Ports and protocols
Every NovaVMS component listens on a specific port. This page lists them all so you can open firewalls or diagnose connectivity.
Component ports
| Port | Protocol | Component | Direction | Configurable via | Notes |
|---|---|---|---|---|---|
| 443 | TCP | Frontend / API ingress (Caddy) | Inbound from browsers and gateways | Reverse-proxy config | TLS terminates here in production. |
| 5200 | TCP | Frontend dev server (Vite) | Inbound (dev only) | vite.config.ts | Local development only. |
| 8090 | TCP | Cloud backend REST API + WebSocket (local dev default) | Inbound from browsers, gateways, service accounts | SERVER_ADDR | Dev default 127.0.0.1:8090 (see cloud/internal/config/config.go:202). In production compose, SERVER_ADDR=0.0.0.0:8080 and the container listens on 8080 (see deploy.sh:111); Caddy reverse-proxies 443 → 8080. |
| 8080 | TCP | Cloud backend (production container) | Caddy → cloud upstream | SERVER_ADDR | Production container listens on 8080. Not exposed to host directly when a Caddy overlay is used. |
| 8554 | TCP | RTSP server (go2rtc, gateway side) | Inbound from cameras and playback clients | go2rtc config | Direct-mode streaming on the gateway host. Cloud compose does NOT expose 8554. |
| 8555 | UDP | WebRTC media | Bidirectional with browsers | go2rtc config / cloud SFU | Mapped by docker-compose.prod.yml:49. ICE candidate transport. |
| 11984 | TCP | go2rtc HTTP API | Loopback only | GO2RTC_ADDR | Stream management. Dev default. Not exposed publicly. |
| 3478 | UDP | TURN relay control (Pion) | Inbound from browsers behind strict NAT | TURN_ADDR | Mapped by docker-compose.prod.yml:48. Used only when direct P2P fails. |
| 49152 - 49252 | UDP | TURN relay media ports | Bidirectional | TURN_RELAY_MIN_PORT, TURN_RELAY_MAX_PORT | Allocate the whole range. Mapped by docker-compose.prod.yml:50. |
| 5432 | TCP | PostgreSQL | Internal docker network only in prod; dev allows host mapping | DATABASE_URL | The production compose does NOT publish 5432 to the host. Dev compose maps ${POSTGRES_PORT:-5432}:5432. |
| 5434 | TCP | PostgreSQL (dev override) | Loopback only | DATABASE_URL | Used when port 5432 is occupied on the dev host (see CLAUDE.md). |
| 9000 | TCP | MinIO S3 API (self-host dev only) | Internal docker network | MINIO_ENDPOINT / S3_ENDPOINT | Ships in the self-host dev docker-compose.yml for local object storage. The Novalien-hosted production compose does NOT ship MinIO; it uses GCS or external S3. |
| 9001 | TCP | MinIO console (self-host dev only) | Local browser | MINIO_CONSOLE_PORT | Should not be exposed to the public internet. |
Firewall rules for a typical install
- Browser -> cloud frontend: allow inbound TCP 443 on the public IP that serves
novavms.novalien.com. - Browser -> WebRTC: allow inbound and outbound UDP 8555 and UDP 49152-49252 on the cloud server.
- Gateway -> cloud: allow outbound TCP 443 on the gateway host (WebSocket + API over TLS).
- Camera -> gateway: allow inbound TCP 554 (RTSP) and UDP 3702 (ONVIF WS-Discovery) on the gateway LAN.
- Gateway -> cameras: allow outbound TCP 80, 443, 554, and the camera’s ONVIF port (often 2020) on the gateway host.
- Cloud -> TURN: leave UDP 3478 inbound open on the cloud server for clients behind strict NAT.
- Between cloud and database: loopback only, no external rule needed.
Related
- Retention policy — how long clips, events, and audit entries are kept
- Roles and permissions — who can trigger network-facing actions