Protect Your App Server with Sunray Zero Trust¶
Sunray asks who a visitor is before your application ever sees the request. It is switched on by the App Definition your App Server was created from, not from this screen. What is yours here is the list of addresses allowed straight through, on the App Server's Access tab.
Sunray protects a name, not a server¶
An App Server answers to several names, and each one is guarded on its own:
| Name | Example |
|---|---|
| its direct name | myapp-main-prod-acme.msa2-1.lair.ovh |
| its public name | myapp-main-prod-acme.acme.muppy.cloud |
| its IDE | codr-myapp-main-prod-acme.inouk-cloud.ovh |
| your Custom Domain | erp.acme.com |
Every name served by an application Sunray protects is covered, a Custom Domain you add later included — the name is guarded as soon as the application is reconfigured with it.
An application you deactivate leaves the list Muppy publishes, and Sunray drops the protected host at its next synchronisation.
One sign-in per name
Sessions are per host name. Someone who signs in on your Custom Domain and then follows a link to the Muppy name is asked to sign in again. This is the same rule as for the application's own sessions.
Who can sign in¶
Two groups, and you change both from Manganese rather than from this tab:
- The administrators of your company — every active Manganese user of the App Server's company who holds the admin role. Promote a user to admin and they gain access; demote them and they lose it.
- The App Server's owner — the user named in its Owner field.
Users who have never set a password, and accounts still waiting on their signup email, are not published to Sunray: an account nobody can sign in with is not an account that should open a door.
Allowed CIDRs — the control that is yours¶
Sunray Allowed CIDRs sits on the Access tab. It lists the addresses and ranges that reach the application without being asked to sign in — an office, a VPN, a monitoring probe.
One entry per line, # opens a comment:
192.168.1.0/24 # Office network
10.0.0.0/8 # VPN
234.170.10.5 # A single address
234.170.10.5/32 # The same one, written as a range
Leave it empty and nothing is allowed through without signing in — which is the point of Sunray, and the right default.
The Parsed CIDRs box next to it shows what Muppy understood. An entry it cannot read is reported as invalid instead of being silently dropped, so a typo costs you a warning rather than an open door or a locked one.
Changes are not immediate
Sunray applies the list at its next synchronisation — every 5 minutes by default. An immediate test measures the previous list.
When you cannot get in¶
| What you see | What it means |
|---|---|
| a sign-in prompt you did not expect | your address is not in Sunray Allowed CIDRs, or the edit has not propagated yet |
| signed in, then refused | your account is neither an administrator of the App Server's company nor its owner |
| refused on your Custom Domain, fine on the Muppy name | the application serving your Custom Domain has not been reconfigured since you set the name |
403 on every name, for everyone |
an IP whitelist on the application itself, which is a different control — see Network Configuration |
Setting up Sunray in front of an App Server — the Traefik side, the shared token, the checks — is covered by How to Protect Your App Servers with Sunray Zero Trust.