Lunar Network
Lunar Systems is building the network behind Astra and Heimdall to run on dedicated servers we operate ourselves, not on a cloud provider's compute. Every layer is designed the same way: nodes only dial out, people approve what machines cannot, and emergency calls are never held back by a balance or a fraud check.
Status: PlannedWe are establishing our own ASN and IP address space.
The first point of presence is being brought up. Most of this page describes what is designed and built in code but not yet in service, so every part carries its status. Of everything on this page, only the four DNS and TLS settings on lunarsystems.io are live today.
A voice network meets the open internet on every call: floods, scanners, password guessing against SIP accounts, toll fraud. The machines that carry those calls are worth attacking in their own right. These rules decide how every layer is built.
Astra is built to run on dedicated servers that Lunar operates, not on a cloud provider's compute. Every session border controller (SBC), point of presence and control-plane machine is ours to run, and Lunar builds it and looks after it itself; no third party runs it for us. Tenants bring their carriers, numbers, certificates and brand, never hardware.
Status: In developmentThe first point of presence is delivered and being brought up.
Each edge node opens its own encrypted, mutually authenticated connection to the control plane. The control plane never reaches in to a node, and the node's image is designed to carry no remote shell to reach.
Status: In developmentBuilt in code, not in service yet.
Releasing or re-imaging a node that detection has flagged takes a signed approval from a named person. No control-plane service holds a key that could sign it.
Status: In developmentThe approval signer is built, not deployed yet.
Five rings, from the open internet to the people who approve. A call is decided at the outer ring; the inner rings hold the records, the keys and the approvals.
01 Edge
Calls are designed to arrive at an active/standby SBC pair. The firewall admits only known SIP peers, the SBC checks every message, and routing is decided right here, on the edge node. Media is anchored at the SBC and accepted only from the negotiated source.
Status: In developmentFirst SBC delivered. Its standby comes before live traffic.
02 Fabric
Each node dials out to the control plane over an encrypted, mutually authenticated link. Call records, signed configuration and health data travel over it. The control plane never dials in.
Status: In developmentBuilt in code, not in service.
03 Control
Routing data, rating, call records and the audit log. Tenant isolation is enforced in the database, every request is permission-checked, and the audit log is append-only and hash-chained. The staff console is designed to be reachable only over a private network, never from the public internet.
Status: In developmentBuilt in code, not in service.
04 Keys
Each tenant is designed to sign its calls with its own STIR/SHAKEN certificate. Approval keys are non-exportable and live in a separate key store that only the approval signer uses, on a network of its own.
Status: In developmentApproval signer built, not deployed; per-tenant STIR/SHAKEN signing in development.
05 People
Releasing or re-imaging a flagged node, and opening break-glass access, need a named person's own WebAuthn assertion, with user verification. No service can stand in for them, and every signature is logged, append-only.
Status: In developmentThe approval signer is built, not deployed; break-glass access is planned.
The SBC at a point of presence is where every call's signalling and media arrive. We build it as a sealed appliance, not as a server someone logs in to.
Status: In developmentDesigned; the image's sources are written, and the first build attempts have not yet produced a release image. No node runs it yet.
All of this happens on the SBC itself, before a call is admitted or routed.
No remote shell in the image. Updates are designed to land in a spare A/B slot and to roll back on their own if the new version fails its checks.
Each update's manifest is designed to be signed and checked by the node before it switches slots. Releases are designed to be signed, to ship with a software bill of materials, and to need two people.
Status: In developmentNo release has shipped through this path yet. Writing updates to the spare slot is planned.
By design there is no everyday login to an edge node: access is break-glass only, and it takes two people, a signed grant and a recording.
A person asks for access to one node, with a reason and a time limit.
A separate security approver agrees, or it goes no further.
The grant is signed, and the node verifies the signature before it opens anything.
The session runs in a recorded shell, streamed off the node over the connection the node itself opened.
They connect with a short-lived certificate, and the grant has its own time limit.
Status: PlannedThe recorded shell is not built yet, so break-glass access is not in service.
Status: In developmentBuilt, not deployed.
Status: PlannedDecided, not built.
Detection is self-hosted and open source, designed so host telemetry never leaves Lunar's own systems. There is no cloud-hosted endpoint detection (EDR) service.
Status: In developmentBuilt, not in service.
No detection or response ever stops the SBC's call software directly. An SBC is contained by failing over and by quarantine.
A compromised machine that is not an SBC is isolated from the network, except for management and monitoring.
Isolating any machine whose loss would block customers' calls needs a person's approval, just as re-imaging does.
Every automatic action is audited, can be reversed, and pages a person at Lunar. The watchers are watched too: a missing heartbeat or a stopped agent is an alert in itself.
911 and 933 are designed to skip every credit, spend and fraud check, and to route when everything else fails.
From any known trunk or account, an emergency call is designed to skip credit checks, spend caps and fraud locks, and to route even when the account is suspended. It is designed to keep working through every containment state, quarantine included. If the SBC cannot reach its own decision service, emergency calls are designed to route from data held on the SBC itself.
Status: In developmentDesigned so; the normal and degraded routes are exercised in end-to-end tests; the quarantine case is not tested yet. Not in service.
US voice runs on trust between carriers. Astra is built to sign what it sends and to answer blocks the way the FCC's rules require.
Each tenant is designed to sign its calls with its own STIR/SHAKEN certificate, not a shared one. The edge is designed to check the signatures on incoming calls; that check is still being completed.
Status: In developmentSigning and verification are both in development.
A call blocked on the strength of analytics is designed to be answered with SIP 603+, which carries a redress contact, so whoever placed it knows where to dispute the block.
Status: In developmentBuilt and proven in test. Not live until counsel approves the redress page and its mailbox exists.
Stated precisely, including the places where data does leave our servers.
Status: In developmentDesigned in; not in service.
Status: Planned
We are establishing our own autonomous system number (ASN) and IP address space. Neither is registered yet, and until they are, our servers use the addresses that come with them.
Why it matters: the network-level DDoS scrubbing we plan for our voice points of presence works on address space we hold ourselves. That scrubbing is planned for a later milestone, once the addresses are ours.
More points of presence are planned too. We will list them here when they exist.
Applied on 24 September 2026. Anyone can check these from outside with standard DNS and TLS tools.
Green means live, and only the first row is. Everything else is in development or planned, and says so.
| Part | Status and where it stands |
|---|---|
| DNSSEC, HTTPS only, TLS 1.2 minimum and CAA on lunarsystems.io | LiveApplied 24 September 2026. |
| First point of presence and SBC | In developmentDelivered; being brought up. |
| Standby SBC for the active/standby pair | PlannedBefore live traffic. |
| Hardened, measured-boot SBC image with TPM-bound encryption | In developmentDesigned; the image's sources are written, and the first build attempts have not yet produced a release image. |
| SIP edge protections | In developmentWritten into the SBC configuration and partly proven in test; not in service. |
| Outbound-only encrypted fabric | In developmentBuilt in code; not in service. |
| Default-deny firewalls on every machine | In developmentDesigned so; applied to each machine as it is brought up. |
| Approval signer: people approve, machines can't | In developmentBuilt, not deployed. |
| Detection and containment | In developmentBuilt; not in service. |
| 911 and 933 ahead of credit, spend and fraud checks | In developmentDesigned so; the normal and degraded routes are exercised in end-to-end tests; the quarantine case is not tested yet. |
| STIR/SHAKEN signing per tenant, and verification | In developmentBoth in development. |
| SIP 603+ answers with a redress contact | In developmentBuilt and proven in test; not live until counsel approves the redress page and its mailbox exists. |
| CPNI handling | In developmentDesigned in. |
| Signed updates with A/B rollback | In developmentVerification built; no release shipped this way yet. |
| TPM-resident node identity, the recorded break-glass shell, writing updates to the spare slot | PlannedNot built yet. |
| Two-person release | PlannedIn the design. |
| Self-hosted secrets store | PlannedDecided, not built. |
| Pass-through endpoints for Heimdall's customers | PlannedDecided, not built. |
| Our own ASN and IP space | PlannedEstablishing; not registered. |
| Network-level DDoS scrubbing for voice | PlannedNeeds our own address space first. |
| More points of presence | PlannedLater. |
Questions about the network, its security design, or where a part stands? Write to us and we will answer. We would rather explain a design choice than have you guess at it.