Network Endpoints¶

This page lists the external hosts GeoLibre contacts, grouped by feature, so that reviewers and operators can see what leaves the device and decide what to allow. It complements the Privacy Policy, which explains what is sent, and Self-Hosting, which explains how to keep a deployment internal.

The list reflects the source as of GeoLibre v3.6.1 (November 2026). It is maintained by hand; see Keeping this page current.

How to read this page¶

Each entry is marked:

• Default: contacted without the user choosing that service, for example the default basemap at startup.
• Opt-in: contacted only when the user picks that data source, plugin, tool, or service, or opens a project that uses it.

The Builds column says which builds make the request: desktop (Tauri), web (the browser build, hosted or Docker), and Jupyter (the geolibre Python widget, which embeds the web build). "All" means all three.

The Route column says how the request travels:

• Direct: from the user's browser or webview (or the desktop app's native HTTP client) straight to the host.
• Relay: through a GeoLibre-operated proxy. The relays are described under GeoLibre-operated hosts. A relay sees the request (including any area of interest or query) and forwards it to a fixed upstream.

Requests to the app's own origin (the web build's assets, deployment.json, geolibre-runtime-config.js, and the Docker image's /sidecar proxy to the local Python sidecar) are not external and are not listed. Neither are user supplied URLs (a WMS endpoint, a COG URL, an S3 bucket) or the data hosts a project's layers point at: GeoLibre fetches whatever the user or project points it at. A network allowlist built from this page alone will block those layers, so add the hosts your projects use.

Default requests¶

These are the requests this page found a fresh install making without the user choosing a service, from a review of the source rather than an automated check. GeoLibre has no telemetry and no crash reporting in any build; the only analytics are page-visit counts in a web build that sets a Google Analytics measurement ID (see the last row).

Three hosted builds go further than this because the OpenGeos project configures them: the hosted web builds (geolibre.app/demo, web.geolibre.app, studio.geolibre.app) bake in wss://collab.geolibre.app so the Collaborate menu works, and studio.geolibre.app also bakes in https://ai.geolibre.app for the AI assistant. Neither connects until the user starts a session or sends a prompt. The desktop release, the Jupyter wheel, and the Docker image configure neither.

Three built-in plugins are active in a fresh project (Layer Control, Deck.gl Layer, and Atmospheric Effects). None of them makes a request until the user builds a visualization with it.

GeoLibre-operated hosts¶

These hosts are run by the OpenGeos project, currently on Cloudflare (Workers, Durable Objects, R2) and GitHub Pages. All of them are opt-in except the plugin registry and blocklist above.

The tiles.geolibre.app relay¶

Every route forwards to fixed upstreams from an allowlist (workers/tiles/src/allowlisted-fetch.ts); it is not an open proxy. Where the desktop app can reach an upstream directly with its native HTTP client, it does so and skips the relay; the table notes those cases.

Opt-in: core features¶

Opt-in: built-in plugins¶

Every plugin here makes requests only once the user turns it on, uses it, or opens a project in which it was active. Catalog plugins with many portals are summarised by host family; follow the source file for the full list. Paths are under packages/plugins/src/plugins/.

External plugins (from the registry, a zip, or a manifest URL) can contact any host the CSP allows, and GeoLibre does not track which. On the desktop, app.nativeFetch sends a plugin's requests through the native HTTP client, which the webview CSP does not govern. It can reach loopback and private LAN addresses; it refuses only link-local addresses (including the 169.254.169.254 cloud metadata address), unspecified, multicast, and the limited broadcast address 255.255.255.255. Other metadata endpoints, such as AWS's IPv6 fd00:ec2::254, and subnet-directed broadcasts are not blocked. Review a plugin before allowing it, and use plugins.allowed to limit which ones load (see Plugin API).

Differences between builds¶

• Desktop adds the startup update check and the Python sidecar bootstrap. It reaches some upstreams directly (OpenAerialMap, Source Cooperative, Ocean Data Platform features, Earthdata downloads) where the web build needs the relay, through GeoLibre's own Rust commands (fetch_url_bytes and related, wrapped by apps/geolibre-desktop/src/lib/native-http.ts), which bypass CORS. Separately, the Tauri HTTP plugin that page code can call is scoped to the sidecar, the geocoders, share.geolibre.app, datasets.geolibre.app, and api.typesafe.ai (src-tauri/capabilities/default.json).
• Web hosted by the OpenGeos project adds Google Analytics and the baked-in collaboration (and, on studio.geolibre.app, AI) URLs. A Docker deployment adds neither; a self-built web deployment adds them only if it sets the same build variables.
• Jupyter serves the bundled web build from the Jupyter server, so the app assets and deployment.json are local; map and data requests are the same as the web build. The Python package itself makes network requests only for GeoJSON URLs passed to it.

Restricting network access¶

• deployment.json turns off or redirects the GeoLibre-operated services: sharing.shareUrl: "off", sharing.collabUrl, plugins.registryUrl, plugins.allowed and plugins.sideload, services.builtins: false and a curated services.catalog, geolens.url, and ai.enabled.
• Interface profiles (interface.hiddenDataSources, interface.hiddenPlugins, interface.hiddenMenuItems) hide data sources, plugins, and menu items so users do not reach them. See UI Profiles. This hides entry points; it is not a network control.
• Build flags. GEOLIBRE_NO_EXTERNAL_CDN=1 strips GeoLibre's own CDN references (jsDelivr, unpkg, the language pack host); see Self-Hosting. VITE_PYODIDE_INDEX_URL, VITE_DUCKDB_SPATIAL_EXTENSION_PATH, VITE_ROUTING_ENDPOINT, and the geocoder settings point those features at internal hosts.
• Content Security Policy. connect-src and img-src allow any https: host in both the desktop app (tauri.conf.json, which also allows http:) and the Docker image (docker/nginx.conf), so the CSP does not limit which data hosts are reached. Only script-src is pinned to specific CDN paths. An operator who needs a host allowlist should enforce it with an egress proxy or firewall and include the data hosts its projects use as well as the hosts on this page. To restrict browser requests with CSP instead, narrow both connect-src and img-src (and review media-src and frame-src) in a derived image.
• Relays. A browser-side control (CSP or an egress rule on the client) only sees the request to tiles.geolibre.app, not the upstream the relay then contacts. If an upstream listed under the relay is not acceptable, block tiles.geolibre.app itself, which disables the features that use it. On the desktop some of those features reach the upstream directly instead (see Differences between builds), so block the upstream host as well with an egress proxy or firewall.

Self-Hosting: Reducing outbound requests has the per-feature checklist.

Keeping this page current¶

This page is written by hand from the source. A change that adds a host the app contacts (a new basemap, plugin, relay route, CDN asset, or default service) should add it here in the same pull request, and say whether it is default or opt-in. Useful starting points for an audit:

grep -rhoE "(https?|wss?)://[a-zA-Z0-9.-]+" packages apps/geolibre-desktop/src workers \
  --include='*.ts' --include='*.tsx' --include='*.json' | sort | uniq -c | sort -rn

plus workers/tiles/src/allowlisted-fetch.ts for relay upstreams and the maplibre-gl-* packages in packages/plugins/package.json, which carry hosts of their own.