From 31ce871d33926418e7f85898b60058a53dee2850 Mon Sep 17 00:00:00 2001 From: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com> Date: Thu, 24 Sep 2026 09:16:16 +0200 Subject: [PATCH] docs: name every installer port to close when the node moves behind the load balancer --- .../scaling/high-availability-from-installer.mdx | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx b/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx index abe364e2..004b9e02 100644 --- a/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx +++ b/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx @@ -295,7 +295,12 @@ From here on, TLS and routing move from the installer's Traefik to your load bal Keep the installer's `.env` beside it: it supplies the domain, image tags and license key. - Before you start the node, allow ports 80 and 8080 on it from the load balancer only, at a network firewall or cloud security group. The server serves its API and login page on port 80 in plain HTTP, so it must not be reachable from anywhere else. Remove the rules that opened ports 80 and 443 to the internet for Traefik. A host firewall such as UFW or firewalld does not restrict these ports, because Docker-published ports bypass those rules. + Before you start the node, change its rules at a network firewall or cloud security group: + + - Allow TCP 80 and 8080 from the load balancer only. The server serves its API and login page on port 80 in plain HTTP, so it must not be reachable from anywhere else. + - Remove the rules the installer needed: TCP 80 and 443 from the internet, which Traefik used, and UDP 3478, which the built-in STUN server used. STUN now runs on the relay instances. + + A host firewall such as UFW or firewalld does not restrict these ports, because Docker-published ports bypass those rules. Then start the node: