DDM HelpFirewall
An installation needs few connections to the outside. All of them use HTTPS (TCP 443), except the one to your mail server. If your server may not reach the internet directly, send them through a proxy: HTTPS_PROXY (see Configuration) for the cms, and the proxy setting of Docker or your container runtime for pulling images.
Incoming
| Port | From | For |
|---|---|---|
| TCP 443 | your staff's devices | The cms and the reader app under their two hostnames. Whoever uses the mobile app on the move needs them from the internet. |
| TCP 80 | internet | Only with the Caddy we ship: Let's Encrypt checks here that the hostnames are yours, then Caddy redirects to HTTPS. Not needed with certificates of your own. |
With Kubernetes the connections arrive at your ingress controller; the same applies there.
Outgoing – always needed
| Destination | Port | From | For |
|---|---|---|---|
registry.gitlab.com | 443 | Docker, or every Kubernetes node | Pulling DDM's images. |
gitlab.com | 443 | Docker, or every Kubernetes node | Signing in to the registry with your deploy token. |
cdn.registry.gitlab-static.net | 443 | Docker, or every Kubernetes node | The registry serves the images' contents from here. |
cms.documentdistributionmanager.com | 443 | the cms service | Renewing the licence, asking for new releases, passing feature requests and bug reports on to us. |
Only the machine that pulls the images needs the registry – when setting up and at every update. The cms needs us all along: if it cannot reach us, the licence lapses at the end of its term. Without this rule you renew it by hand, see Licence.
With Docker Compose and Caddy
| Destination | Port | For |
|---|---|---|
registry-1.docker.io, auth.docker.io, production.cloudflare.docker.com | 443 | Caddy's image is on Docker Hub. |
acme-v02.api.letsencrypt.org | 443 | Caddy gets and renews the TLS certificates. |
Outgoing – depending on what you use
All from the cms service:
| Destination | Port | When |
|---|---|---|
| Your mail server | usually 587 or 465 | With SMTP – for invitations, password links and notifications. |
api.resend.com | 443 | If you send mail through Resend instead of SMTP. |
| Your S3 endpoint | 443 | If the documents are kept in a bucket rather than on a volume. |
login.microsoftonline.com, graph.microsoft.com | 443 | Signing in with Microsoft Entra ID, SharePoint and OneDrive as a source, Outlook calendars. |
oauth2.googleapis.com, www.googleapis.com | 443 | Google Drive as a source, Google calendars. |
| Your identity provider | 443 | Signing in through another provider (SSO), such as Okta or Keycloak. |
api.anthropic.com or api.openai.com | 443 | The AI assistant – or the address you entered for it, such as Azure OpenAI. |
| The systems you connect | as entered | Webhooks, PIM imports and other sources you set up in DDM. |
accounts.google.com is opened only by your staff's browsers when they connect a Google calendar – not by the server.
Between the services
With Docker Compose the services talk in a network of their own; nothing needs allowing. If you use NetworkPolicies on Kubernetes, allow:
| From | To | Port |
|---|---|---|
| ingress controller | cms, client | TCP 3000 |
client | cms | TCP 3000 |
cms, render-worker | postgres | TCP 5432 |
Plus DNS (UDP and TCP 53) to your cluster DNS for every service.