Run Without Internet Access (Sovereign Mode)¶
Sovereign mode is for consoles on networks with no internet access, or where nothing may leave the site. When it is on, the console, and the work it sends to nodes, may only reach:
- private addresses (10.x, 172.16–31.x, 192.168.x, loopback, link-local), and host names that resolve only to them;
- the hosts on the allowed outside hosts list.
Anything else fails at once, with an error that names Settings → Sovereign Mode, instead of waiting for a firewall to time it out.
Turn it on¶
Settings → Sovereign Mode, as a Super Admin. Tick Sovereign mode, add any outside hosts you do want to allow, and Save.
Allowed outside hosts take one entry per line:
| Entry | Allows |
|---|---|
mirror.example.com |
that host only |
.example.com or *.example.com |
that domain and all its subdomains |
203.0.113.10 |
that address |
203.0.113.0/24 |
that range |
What it affects¶
| Feature | With an outside host blocked |
|---|---|
| Update check (Docker Hub) | skipped |
| License heartbeat | skipped; the license keeps its edition, because keys verify offline |
| Notification channels (webhook, Teams, email, syslog) | the delivery log shows the reason |
| Single sign-on (OIDC) | sign-in fails with the reason |
| AI assistant | the chat shows the reason |
| AWX | the run fails with the reason |
| Cloud backup, restore and restore checks (S3), control-plane backup | refused, or skipped with a warning when scheduled |
| Kubernetes create and scale, storage and networking add-ons | refused before anything starts |
| Marketplace apps | refused before anything starts |
Container images from images:/ubuntu: and the TurnKey marketplace |
refused |
| Download image by URL | refused |
| VM with the Docker app stack | refused |
| Node setup steps that use ELRepo, OpenZFS, Debian or the virtio-win mirror | skipped or failed with the reason |
The status list under the setting shows every outside endpoint the console knows about, including the ones you configured (notification channels, single sign-on, the AI assistant, AWX, S3), and whether each one is blocked.
Node operating system repositories
Sovereign mode doesn't change the nodes' own dnf/apt repositories.
Point them at an internal mirror, or nodes can't install packages.
Updating the console¶
The update check can't reach Docker Hub in sovereign mode. Bring each release in as a signed bundle instead: see Update a Console Without Internet Access.
API¶
GET /api/settings/sovereign, PUT /api/settings/sovereign (audited) and
GET /api/settings/sovereign/status, all Super Admin only.