> ## Documentation Index
> Fetch the complete documentation index at: https://ayakaleaf-pro.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# External URL

> Let users add files from external URLs on a Kubernetes deployment, and keep the cluster's internal addresses out of reach.

"From External URL" files (and the files the [Import API](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/integrations/overleaf-import-api.md) and the AI assistant's `web_fetch` download) are fetched by the **linked-url-proxy** service inside every Ayakaleaf Pro pod. It refuses addresses that are not public, so users cannot read internal services through it. The feature and its settings are described in [External URL](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/overleaf-toolkit/external-url.md).

| | |
| - | - |
| Service | linked-url-proxy (`127.0.0.1:3066` in every pod); web shows the menu when `url` is in `ENABLED_LINKED_FILE_TYPES` |
| Pod → outside | the URLs users give, on any port, directly or through `OVERLEAF_LINKED_URL_OUTBOUND_PROXY` |
| State | none |
| Periodic jobs | none: a file is refreshed only when a user asks |

### Configuration

```yaml title="30-config.yaml (additions)" wrap theme={null}
  ENABLED_LINKED_FILE_TYPES: project_file,project_output_file,url
  # Public addresses of your nodes and load balancer, see below
  OVERLEAF_LINKED_URL_BLOCKED_NETWORKS: 203.0.113.0/24 198.51.100.7/32
  # optional
  # OVERLEAF_LINKED_URL_ALLOWED_RESOURCES: ^https?://www\.example\.com/public/
  # OVERLEAF_LINKED_URL_OUTBOUND_PROXY: http://proxy.example.com:3128
```

```bash theme={null}
kubectl apply -f 30-config.yaml
kubectl -n overleaf rollout restart deployment/overleaf     # or statefulset/overleaf
```

### What is blocked on Kubernetes

The proxy refuses every address that is not a public unicast address: loopback, link-local (including the cloud metadata address `169.254.169.254`), the private ranges `10.0.0.0/8`, `172.16.0.0/12` and `192.168.0.0/16`, the carrier-grade NAT range `100.64.0.0/10`, and their IPv6 counterparts. Pod and Service networks in these ranges, which is the default for kubeadm, flannel, Calico and most managed clusters, are therefore blocked without any setting, and so are the in-cluster names such as `redis` or `git-bridge` that resolve to them.

Public addresses are allowed. If your nodes or load balancer have public addresses, add them to `OVERLEAF_LINKED_URL_BLOCKED_NETWORKS` (separated by spaces or commas), so that users cannot fetch the NodePorts or a status page through them.

With `OVERLEAF_LINKED_URL_OUTBOUND_PROXY` set, host names are resolved by the proxy, so only URLs that contain an IP address are checked: the proxy must block your internal networks itself.

### Several replicas

Nothing extra: each pod fetches with its own linked-url-proxy and the same settings.

### Tested on Kubernetes

On Kubernetes 1.37 with three replicas, flannel's pod network `10.244.0.0/16` and kubeadm's service network `10.96.0.0/12`, the proxy refused downloads from a Service's ClusterIP, from the in-cluster names `redis`, `garage` and `overleaf-1.overleaf-hl.overleaf.svc.cluster.local`, and from a node's address, without any `OVERLEAF_LINKED_URL_BLOCKED_NETWORKS`. Our end-to-end tests also pass for refusing loopback and the cloud metadata address through the Import API, and for the AI assistant reading only the pages that `OVERLEAF_LINKED_URL_ALLOWED_RESOURCES` allows.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.