Port Strategy
No port is hard-coded. Every listener reads its port from configuration
(config*.yaml or a YARMA_* environment variable). The defaults below avoid common
collisions on developer machines.
Platform
| Component | Default | Config key / variable | Exposure |
|---|---|---|---|
| Web console | 8443 | YARMA_WEB_PORT |
Internal / corporate |
| Public support portal | 9443 | YARMA_PORTAL_PORT |
Internet (via reverse proxy on 443) |
| API (gateway) | 10443 | server.api_port / YARMA_SERVER_API_PORT |
Internal + portal |
| API metrics | 19091 | server.metrics_port / YARMA_SERVER_METRICS_PORT |
Monitoring network only |
| WebRTC signaling | 11443 | YARMA_SIGNALING_PORT |
Internet (via reverse proxy on 443) |
| Agent service (gRPC mTLS) | 18443 | YARMA_AGENT_SERVICE_PORT |
Internet (agents roam) |
| coturn | 13478 (dev), 443 TCP/UDP (prod) | YARMA_TURN_PORT |
Internet |
| coturn relay range | 49160–49200/UDP (dev) | compose file | Internet |
Dependencies (development lab)
| Service | Port | Variable |
|---|---|---|
| PostgreSQL | 15432 | YARMA_POSTGRES_PORT |
| Redis | 16379 | YARMA_REDIS_PORT |
| NATS | 14222 (monitor 18222) | YARMA_NATS_PORT |
| Object store S3 API | 19000 | YARMA_S3_PORT |
| Object store console | 19001 | YARMA_S3_CONSOLE_PORT |
| Vault | 18200 | YARMA_VAULT_PORT |
| Keycloak | 18080 | YARMA_KEYCLOAK_PORT |
| OpenLDAP | 10389 | YARMA_LDAP_PORT |
| Samba AD (LDAP / Kerberos) | 10390 / 10088 | YARMA_AD_LDAP_PORT / YARMA_AD_KERBEROS_PORT |
| Mailpit SMTP / UI | 11025 / 18025 | YARMA_SMTP_PORT / YARMA_MAILPIT_UI_PORT |
| Notification mocks | 18090 | YARMA_MOCKS_PORT |
| Prometheus | 19090 | YARMA_PROMETHEUS_PORT |
| Grafana | 13000 | YARMA_GRAFANA_PORT |
| Loki | 13100 | YARMA_LOKI_PORT |
| Tempo | 13200 | YARMA_TEMPO_PORT |
| Jaeger UI / OTLP gRPC / OTLP HTTP | 16686 / 14317 / 14318 | YARMA_JAEGER_UI_PORT, YARMA_OTLP_* |
| ClamAV | 13310 | YARMA_CLAMAV_PORT |
External support without VPN
In production a reverse proxy or load balancer terminates 443/TCP for the portal, signaling and agent service (SNI/host routing), and coturn listens on 443/UDP and 443/TCP (TURN over TLS). Users and agents behind restrictive firewalls need only outbound 443.
Documentation for Yarma 0.1.0-alpha.4. Something unclear? .