Network allowlist configuration

Within secure networking contexts, you may need to configure allowlists to use Determinate, including FlakeHub and FlakeHub Cache, properly. This document lists domains that you should consider required across the board as well as some optional domains that may be required in some cases.

Domains

Required domains

These domains should be allowlisted in all cases:

• flakehub.com
• cache.flakehub.com
• api.flakehub.com
• flake-archives.flakehub.com
• determinate.systems
• install.determinate.systems
• *.install.determinate.systems

Optional domains

In some cases, you may also want to allowlist some GitHub and Microsoft Entra domains.

GitHub domains

We recommend allowlisting these domains if you’re using GitHub sign-in to FlakeHub in the browser:

• github.com
• api.github.com

Entra domain

If you’re using Microsoft Entra for authentication, you will likely need to allowlist this domain:

• login.microsoftonline.com

Okta domain

If you’re using Okta for authentication, you may need to allowlist the Okta domain for your tenant:

• <tenant>.okta.com

IP Addresses

All services in Determinate Gov, our FedRAMP High environment, use the following IP address blocks:

• IPv6: 2606:c220::/36
• IPv4: 206.209.218.0/24

FlakeHub will try to reach your IdP and code forge APIs from these IP addresses. You may need to configure ingress and egress rules for FlakeHub to work properly.