Networking¶
Status: Current | Last reviewed: 2026-09-01
Ports, ingress, public vs. private surfaces, and the Global Accelerator caveat.
Vanguard ports¶
In the devcontainer, services bind to localhost. The nginx ingress at *.vanguard.dev.trueserve.deloitte.com maps public hostnames onto local ports.
| Port | Service | Notes |
|---|---|---|
| 3000 | ari-controller | local HTTP callbacks |
| 3001 | ai-manager | admin UI (Next.js) |
| 3002 | surface-app | end-user UI |
| 3030 | webex-connector-go | gRPC/control |
| 3031 | connect-scv-translator | Amazon Connect SCV bridge |
| 3032 | five9-voicestream-connector-go | gRPC/control |
| 3510 | collab-gateway | WebSocket presence + Yjs |
| 3520 | multimodal-service | A2UI HTTP / MCP |
| 3521 | teams-agent-gateway | optional; disabled by default |
| 5050 | pgadmin | dev convenience |
| 5060 | kamailio | SIP UDP/TCP |
| 5061 | kamailio | SIP TLS |
| 5432 | postgres | DB |
| 6379 | redis | cache + pubsub |
| 7474 / 7687 | neo4j | HTTP / bolt |
| 8000 | async-agent | HTTP |
| 8003 | agent-host | MCP streamable HTTP |
| 8010 | code-executor | sandboxed Python |
| 8011 | antigravity-runner | sandboxed Google Antigravity preview runner |
| 8012 | workspace-agent-runner | sandboxed Codex / Claude Code Assistant Agent runner |
| 8080 | conversation-api | HTTP |
| 8081 | ai-orchestrator | HTTP metrics/health/debug gateway |
| 8085 | media-proxy | HTTP |
| 8087 | asterisk ARI | WebSocket |
| 8088 | asterisk HTTP / janus HTTP | both bind here in different containers |
| 8089 | genesys-connector-go | HTTP / WebSocket |
| 8090 | catalog-builder | catalog bundle builder |
| 8091 | knowledge-engine | optional gitignored app |
| 8092 | webex-app-manager | HTTP |
| 8093 | connect-kvs-connector | Amazon Connect KVS reader |
| 8094 | mkdocs-developer | developer docs |
| 8095 | five9-voicestream-connector-go | HTTP |
| 8096 | mkdocs-userguide | user guide docs |
| 8097 | status-page | dual-mode dashboard |
| 8098 | webex-connector-go | health |
| 8188 | janus | WebSocket |
| 9000 / 9001 | minio | S3 API / console |
| 50051 | ai-orchestrator | gRPC |
| 1234 | conversation-api | gRPC |
The full list lives in the port matrix reference.
Public vs. private¶
In Vanguard, nginx maps:
| Public hostname | → local port | Why public |
|---|---|---|
ai-manager.<host> / apex host |
3001 (ai-manager) | admin UI |
surface-app.<host> |
3002 (surface-app) | end-user UI |
tools.<host>.vanguard.dev.trueserve.deloitte.com |
8003 (agent-host MCP) | external MCP clients |
janus.<host>.vanguard.dev.trueserve.deloitte.com |
8188 (janus WS /ws) |
browser WebRTC |
conversation-api.<host>.vanguard.dev.trueserve.deloitte.com |
8080 (conversation-api) | A2A Agent Cards and external conversation API |
code.<host>.vanguard.dev.trueserve.deloitte.com |
8444 (code-server auth proxy) | editor access |
docs.<host>.vanguard.dev.trueserve.deloitte.com |
8096 (user guide) | docs |
developer.<host>.vanguard.dev.trueserve.deloitte.com |
8094 (developer docs) | docs |
sip.<host>.vanguard.dev.trueserve.deloitte.com |
5060 (kamailio) | carriers |
.devcontainer/configs/nginx/ is the source of truth.
In cluster, the same hostnames resolve via cloud DNS. Public TLS terminates at the cloud load balancer or Gateway (ALB/nginx on AWS, GCLB/Gateway on GCP, App Gateway on Azure). In-cluster service traffic is separately controlled by mesh mTLS when global.security.transportEncryption.enabled=true.
Transport encryption¶
TrueServe has three transport layers:
| Layer | Control | Notes |
|---|---|---|
| Public edge TLS | Cloud LB, Gateway, or ingress controller | Require TLS 1.2 minimum; allow TLS 1.3 where the provider supports it. nginx ingress controllers set this with the controller ConfigMap ssl-protocols: TLSv1.2 TLSv1.3, not an app Ingress annotation. |
| In-cluster workload traffic | global.security.transportEncryption in the umbrella chart |
Cloud values enable Istio PeerAuthentication in strict mode and set meshSidecarInjection: true on agent/workflow/data pods. Local/Kind defaults leave this disabled, and injectSidecar: false suppresses generated pod injection. |
| App-native TLS | Service-specific code/config | Not the default for internal HTTP/gRPC. App URLs can remain http://service:port and gRPC clients can keep insecure channels because the sidecars encrypt pod-to-pod traffic. Use this only for clusters that cannot run a mesh. |
KMS environments provide the external Gateway/HTTPRoute resources outside this chart. The TrueServe chart only owns the optional in-namespace mesh policy and generated pod injection for opted-in workloads; Gateway TLS policy remains with the KMS gateway resources.
Global Accelerator (AWS only)¶
When a cloud customer fronts SIP/media via AWS Global Accelerator (anycast public IP on top of regional endpoints), GA DNATs the destination from public to LAN before delivery.
Affected services:
- rtpengine — must bind both LAN and public IPs (dual-interface). See media-stack.md.
- kamailio — TLS cert SAN must include both. ACL evaluation happens on the LAN side.
This is the source of the "RTP works for outbound, breaks for inbound" failure mode. If you see asymmetric audio in an EC2 deploy, check the rtpengine interface config first.
Cluster ingress¶
Each cloud uses its own ingress controller, but the chart abstracts this:
| Cloud | Controller | Ingress kind |
|---|---|---|
| GKE | GCE Ingress / Cloud Load Balancer | Ingress |
| EKS | AWS Load Balancer Controller | Ingress (annotated for ALB) |
| AKS | Azure Application Gateway Ingress | Ingress (annotated for AGIC) |
| Self-hosted | nginx-ingress or Traefik | Ingress |
TLS certs come from cert-manager (Issuer: letsencrypt-prod) or a customer-provided ACM/Key Vault secret.
WebSocket considerations¶
Janus, collab-gateway, and ari-controller all use WebSockets. The cloud load balancer must:
- Support WebSocket upgrade (most modern ones do; older ALBs need explicit annotation).
- Have a long enough idle timeout (
>= 3600sfor collab-gateway; otherwise disconnects propagate to the UI). - Strip cookies and re-declare
Upgrade/Connection/Hostheaders on Janus's/wslocation specifically. nginx's header inheritance forces this; see the agent memory entry on Janus header strip.