Ports, networks, files
Everything Deplo listens on, connects over and writes to disk.
Everything Deplo listens on, connects over and writes to disk.
Ports
Prop
Type
Two things people get wrong here
- Port 3000 is not open, on purpose. A dashboard on an open port is
a login page on the internet with no TLS in front of it. It binds
127.0.0.1, so the way back in when the proxy is what broke isssh -L 3000:localhost:3000 root@your-server, thenhttp://localhost:3000. The generateddeplo-<hex>.nip.ioaddress covers everything short of that: it answers over HTTPS whatever your domain is doing. - A green server card does not prove port 9443 is open. The call
home is outbound over 443, and that is what turns it green at
enrolment. Opening the servers page re-dials every agent, so a
blocked port shows up there as
offline- but a card painted from an older reading still says online. No installer opens a firewall: the agent installer only tells you whenufworfirewalldis the one holding the port.
Networks
Prop
Type
The split is not decoration. Every container on the shared network
registers its service name as a DNS alias, and Docker round-robins a name
two containers both claim. A tenant service called postgres on the shared
network would collect the control plane's own database connections,
password included, which is why Postgres sits on its own internal leg and
why four service names are refused outright on the shared one.
Docker address pools
Deplo uses one network per app, and Docker's default pools allow about
31. Both installers therefore write a /13 into
default-address-pools in /etc/docker/daemon.json, with size: 24.
- An existing pool configuration is never clobbered.
- The previous file is kept as
daemon.json.deplo-bak. - The new one is validated with
dockerd --validatebefore it is used. - If containers are already running, the Docker restart is skipped and the installer tells you to do it in a maintenance window.
Files on the panel's host
/opt/deplo/.env generated secrets, chmod 600
/opt/deplo/docker-compose.yml Postgres + the control plane
/opt/deplo/traefik/ the proxy stack
/opt/deplo/traefik/certs/ the fallback certificate, minted once
/opt/deplo/data/ build and upload staging
/opt/deplo/acme/acme.json issued certificates, chmod 600Files on every server
/usr/local/bin/deplo-agent the agent binary
/var/lib/deplo-agent/ chmod 700
agent.crt, agent.key, ca.crt its mutual TLS identity
bootstrap.env first-run enrollment, chmod 600
traefik/ that host's proxy stack
/etc/systemd/system/deplo-agent.service
/data/backups/ the agent's managed backup store, chmod 700
/etc/docker/daemon.json plus daemon.json.deplo-bakOn the machine that runs the control plane, /var/lib/deplo-agent/traefik
is a symlink to /opt/deplo/traefik, so the agent manages the
panel's own proxy rather than installing a second one.
/var/lib/deplo-agent holds Traefik's acme.json. Deleting it takes
your issued certificates with it, and Let's Encrypt rate-limits
reissuance.
Container names worth knowing
Prop
Type
See also
Did this page help you?