Network requirements

Reference for users and administrators operating Lumen behind commercial firewalls, filtered DNS or restricted outbound networks.

Lumen remains a local Frigate client by default. LorisLabs-operated services are contacted only for the corresponding user-enabled cloud feature. Camera live streams and Frigate credentials are not sent through these services.

Destination	When required	Purpose	Impact if unavailable
`relay.lorislab.fr:443` HTTPS/WSS	Apple Bridge, Web Settings or Auto Call	Pairing, scoped credentials, synchronization and relay discovery	The enabled relay-backed feature cannot pair or synchronize. Local Frigate viewing remains available.
`referrals.lorislab.fr:443` HTTPS	Optional referrals	Signed referral entitlement and Universal Links	Referral status cannot refresh; the last valid signed cache remains.
`settings.lorislab.fr:443` HTTPS	Optional Web Settings	Canonical browser application	Browser settings are unavailable; in-app settings remain.
`lumen-settings.lorislab.fr:443` HTTPS	Compatibility only	Redirect for old builds and saved links	Old links fail. Current builds use `settings.lorislab.fr`.
`lumen-push.mail5491.workers.dev:443` HTTPS	Instant Push	Push registration and delivery	Instant Push cannot register or deliver. Apple Bridge and live-only operation are separate.
`lorislab.fr:443` HTTPS	Documentation	Help, privacy policy and terms	Documentation and legal pages cannot open from the app.
User-configured Frigate endpoint	Core operation	API, snapshots and live streams	Camera and event functionality is unavailable.

Apple services

Apple Push Notification service and CloudKit access must follow Apple's maintained enterprise-network guidance. Do not replace Apple's current hostname guidance with a static third-party IP allowlist.

Administrator validation

A DNS failure proves only that the name cannot be resolved from that network path. It does not identify the filtering vendor.

dig +short relay.lorislab.fr
curl --fail --show-error --max-time 10 https://relay.lorislab.fr/health

dig +short referrals.lorislab.fr
curl --fail --show-error --max-time 10 https://referrals.lorislab.fr/healthz

curl --fail --show-error --max-time 10 https://lorislab.fr/privacy.html
curl --fail --show-error --max-time 10 https://lorislab.fr/terms.html

Diagnostics and privacy

Lumen classifies observed DNS, TLS, timeout and HTTP failures without claiming which firewall caused them. Its diagnostic export contains only the public hostname, symptom class and check time—not resolved IPs, resolver addresses, authentication tokens or cloud payloads.

DNS change control

Search every known client and infrastructure repository for the hostname.
Identify the owner and active versions still depending on it.
Validate any replacement from at least two independent networks.
Obtain the approvals specified in the machine-readable domain registry.
Retain rollback evidence and monitor DNS, TLS and application health.