Trusted networks

Trusted networks let traffic from a list of CIDRs reach your apps without the WireGuard tunnel and without the per-app ACL. Useful for server-to-server calls and IoT devices that can’t run WireGuard.

The list lives in proxy.trusted_networks in config.yaml. It’s empty by default — no networks are trusted until you opt in. Add the smallest CIDR that covers the devices you actually want to bypass the tunnel for.

Caution

Trusted networks bypass per-member access control. Anything in the CIDR can reach every app on the server, regardless of who owns it or who’s been granted access. Don’t widen the list to networks that include untrusted devices. 0.0.0.0/0 is a footgun, never use it.

When to use it

• A Home Assistant box on a Pi calling Jellyfin on the main server.
• One self-hosted container making API calls to another on the same LAN.
• Smart-home gear (cameras, sensors) that can’t speak WireGuard.
• A laptop on your home Wi-Fi that you’d like to use without tapping Connect every time.

If a member can run the atreoLINK app, prefer the tunnel. Trusted networks are for the cases where the tunnel isn’t an option.

Setup

1. Edit config.yaml and pick the smallest CIDR that covers what you need:

   proxy:
     trusted_networks:
       - "192.168.1.0/24"

2. Restart the agent:

   docker compose restart atreoagent

3. Override DNS on your LAN. Without this, <app>.<yourname>.atreo.link resolves to the WireGuard tunnel target (100.64.0.1, or fd00:64::1 over IPv6), which is only reachable inside the tunnel. You need traffic to actually arrive at the agent’s LAN IP. Two common ways:

   • /etc/hosts on the LAN client:

     192.168.1.10  jellyfin.alice.atreo.link
     192.168.1.10  immich.alice.atreo.link

   • A wildcard DNS entry on your local resolver (Pi-hole, AdGuard Home, your router, BIND):

     *.alice.atreo.link  →  192.168.1.10

4. Verify. From a LAN client, curl https://jellyfin.alice.atreo.link should reach the app without you opening atreoLINK on a phone.

Tip

Once this is in place, the atreoLINK mobile app notices when a member is on this network and opens apps without the tunnel: the server shows an On network badge and an Open button instead of Connect (see On your home network). On iOS, the per-server Skip on local network toggle additionally tears the tunnel down on arrival. Both rely on the same local DNS override above.

How it works

The agent looks at the RemoteAddr on every incoming request. If it falls inside a trusted CIDR, the per-app ACL check is skipped and the request proxies straight through to the app.

The TLS certificate served on the LAN is the same wildcard cert atreoAGENT uses for tunnel traffic.

Custom domains

Trusted networks work the same way for custom domains. Override DNS for *.your-custom-domain.com on your LAN to point at the agent’s LAN IP, and traffic from the trusted CIDR is allowed in without ACL checks.

Removing a trusted network

Edit config.yaml, drop the CIDR, restart. Existing connections aren’t torn down, but new requests from the removed CIDR fall back to ACL enforcement (and will be rejected because they don’t have a tunnel session).