Server ports
The agent only dials out: it reaches the panel over HTTPS and needs no inbound port. The installer opens the ports below in the server’s firewall (ufw), according to what the server is for. It never changes your hosting provider’s firewall; open the same ports there.
| Port | On which servers | For |
|---|---|---|
The ports sshd listens on |
Every server, when the installer enables ufw | Keeping your SSH access |
| 80/tcp and 443/tcp | Servers that host instances, unless reached only through their own tunnel | Your clients’ Odoo, through Caddy |
| 51871/udp | Every server | The partner’s mesh, between your servers (WireGuard) |
6432 and 30000–30999/tcp, on the osaas-mesh interface |
Servers that may run Postgres | The pooler and the databases, for your other servers only |
| 25000–25999/tcp | Servers that may run Postgres | A client’s read-only access to its own database |
| 80/tcp | A database server that publishes its clients’ access | The certificate of the published name |
| 10000–20000/tcp | Servers that may run Postgres | Database access for your other servers, from before the mesh |
WireGuard answers no packet that does not authenticate, so 51871/udp does not show in a port scan.
A server without a public IP opens neither 80 nor 443: its tunnel’s connector reaches Caddy on the machine itself.