Ports, networks, files

Everything Deplo listens on, connects over and writes to disk.

Use this page to check firewall rules, Docker networks, and host paths.

At a glance

Open 80 and 443 to the internet. Allow 9443 from the control plane to every server. Never publish 3000, 5432 or 2375.

Ports

Prop

Type

Common mistakes

  • Port 3000 is not open, on purpose. A dashboard on an open port is a login page on the internet with no TLS in front of it. It binds 127.0.0.1, so the way back in when the proxy is what broke is ssh -L 3000:localhost:3000 root@your-server, then http://localhost:3000. The generated address (like deplo-cb00710a.deplo.site) covers everything short of that: it answers over HTTPS whatever your domain is doing.
  • A green server card does not prove port 9443 is open. The call home is outbound over 443, and that is what turns it green at enrolment. Opening the servers page re-dials every agent, so a blocked port shows up there as offline - but a card painted from an older reading still says online. No installer opens a firewall: the agent installer only tells you when ufw or firewalld is the one holding the port.

Networks

These belong to the platform. Tenant stacks never join them:

Prop

Type

Tenant networks are created per Environment:

Prop

Type

The separation prevents tenant containers from reaching platform services. Deplo also reserves platform service names on managed networks to avoid Docker DNS collisions.

Address pools

Deplo uses one network per Environment. Both installers configure a /13 pool with size: 24 in /etc/docker/daemon.json.

  • An existing pool configuration is never clobbered.
  • The previous file is kept as daemon.json.deplo-bak.
  • The new one is validated with dockerd --validate before it is used.
  • If containers are already running, Docker is not restarted automatically.

Files on the panel's host

/opt/deplo/.env                     generated secrets, chmod 600
/opt/deplo/docker-compose.yml       Postgres + the control plane
/opt/deplo/traefik/                 the proxy stack
/opt/deplo/traefik/certs/           the fallback certificate, created once
/opt/deplo/data/                    build and upload staging
/opt/deplo/acme/acme.json           issued certificates, chmod 600

Files on every server

/usr/local/bin/deplo-agent          the agent binary
/var/lib/deplo-agent/               chmod 700
  agent.crt, agent.key, ca.crt      its mutual TLS identity
  bootstrap.env                     first-run enrollment, chmod 600
  traefik/                          that host's proxy stack
/etc/systemd/system/deplo-agent.service
/data/backups/                      the agent's managed backup store, chmod 700
/etc/docker/daemon.json             plus daemon.json.deplo-bak

On the control-plane host, /var/lib/deplo-agent/traefik is a symlink to /opt/deplo/traefik, so the agent manages the panel's proxy.

/var/lib/deplo-agent holds Traefik's acme.json. Deleting it takes your issued certificates with it, and Let's Encrypt rate-limits reissuance.

Common container names

Prop

Type

See also

Platform variables

Every variable Deplo itself reads

Installers reference

What writes these files

Add a server

Enrolling a host

How Deplo works

The control plane and the agent

Did this page help you?

uninstall.sh

One script, two jobs: pull the agent off a host, or remove Deplo itself. Dry run by default.

Troubleshooting

Find the symptom, check the right log, and fix the common causes.

On this page

PortsNetworksAddress poolsFiles on the panel's hostFiles on every serverCommon container namesSee also