Network ports and flows
This page lists the ports the Navin Platform listens on and the flows to open, per installation method. The values come from the systemd units of the packages, the Helm chart, the data service manifests and the compose file.
OS packages
| Port | Protocol | Service | Who connects |
|---|---|---|---|
| 8080 | HTTP | Control Plane API (navin-platform-api, EAI_PORT) | Browsers through the TLS reverse proxy, SDK, CLI |
| 3300 | HTTP | Portal (navin-platform-portal, NAVIN_PORTAL_PORT) | Browsers through the TLS reverse proxy |
| 9464 | HTTP | Worker metrics (EAI_WORKER_METRICS_PORT) | Prometheus |
| 9465 | HTTP | Media worker metrics (EAI_MEDIA_WORKER_METRICS_PORT) | Prometheus |
| 5432 | PostgreSQL | Local database (UNIX socket only by default) | API and worker of the same host |
| 8460 | HTTPS | Navin Manager console and API (standalone or manager role) | Operators, portal |
| 8461 | HTTPS | Navin Manager agent endpoint | Agents of the nodes |
navin-install preflight checks that 5432, 8460, 8461, 8080, 3300 and 9464 are free (or already served by their own
Navin unit) and reports the ports the local firewall still blocks.
Outbound from the platform host: OpenBao (EAI_OPENBAO_URL, 8200 by default), Keycloak (EAI_OIDC_ISSUER), Redis
(EAI_REDIS_URL, 6379), LiteLLM (EAI_LITELLM_URL), the OTLP collector (4318) and, when used, the external
PostgreSQL server (5432).
Kubernetes
Exposure
| Entry point | Port | Object |
|---|---|---|
APISIX (API <control-plane-host>) | 9080 HTTP, 9443 TLS (container ports) | Service LoadBalancer, externalTrafficPolicy: Local (deploy/apisix/values.yaml) |
Portal (<portal-host>) | 443, HTTP redirected to HTTPS | Ingress class nginx (portal.ingress) |
| LiveKit media (voice) | 7880 signalling, 7881 TCP, UDP range of deploy/livekit | Manifests of deploy/livekit |
In-cluster ports
| Service | Namespace | Port |
|---|---|---|
| Control Plane API | enterprise-ai | 8080 |
| Portal | enterprise-ai | 3000 |
| LiteLLM | enterprise-ai | 4000 |
| vLLM | enterprise-ai | 8000 |
| Ollama | enterprise-ai | 11434 |
| Worker metrics | enterprise-ai | 9464 |
| PostgreSQL (CloudNativePG) | eai-data | 5432 |
| Redis | eai-data | 6379 |
| NATS | eai-data | 4222 (client), 8222 (monitoring, read by KEDA) |
| Qdrant | eai-data | 6333 |
| Temporal frontend | eai-data | 7243 |
| LiveKit | eai-data | 80 (Service), 7880 (container) |
| OpenFGA | eai-security | 8080 |
| OPA | eai-security | 8181 |
| OpenBao | openbao | 8200 (API), 8201 (cluster) |
| ClickHouse | observability | 8443 |
| OpenTelemetry Collector | observability | 4317 (gRPC), 4318 (HTTP) |
| Opik backend | observability | 8080 |
| Prometheus | observability | 9090 |
Flows
Every namespace starts from a full deny, DNS included, and each workload opens only what it needs. The flow matrix of
the chart (Control Plane, worker, migration Job, portal, LiteLLM, vLLM, media workers) and the DNS rules are
described in Network and DNS hardening. Only the Control Plane and
LiteLLM reach the Internet, through the FQDN list networkSecurity.providerFQDNs
(Helm values reference).
Docker Compose
Published on the host (deploy/compose/docker-compose.yml):
| Port | Service |
|---|---|
| 8080 | Control Plane API |
| 3300 | Portal |
| 4000 | LiteLLM |
| 8081 | Keycloak |
| 8082 | OpenFGA |
| 8088 | Temporal UI |
| 8200 | OpenBao (dev mode) |
| 7880, 7881, 50000-50100/udp | LiveKit |
| 3001 | Opik frontend (profile opik) |
| 16686 | Jaeger |
| 4317, 4318 | OpenTelemetry Collector |
| 9090 | Prometheus |
| 8333 | SeaweedFS S3 API |
docker-compose.host-ports.yml, added by every make docker-* target unless HOST_PORTS=0, also publishes on
127.0.0.1 only: PostgreSQL 5432, Redis 6379, OPA 8181, Qdrant 6333, NATS 4222, Temporal 7243, ClickHouse 8123,
vLLM 8000, Ollama 11434. make docker-env writes the next free port when a default one is taken (for example
POSTGRES_HOST_PORT=5433).
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
navin-install preflight prints port 8080 is taken | Another program listens on the port | ss -ltnp 'sport = :8080' shows it; stop or move it |
| The portal loads but every API call fails | NAVIN_PORTAL_API_URL or NEXT_PUBLIC_EAI_API_URL is not the URL the browsers reach | Set the public URL of the API, then restart the portal |
| A pod cannot resolve a name | The Cilium DNS rule of the workload does not list it | Use the fully qualified name (nats.eai-data.svc.cluster.local), see the DNS section of the hardening page |