Lunar Dedicated
Lunar Dedicated is a single-tenant Lunar install that Earthly provisions, operates, and upgrades end-to-end in a dedicated AWS account, reachable only over private networking.
Lunar Dedicated is a fully managed, single-tenant Lunar install. Earthly provisions, operates, and upgrades it end-to-end in an AWS account dedicated to you, and it runs behind private networking that you reach from your own network. It's for teams that want Lunar's guardrails without running the Hub themselves.
This page explains how it works, who it fits, and what Earthly needs from you to stand one up.
Lunar Dedicated is a managed offering, distinct from the self-hosted Lunar Hub. With Dedicated, Earthly runs the infrastructure; with the self-hosted Hub, you do. The CLI and CI agent are installed and configured the same way in both.
How it works
One dedicated AWS account. The strongest isolation AWS offers — a hard billing and security boundary, with nothing else running inside it.
Earthly operates it by assuming an IAM role. Management is identity-based, so Earthly needs no VPN or peering to run your install.
The hub is private. You reach it over PrivateLink or a joined network (peering / Transit Gateway). The only thing exposed to the public internet is a locked-down GitHub webhook listener.
Your data stays in the install. Authoritative state (Postgres), run inputs and outputs (S3), and secrets all live in your dedicated account and region. Earthly stores none of your data centrally.
Earthly manages the whole lifecycle. Provisioning, version upgrades, patching, and monitoring — on a maintenance schedule you choose.
Requirements
Lunar Dedicated fits cleanly when the following are true:
A network to connect from
An AWS VPC you can peer/route to the install, or that can reach a PrivateLink endpoint. The hub is private and never exposed to the public internet.
Network-reachable CI
The Lunar CLI and CI agent must run where they can reach the private hub — self-hosted runners in your network, or runners with VPN/PrivateLink access.
An outbound allowlist you can permit
The install needs egress for operational telemetry, container image pulls, and AWS APIs.
A single region
Each install lives in one AWS region.
A GitHub App
You create a GitHub App and install it on the org(s) and repositories Lunar should monitor.
Coming soon. Support for GitHub-hosted (public) CI runners, connecting with no existing AWS footprint (site-to-site VPN), and multi-region or high-availability installs are on the roadmap.
Need a fully air-gapped, no-egress install? Dedicated isn't air-gapped — it requires outbound egress to operate. For an air-gapped environment, the self-hosted Lunar Hub is a better fit — book a demo to work with us.
How you connect
Every install is private. There are two ways to reach it — Earthly helps you pick based on where your CI runs and whether Lunar needs to reach systems that aren't on the public internet.
PrivateLink (typical starting point)
Joined network (peering / Transit Gateway)
What it is
Private one-way "doors" between your network and the install
Your network and the install's network are routed together
Reaching the hub
Through one private endpoint you create
Over the joined network, at a private address
Lunar reaching your internal systems
One private door per internal target
Anything your routes and firewall rules allow
Address coordination
None — address ranges can overlap freely
Address ranges must not overlap
Best when
You want tight, per-service exposure and minimal coordination
You already run a Transit Gateway, or Lunar needs many internal targets
Lunar's collectors, catalogers, and policies run inside your install and reach out to the systems they gather data from — which, for a dedicated customer, may be internal (internal Git, registries, ticketing, internal APIs). That's why connectivity is two-way, and why onboarding asks where your CI runs and what your collectors need to reach.
What Earthly needs from you
These answers shape your install:
Region
Where the install (and your data) lives
Connectivity
PrivateLink or joined network — plus where your CI runs, and whether collectors need internal systems
DNS
Use Earthly's subdomain (you.dedicated.earthly.dev), or delegate a subdomain of your own (e.g. lunar.yourco.com) for Earthly to manage
GitHub App
You create it and tell us the org(s)/repos it's installed on
Sizing
Rough org/repo count and CI volume, which maps to a t-shirt size (final sizing confirmed together)
Maintenance windows
A recurring weekly app window and a monthly infra window, in your timezone
Contacts
An operations contact (for maintenance notices) and a security contact (for incidents)
WAF (optional)
A web-application firewall on the public webhook listener — off by default, or on with a rule group you provide
Setup
Earthly handles initial provisioning and setup. This includes account creation, infrastructure provisioning, bringing up your hub, every upgrade (within your chosen window), version selection, monitoring, backup/restore, and clean offboarding.
However, we do need some help from your end.
What you do
Kickoff
Answer the questionnaire above. These answers parameterize your install.
Create your GitHub App
Create a GitHub App and install it on your org. Use the hosted setup tool, or see manual GitHub App setup if your security review needs every permission laid out first. Hand Earthly the App ID and the org(s) it's installed on.
Go live
Earthly provisions the install and hands you an access token plus your install's Grafana login. Then:
Load your workload secrets (the API keys your catalogers, collectors, and policies need) via the CLI:
Complete one network step — for PrivateLink, create the inbound endpoint(s), and coordinate with Earthly; for a joined network, accept the network join and add the routes Earthly provides (usually your networking team). If you delegated a subdomain, add the NS records Earthly provides to hand off the zone — Earthly manages every record and the TLS cert under it.
Maintenance and upgrades
The Earthly team manages Lunar Hub updates for you; you choose when upgrades land. There are two recurring maintenance windows:
A weekly app window for routine Lunar version bumps — a brief hub restart.
A monthly infra window for node patches, add-on updates, and the occasional Kubernetes upgrade.
The hub runs as a single replica, so each upgrade is a brief, scheduled pause while it restarts. Planned windows are excluded from the uptime clock. Critical security patches and forced version deprecations can land out-of-window, with notice.
Security and data
How a Dedicated install handles isolation, data, secrets, and audit:
Exclusive, isolated account. Your install runs alone in a dedicated AWS account — no other workloads.
Your data stays put. Authoritative state (Postgres), run inputs/outputs (S3), and secrets all live in your dedicated account and region. Earthly stores none of your data centrally.
Secrets are encrypted at rest. Your GitHub App credentials and your workload secrets (API keys) live encrypted inside your install — workload secrets go straight to your hub via the CLI, never through Earthly's central systems.
Full audit visibility. Every action Earthly's roles take is recorded in AWS CloudTrail.
Defined data lifecycle. Run inputs and outputs are retained 30 days. On exit, Earthly returns your data (a portable database dump plus your storage buckets) and provably deletes the install by destroying its encryption keys, with the deletion recorded in CloudTrail.
Operational telemetry is required. The install sends metrics and logs back to Earthly so it can monitor the install and meet the SLA. This covers operational data only — never your source code, data, or secrets — and Earthly details exactly what it includes in your security review. If you need telemetry fully off, the self-hosted Lunar Hub is a better fit — book a demo.
Custody is audited, not zero-knowledge. Your secrets are encrypted with a key that lives inside your account and is readable only by the hub. Routine operation can't read your secrets, and any access that could is a deliberate, audited action. It is not a cryptographic guarantee that Earthly cannot read them. If you need hard zero-knowledge, the self-hosted Lunar Hub is the better fit — book a demo.
What's included
A single-tenant, fully managed Lunar install in a dedicated AWS account
Private hub access via PrivateLink or a joined network
A single region per install
Full lifecycle management: provisioning, upgrades, patching, monitoring, backup/restore, and clean offboarding
Next steps
Earthly walks through the model live, answers your security team's questions, and maps out what onboarding looks like for your environment.
Last updated