Ports & protocols reference
This is the operations and networking reference for a cell: every listener, its protocol, what it is for, and how it authenticates. It is organized by the nine services and verified against the shipped per-service configuration.
Two rules from the services overview govern the whole table:
- The node service is the only front door. Every external client terminates on a node listener and passes a deny-by-default gate before any backend is reached.
- No backend service is exposed externally in its own right. Backend HTTP/gRPC listeners bind loopback (clear, intra-cell) or an internal mutual-TLS interface; a subset also advertise a mutual-TLS interface on the fabric for cell-to-cell traffic only.
The port-allocation convention
Backend services follow one numbering convention, which makes the whole cell legible at a glance:
| Family | Pattern | Example (data) |
|---|---|---|
| Service HTTP, clear (loopback) | 9<svc>00 | 9600 |
| Service HTTP, mutual TLS | 9<svc>43 | 9643 |
| Service gRPC, clear (loopback) | 59<svc>00 | 59600 |
| Service gRPC, mutual TLS | 59<svc>43 | 59643 |
The <svc> digit runs 1=security, 2=admin, 3=system, 4=metrics,
5=messaging, 6=data, 7=storage, 8=compute, 9=node (internal). The
node service's external listeners sit in the 8xxx range instead, so the
public front door is never confused with an internal control port.
Figure P1: the three network planes. External clients (neutral) reach only the node front door (amber, deny-by-default); backends (filled) bind loopback or internal mTLS; the fabric plane (outlined) carries cell-to-cell mutual-TLS traffic between backends only. The dotted external→backend edge is the path that does not exist. Ceiling: ports shown are the shipped configuration defaults; an operator may rebind or disable any of them.
Table equivalent
| Plane | Who uses it | Binding | Auth |
|---|---|---|---|
| Front door | External clients | node 8xxx / gateway ports | deny-by-default; TLS or mTLS |
| Backend control | Intra-cell callers | 9x00 / 59x00 loopback | local |
| Fabric | Peer cells only | 9x43 / 59x43 on all interfaces | mutual TLS |
node
The single external front door. Public HTTP carries REST, GraphQL, the MCP tool server, static hosting, and the edge REST/WebSocket/DoH/bundle/discovery routes.
| Port | Protocol | Bind | Purpose | Auth |
|---|---|---|---|---|
| 8080 | HTTP | 0.0.0.0 (public) | Public REST / GraphQL, MCP tool server, static hosting, edge REST/WS/DoH/bundle/discovery | Deny-by-default; app-layer authn |
| 8443 | HTTPS | 0.0.0.0 (public) | Same, over TLS | Deny-by-default; TLS |
| 9900 | HTTP | 127.0.0.1 | Internal control plane | Loopback |
| 9943 | HTTPS | 0.0.0.0 (internal) | Internal control plane | Mutual TLS (client cert required) |
| 59900 | gRPC | 127.0.0.1 | Internal control plane | Loopback |
| 59943 | gRPC/TLS | 0.0.0.0 (internal) | Internal control plane | Mutual TLS |
| 9950 | PostgreSQL wire | 0.0.0.0 (public) | External SQL gateway → data engine; in-band SSL negotiation on one port | require_tls configurable; proxied |
| 59950 | Arrow Flight SQL (gRPC) | 0.0.0.0 (public) | External columnar gateway → data engine (clear) | Deny-by-default; proxied |
| 59951 | Arrow Flight SQL/TLS | 0.0.0.0 (public) | External columnar gateway → data engine (TLS) | TLS; enabled when certs configured |
| 8444 | HTTPS | 0.0.0.0 (public) | Edge device enrollment listener; one route (enroll) | TLS, no client cert (device has none yet) |
| 8445 | HTTPS | 0.0.0.0 (public) | Edge device operational listener; all enrolled-device routes | Mutual TLS (client cert required) |
| 8446 | gRPC/TLS | 0.0.0.0 (public) | Edge device gRPC bootstrap: Enroll and RefreshCert only | TLS with the node certificate, no client cert. Not published in discovery; edge config only |
| 8447 | gRPC/mTLS | 0.0.0.0 (public) | Edge device gRPC operational: every gateway RPC, plus the discovery-mapping leaf service | Mutual TLS with the enrolled device certificate |
| 9922 | SFTP (SSH) | 0.0.0.0 | File-transfer gateway | Not-wired: off by default; see below |
| 8883 | MQTT | Edge MQTT outbound bridge | Not-wired: binds no port; see below | |
| 2222 | SSH | 0.0.0.0 | Edge SSH tunnel, now carrying device mutual TLS to the node front door (8447) | Not-wired: off by default; see below |
- SFTP (9922) ships disabled. When enabled it binds, but the shipped authenticator denies every credential, so it accepts the connection, refuses the handshake, and closes. Exposure with no capability until a real authenticator is supplied.
- MQTT (8883) is an outbound client bridge that dials an external broker; it binds no listener, and the configured port is read by nothing. Set the broker host/port to use it.
- SSH tunnel (2222) ships disabled and cannot serve a device as shipped (the only cert issuer emits principals the validator rejects). It refuses to bind without a configured signing CA.
The node service is the only device path. An Edge Agent dials the node's own address, and the node verifies the call with the cell's own guard before forwarding it over the intra-node fabric, carrying the device identity as an assertion only the node can mint.
| Purpose | Port | Authentication |
|---|---|---|
| Enroll, refresh a certificate | 8446 gRPC | Node certificate, no client cert (the device has none yet) |
| Everything else, once enrolled | 8447 gRPC | Mutual TLS with the enrolled device certificate |
| HTTPS fallback | 8444 / 8445 | As above, when a gRPC leg cannot be reached |
The cell listeners now refuse devices. Ports 59350 and 59353 narrow to
loopback and reject any device call that did not arrive through the front door.
A direct setting re-opens them for in-cell and lab use, and any
unrecognised value falls back to the refusing behaviour, so a typo closes the
door rather than opening it.
Two details worth carrying into a deployment plan:
- Discovery returns node addresses only. Enrollment and endpoint discovery publish the node's fully-qualified name, gRPC first and HTTPS second. If the node has no name on record the list comes back empty rather than falling back to a cell host.
- The trust bundle is narrow. Enrollment returns the organization's device and server certificate authorities, not its root. The server authority issues server-authentication certificates only, so including it lets a device verify the node without widening what it will trust.
- A first-time device trusts the node from its enrollment token. The token carries the fingerprints of the organization's active server authorities, so a sovereign or air-gapped device needs no bundle staged on it beforehand. The node presents its full certificate chain on the device listeners. See connect an Edge Agent.
system
| Port | Protocol | Bind | Purpose | Auth |
|---|---|---|---|---|
| 9300 | HTTP | 127.0.0.1 | Service control plane | Loopback |
| 9343 | HTTPS | 0.0.0.0 (internal) | Service control plane; inter-cell | Mutual TLS |
| 59300 | gRPC | 127.0.0.1 | Service control plane | Loopback |
| 59343 | gRPC/TLS | 0.0.0.0 (internal) | Service control plane; inter-cell | Mutual TLS |
| 59350 | gRPC | 0.0.0.0 (cell-local) | Edge-fleet bootstrap channel: admits only device enroll + certificate refresh. Cell-internal; not the external device path | Clear; every other RPC rejected UNAUTHENTICATED |
| 59353 | gRPC/TLS | 0.0.0.0 (cell-local) | Edge-fleet operational channel: full fleet surface. Cell-internal; not the external device path | Mutual TLS; per-device rate limit after identity verified |
security
| Port | Protocol | Bind | Purpose | Auth |
|---|---|---|---|---|
| 9100 | HTTP | 127.0.0.1 | Service control plane (retains crypto-service port for compatibility) | Loopback |
| 9143 | HTTPS | 0.0.0.0 (internal) | Service control plane | Mutual TLS |
| 59100 | gRPC | 127.0.0.1 | Service control plane | Loopback |
| 59143 | gRPC/TLS | 0.0.0.0 (internal) | Service control plane | Mutual TLS |
storage
The S3-compatible and native object API rides the storage HTTP listeners; cross-cell replication and repair (StorageReplication) rides the gRPC listeners.
| Port | Protocol | Bind | Purpose | Auth |
|---|---|---|---|---|
| 9700 | HTTP | 127.0.0.1 | Object / block API (S3-compatible + native), intra-cell | Loopback |
| 9743 | HTTPS | 0.0.0.0 (fabric) | Object / block API for peers | Mutual TLS |
| 59700 | gRPC | 127.0.0.1 | Replication / repair, intra-cell | Loopback |
| 59743 | gRPC/TLS | 0.0.0.0 (fabric) | StorageReplication: cross-cell copy, repair, relay | Mutual TLS |
data
Internal database wire protocols bind loopback for intra-cell callers; the multi-cell mesh binding uses mutual TLS. External clients reach these only through the node gateways (9950 / 59950).
| Port | Protocol | Bind | Purpose | Auth |
|---|---|---|---|---|
| 9600 | HTTP | 127.0.0.1 | Service control plane | Loopback |
| 9643 | HTTPS | 0.0.0.0 (fabric) | Service control plane; inter-cell | Mutual TLS |
| 59600 | gRPC | 127.0.0.1 | Service control plane | Loopback |
| 59643 | gRPC/TLS | 0.0.0.0 (fabric) | Service control plane; inter-cell | Mutual TLS |
| 9650 | PostgreSQL wire | 127.0.0.1 (mesh IP multi-cell) | Internal SQL engine surface; in-band SSL negotiation | system_token; mTLS on mesh |
| 59650 | Arrow Flight SQL (gRPC) | 127.0.0.1 (mesh IP multi-cell) | Internal columnar engine surface | bearer / system_token |
| RESP (Redis / Valkey-compatible) | intra-cell | Data-structure engine surface | See below |
The data-structure engine speaks a Redis / Valkey-compatible protocol, and its configuration governs client tracking and Redis-cluster protocol emulation (emulation off by default). A single fixed standalone RESP listen port is not pinned in the service configuration reviewed here, the surface is intra-cell, and external SQL/columnar access is via the node gateways. Treat the RESP port as deployment-configured, not a shipped constant.
messaging
| Port | Protocol | Bind | Purpose | Auth |
|---|---|---|---|---|
| 9500 | HTTP | 127.0.0.1 | Pub/sub + streaming control, intra-cell | Loopback |
| 9543 | HTTPS | 0.0.0.0 (fabric, cell FQDN) | Pub/sub + streaming for peers | Mutual TLS |
| 59500 | gRPC | 127.0.0.1 | Replication / streaming, intra-cell | Loopback |
| 59543 | gRPC/TLS | 0.0.0.0 (fabric, cell FQDN) | Cross-cell topic replication | Mutual TLS |
| 5672 | AMQP | : (outbound) | Transport bridge to external AMQP broker | Not-wired: off by default; binds no listener |
| 1883 | MQTT | : (outbound) | Transport bridge to external MQTT broker | Not-wired: off by default; binds no listener |
compute
| Port | Protocol | Bind | Purpose | Auth |
|---|---|---|---|---|
| 9800 | HTTP | 127.0.0.1 | Service control plane | Loopback |
| 9843 | HTTPS | 0.0.0.0 (internal) | Service control plane | Mutual TLS |
| 59800 | gRPC | 127.0.0.1 | Service control plane | Loopback |
| 59843 | gRPC/TLS | 0.0.0.0 (internal) | Service control plane | Mutual TLS |
metrics
| Port | Protocol | Bind | Purpose | Auth |
|---|---|---|---|---|
| 9400 | HTTP | 127.0.0.1 | Telemetry / metrics, intra-cell | Loopback |
| 9443 | HTTPS | 0.0.0.0 (fabric, cell FQDN) | Metrics roll-up to peers | Mutual TLS |
| 59400 | gRPC | 127.0.0.1 | (Disabled by default) | Loopback |
| 59443 | gRPC/TLS | 0.0.0.0 (fabric) | (Disabled by default) | Mutual TLS |
Metrics roll-up rides the HTTP surface; the gRPC pair ships disabled.
admin
Out-of-band control and diagnostics. HTTP only, no gRPC, no fabric data-plane surface; the service holds no primary state.
| Port | Protocol | Bind | Purpose | Auth |
|---|---|---|---|---|
| 9200 | HTTP | 127.0.0.1 | Local diagnostics | Loopback |
| 9243 | HTTPS | 0.0.0.0 (internal) | Out-of-band control | Mutual TLS (client cert required) |
The surfaces the question always asks
| Surface | Where it lives | Port(s) | Notes |
|---|---|---|---|
| PostgreSQL wire | data engine (internal) → node gateway (external) | 9650 internal · 9950 external | In-band SSL negotiation on a single port |
| Redis wire (RESP) | data data-structure engine | deployment-configured | Redis/Valkey-compatible; cluster emulation off by default |
| S3 / object | storage service HTTP | 9700 intra-cell · 9743 fabric | S3-compatible + native, one listener pair |
| Arrow Flight SQL | data engine (internal) → node gateway (external) | 59650 internal · 59950/59951 external | gRPC / Arrow columnar |
| gRPC inter-cell | storage / data / messaging / system, fabric | 59743 · 59643 · 59543 · 59343 | Mutual TLS; StorageReplication is the storage one |
| Edge-fleet gRPC | system service, cell-local | 59350 bootstrap · 59353 operational | Split bootstrap (clear, enroll/refresh only) vs operational (mTLS) |
| Admin out-of-band | admin service | 9200 loopback · 9243 mTLS | Read-only aggregation; owns no database |
In the deployment matrix
The port map is identical in every corner. Single-cell, the fabric mutual-TLS
listeners (9x43 / 59x43) are present but idle. Multi-cell, they carry
replication, roll-up, and scale-out between peers. Cloud-enabled, external
transport bridges and cloud connectors may be enabled on node and messaging.
Sovereign / air-gapped, no listener on any boot path phones home, and a peer
that cannot be reached is an absent edge, not a failed one, the local cell's
own ports stay fully serviceable.
Related topics
- Platform services overview, the nine services and the two structural facts.
- node service, the front door these external ports belong to.
- Deployment topology, how the planes spread across the matrix.
- Replication, DR & federation, what the fabric gRPC ports carry.