Chapter 9: Network and firewall
← Back to Index | Previous: Post-install configuration | Next: Troubleshooting →
9.1 Overview
This chapter lists destinations and ports for enterprise Deslicer AI and DAP installs. All Deslicer registry traffic uses HTTPS on port 443 unless noted.
9.2 Outbound allowlist (AI and DAP hosts)
| Host | Purpose |
|---|---|
artifact-registry.deslicer.io |
Install scripts, Ansible bundles |
container-registry.deslicer.io |
Docker/OCI image pulls |
package-registry.deslicer.io |
Package repository channels when used |
nexus-registry.deslicer.io |
Nexus admin / REST when required |
registry.deslicer.io |
Registry metadata API |
If your engagement uses an alternate or regional registry hostname, Deslicer lists it in the handoff—add those hosts as well.
ACME (automatic HTTPS)
When using ACME on a host, allow outbound HTTPS to your certificate authority (for Let’s Encrypt, the public ACME endpoints). The host must also accept inbound HTTP 80 for HTTP-01 challenges unless you use a DNS challenge mode Deslicer configured for you.
9.3 Inbound ports
AI host
| Port | Direction | Purpose |
|---|---|---|
| 443/tcp | Inbound | Public HTTPS via Deslicer Caddy |
| 80/tcp | Inbound | ACME HTTP-01 (when using automatic HTTPS) |
Do not expose 13000 or 13001 on the public interface.
DAP host
| Port | Direction | Purpose |
|---|---|---|
| 443/tcp | Inbound | Observer API edge (Deslicer Caddy) |
| 8443/tcp | Inbound | Observer UI edge (Deslicer Caddy) |
| 80/tcp | Inbound | ACME HTTP-01 when using automatic HTTPS |
Always open the ports Control shows for your backend—not only this table.
9.4 Host-to-host
| Source | Destination | Purpose |
|---|---|---|
| AI host | DAP Observer URL | Deslicer AI → Observer API integration |
| Operator workstations | AI :443, DAP edge ports |
Control, app UI, Observer UI |
| Splunk / worker hosts | DAP Observer URL | Later enrollment (after platform install) |
9.5 Proxies
If hosts must use an HTTP CONNECT proxy for outbound HTTPS:
- Configure Docker and the OS trust store per your standard
- Ensure the proxy allows the Deslicer registry hosts above
- ACME HTTP-01 still needs a public path to port 80 on the product host (or a DNS challenge)
← Back to Index | Previous: Post-install configuration | Next: Troubleshooting →