> For the complete documentation index, see [llms.txt](https://docs-lunar.earthly.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs-lunar.earthly.dev/install/dedicated.md).

# Lunar Dedicated

Lunar Dedicated is a fully managed, single-tenant Lunar install. Earthly provisions, operates, and upgrades it end-to-end in an AWS account dedicated to you, and it runs behind private networking that you reach from your own network. It's for teams that want Lunar's guardrails without running the [Hub](/install/lunar-hub/hub-overview.md) themselves.

This page explains how it works, who it fits, and what Earthly needs from you to stand one up.

{% hint style="info" %}
Lunar Dedicated is a managed offering, distinct from the self-hosted [Lunar Hub](/install/lunar-hub/hub-overview.md). With Dedicated, Earthly runs the infrastructure; with the self-hosted Hub, you do. The CLI and CI agent are installed and configured the same way in both.
{% endhint %}

## How it works

```mermaid
flowchart LR
  GH["GitHub.com"]

  subgraph Earthly["Earthly (management account)"]
    Mgmt["Deploy and operate tooling"]
  end

  subgraph Dedicated["Your dedicated AWS account"]
    Hub["Lunar Hub<br/>(private)"]
    WH["Webhook listener<br/>(public)"]
    Data[("Postgres · S3 · secrets")]
    Hub --> Data
  end

  subgraph You["Your network"]
    CI["CI runners · Lunar CLI"]
  end

  Mgmt -- "assume-role (IAM)" --> Dedicated
  CI -- "PrivateLink / peering" --> Hub
  GH -- "webhooks" --> WH
```

* **One dedicated AWS account.** The strongest isolation AWS offers — a hard billing and security boundary, with nothing else running inside it.
* **Earthly operates it by assuming an IAM role.** Management is identity-based, so Earthly needs no VPN or peering to run your install.
* **The hub is private.** You reach it over PrivateLink or a joined network (peering / Transit Gateway). The only thing exposed to the public internet is a locked-down GitHub webhook listener.
* **Your data stays in the install.** Authoritative state (Postgres), run inputs and outputs (S3), and secrets all live in your dedicated account and region. Earthly stores none of your data centrally.
* **Earthly manages the whole lifecycle.** Provisioning, version upgrades, patching, and monitoring — on a [maintenance schedule](#maintenance-and-upgrades) you choose.

## Requirements

Lunar Dedicated fits cleanly when the following are true:

| Requirement                              | Detail                                                                                                                                                                                                  |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **A network to connect from**            | An AWS VPC you can peer/route to the install, or that can reach a PrivateLink endpoint. The hub is private and never exposed to the public internet.                                                    |
| **Network-reachable CI**                 | The Lunar CLI and [CI agent](/install/lunar-ci-agent/agent-self-hosted.md) must run where they can reach the private hub — self-hosted runners in your network, or runners with VPN/PrivateLink access. |
| **An outbound allowlist you can permit** | The install needs egress for operational telemetry, container image pulls, and AWS APIs.                                                                                                                |
| **A single region**                      | Each install lives in one AWS region.                                                                                                                                                                   |
| **A GitHub App**                         | You create a GitHub App and install it on the org(s) and repositories Lunar should monitor.                                                                                                             |

{% hint style="info" %}
**Coming soon.** Support for GitHub-hosted (public) CI runners, connecting with no existing AWS footprint (site-to-site VPN), and multi-region or high-availability installs are on the roadmap.
{% endhint %}

{% hint style="info" %}
**Need a fully air-gapped, no-egress install?** Dedicated isn't air-gapped — it requires outbound egress to operate. For an air-gapped environment, the [self-hosted Lunar Hub](/install/lunar-hub/hub-overview.md) is a better fit — [book a demo](https://earthly.dev/book-demo/) to work with us.
{% endhint %}

## How you connect

Every install is private. There are two ways to reach it — Earthly helps you pick based on where your CI runs and whether Lunar needs to reach systems that aren't on the public internet.

|                                        | **PrivateLink** (typical starting point)                      | **Joined network** (peering / Transit Gateway)                          |
| -------------------------------------- | ------------------------------------------------------------- | ----------------------------------------------------------------------- |
| What it is                             | Private one-way "doors" between your network and the install  | Your network and the install's network are routed together              |
| Reaching the hub                       | Through one private endpoint you create                       | Over the joined network, at a private address                           |
| Lunar reaching *your* internal systems | One private door per internal target                          | Anything your routes and firewall rules allow                           |
| Address coordination                   | None — address ranges can overlap freely                      | Address ranges must not overlap                                         |
| Best when                              | You want tight, per-service exposure and minimal coordination | You already run a Transit Gateway, or Lunar needs many internal targets |

{% hint style="info" %}
Lunar's collectors, catalogers, and policies run *inside* your install and reach out to the systems they gather data from — which, for a dedicated customer, may be internal (internal Git, registries, ticketing, internal APIs). That's why connectivity is two-way, and why onboarding asks where your CI runs and what your collectors need to reach.
{% endhint %}

## What Earthly needs from you

These answers shape your install:

| What                    | Why                                                                                                                                        |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| **Region**              | Where the install (and your data) lives                                                                                                    |
| **Connectivity**        | PrivateLink or joined network — plus where your CI runs, and whether collectors need internal systems                                      |
| **DNS**                 | Use Earthly's subdomain (`you.dedicated.earthly.dev`), or delegate a subdomain of your own (e.g. `lunar.yourco.com`) for Earthly to manage |
| **GitHub App**          | You create it and tell us the org(s)/repos it's installed on                                                                               |
| **Sizing**              | Rough org/repo count and CI volume, which maps to a t-shirt size (final sizing confirmed together)                                         |
| **Maintenance windows** | A recurring weekly app window and a monthly infra window, in your timezone                                                                 |
| **Contacts**            | An operations contact (for maintenance notices) and a security contact (for incidents)                                                     |
| **WAF** (optional)      | A web-application firewall on the public webhook listener — off by default, or on with a rule group you provide                            |

## Setup

Earthly handles initial provisioning and setup. This includes account creation, infrastructure provisioning, bringing up your hub, every upgrade (within your chosen window), version selection, monitoring, backup/restore, and clean offboarding.

However, we do need some help from your end.

### What you do

{% stepper %}
{% step %}

### Kickoff

Answer the [questionnaire](#what-earthly-needs-from-you) above. These answers parameterize your install.
{% endstep %}

{% step %}

### Create your GitHub App

Create a GitHub App and install it on your org. Use the [hosted setup tool](https://earthly.dev/lunar/github-app-setup/), or see [manual GitHub App setup](/install/lunar-hub/hub-github-app-manual.md) if your security review needs every permission laid out first. Hand Earthly the App ID and the org(s) it's installed on.
{% endstep %}

{% step %}

### Go live

Earthly provisions the install and hands you an access token plus your install's Grafana login. Then:

* **Load your workload secrets** (the API keys your catalogers, collectors, and policies need) via the CLI:

  ```bash
  lunar secret set DATADOG_API_KEY --scope collector   # value read from stdin
  ```
* **Complete one network step** — for **PrivateLink**, create the inbound endpoint(s), and coordinate with Earthly; for a **joined network**, accept the network join and add the routes Earthly provides (usually your networking team). If you delegated a subdomain, add the NS records Earthly provides to hand off the zone — Earthly manages every record and the TLS cert under it.
  {% endstep %}
  {% endstepper %}

## Maintenance and upgrades

The Earthly team manages Lunar Hub updates for you; you choose *when* upgrades land. There are two recurring maintenance windows:

* **A weekly app window** for routine Lunar version bumps — a brief hub restart.
* **A monthly infra window** for node patches, add-on updates, and the occasional Kubernetes upgrade.

The hub runs as a single replica, so each upgrade is a brief, scheduled pause while it restarts. Planned windows are excluded from the uptime clock. Critical security patches and forced version deprecations can land out-of-window, with notice.

## Security and data

How a Dedicated install handles isolation, data, secrets, and audit:

* **Exclusive, isolated account.** Your install runs alone in a dedicated AWS account — no other workloads.
* **Your data stays put.** Authoritative state (Postgres), run inputs/outputs (S3), and secrets all live in your dedicated account and region. Earthly stores none of your data centrally.
* **Secrets are encrypted at rest.** Your GitHub App credentials and your workload secrets (API keys) live encrypted inside your install — workload secrets go straight to your hub via the CLI, never through Earthly's central systems.
* **Full audit visibility.** Every action Earthly's roles take is recorded in AWS CloudTrail.
* **Defined data lifecycle.** Run inputs and outputs are retained 30 days. On exit, Earthly returns your data (a portable database dump plus your storage buckets) and **provably deletes** the install by destroying its encryption keys, with the deletion recorded in CloudTrail.
* **Operational telemetry is required.** The install sends metrics and logs back to Earthly so it can monitor the install and meet the SLA. This covers operational data only — never your source code, data, or secrets — and Earthly details exactly what it includes in your security review. If you need telemetry fully off, the [self-hosted Lunar Hub](/install/lunar-hub/hub-overview.md) is a better fit — [book a demo](https://earthly.dev/book-demo/).

{% hint style="warning" %}
**Custody is audited, not zero-knowledge.** Your secrets are encrypted with a key that lives inside your account and is readable only by the hub. Routine operation can't read your secrets, and any access that could is a deliberate, audited action. It is not a cryptographic guarantee that Earthly *cannot* read them. If you need hard zero-knowledge, the [self-hosted Lunar Hub](/install/lunar-hub/hub-overview.md) is the better fit — [book a demo](https://earthly.dev/book-demo/).
{% endhint %}

## What's included

* A single-tenant, fully managed Lunar install in a dedicated AWS account
* Private hub access via PrivateLink or a joined network
* A single region per install
* Full lifecycle management: provisioning, upgrades, patching, monitoring, backup/restore, and clean offboarding

## Next steps

Earthly walks through the model live, answers your security team's questions, and maps out what onboarding looks like for your environment.

<a href="https://earthly.dev/book-demo/" class="button primary" data-icon="calendar">Book a demo</a>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs-lunar.earthly.dev/install/dedicated.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.