Network Configuration#
Open only the connections required by your deployment in the firewall. The client docker-compose.client.yml publishes these host ports:
| Direction | Port | Purpose |
|---|---|---|
| Browser → Sherpa PD Server | 443; 80 if HTTP is allowed | Web interface through nginx. |
| Discovery Agent → RabbitMQ on the server | 5672 | Event delivery in the client distribution. If TLS is configured separately for the broker, use its assigned port and certificates. |
| Server components → PostgreSQL | 5432 | Application data; the port is published by the compose file, but browsers and agents do not need external DB access. |
| Server components → ClickHouse | 8123, 9000 | Analytical storage; restrict access to the server environment. |
| Server components → RabbitMQ | 5672; 15672 for the broker management UI | Internal messaging; product users do not need the management UI. |
| Server components → graph-service and labeling-service | 8000, 8001 | Internal services; restrict access to the server environment. |
When installing with the standard script, place the HTTPS certificate and key at ./nginx/config/certs/pd.crt and ./nginx/config/certs/pd.key relative to the installation directory. The script offers to create a self-signed certificate or copy an issued pair. The nginx configuration allows TLS 1.2 and 1.3. Before configuring your firewall, verify the ports and access rules in the compose file for your specific distribution.