Reference
Ports
Every port Heimnull uses on the host, which ones are reachable from outside, and the variables that change them.
The heimnull container uses the host’s network, so its ports are the host’s ports. PostgreSQL and ClickHouse run in their own containers and publish their ports on 127.0.0.1 only.
Reachable from outside
Section titled “Reachable from outside”| Port | Service | Variable | Notes |
|---|---|---|---|
| 80/tcp | Web interface and API | HN_HTTP_PORT |
Plain HTTP. See HTTPS |
| 2055/udp | NetFlow v9 | HN_NETFLOW_PORT |
Every flow port accepts every format |
| 4739/udp | IPFIX | HN_IPFIX_PORT |
|
| 6343/udp | sFlow v5 | HN_SFLOW_PORT |
0 turns it off |
| 179/tcp | BGP | Only while a local AS is set on the BGP page. The listen port is set there | |
| 5514/udp | Firewall session logs | HN_SESSIONLOG_PORT |
Only while an exporter has “NAT from session logs” on |
Firewall all of them to the sources that need them: see Network and firewall.
Loopback only
Section titled “Loopback only”These listen on 127.0.0.1 and must be free on the host:
| Port | Service | Variable |
|---|---|---|
| 8080/tcp | Heimnull’s internal API (the web server forwards to it) | HN_API_LISTEN |
| 5432/tcp | PostgreSQL | HN_PG_PORT |
| 9000/tcp | ClickHouse, native protocol | HN_CH_NATIVE_PORT |
| 8123/tcp | ClickHouse, HTTP | HN_CH_HTTP_PORT |
| 50051/tcp | The BGP speaker’s control API | HN_GOBGP_API |
If another service on the host already uses one of these, change it in .env (for example HN_PG_PORT=15432) and run sudo docker compose up -d --wait. Don’t set HN_HTTP_PORT to one of them.
To check that nothing else is exposed, list what listens on the host’s non-loopback addresses:
sudo ss -lntup | grep -v '127.0.0.1\|\[::1\]'