Binions asks very little of your network. It needs outbound HTTPS to install, license, and update itself — and it exposes almost nothing inbound. Everything the platform runs internally talks over the host’s own loopback address, so the only thing the outside world ever reaches is the edge router — and even that is a single process presenting a few authenticated, TLS-protected entry points.
Closed by default. A standard Binions host listens for nothing from the network except the edge router (Traefik) and its authenticated HTTPS entry points. Every database, cache, and health endpoint stays bound to
127.0.0.1and is unreachable from outside the machine.
| Outbound (egress) | HTTPS (TCP 443) to the Binions package repository and the licence server |
| Inbound (ingress) | Only the edge router (Traefik): a main HTTPS edge plus a few authenticated admin entry points — nothing else |
| Internal services | Bound to 127.0.0.1 only — never exposed to the network |
| Firewall baseline | Default-drop on inbound, with explicit allows for what the edge serves |
| Offline tolerance | An offline grace period keeps running daemons working through brief internet outages |
Binions makes outbound HTTPS connections for a small number of jobs. If your host can reach the internet over port 443, you are covered.
apt from the signed Binions package repository over HTTPS, so the host needs outbound access to that repository to install and to receive updates.Internet drops are fine. Once a set is activated, Binions keeps an offline grace period, so a short loss of internet connectivity does not stop your running daemons. For hosts that have no internet access at all, see Offline / air-gapped install.
The only component that listens for traffic from the network is the edge router (Traefik). It is a single process, but it presents several entry points on your bind address: a main HTTPS edge for the routes you publish, and a small set of dedicated entry points for the platform’s bundled admin tools. Every one of them terminates TLS, and all but the object-store console sit behind HTTP Basic authentication.
| Entry point | Port | What it serves | Authentication | Open in the firewall? |
|---|---|---|---|---|
| Main HTTPS edge | :8443 | Routes you publish to the edge; the bundled Jaeger tracing UI answers here by default | Basic auth | Yes — the front door |
| HTTP redirect | :8081 | Redirects every plain http:// request to HTTPS (301) | — | Yes |
| Traefik dashboard | :8444 | The edge router’s own admin dashboard | Basic auth | Restrict to your admin network |
| MinIO console | :8445 | Web console for the object store | MinIO sign-in | Restrict to your admin network |
| Showman hub | :8446 | Operator pages published by showman-service | Basic auth | Restrict to your admin network |
The ports are fixed; only the address is yours. These port numbers are platform defaults baked into the edge configuration — you never set them. What you choose is the single bind address they all listen on, fixed once when the host is bootstrapped.
One related service sits beside the edge rather than behind it: the Jaeger tracing UI also answers directly on its own port :16686 on the bind address (plain HTTP, relying on network isolation), in addition to the authenticated view served at the edge on :8443. Keep it on a trusted network.
Every other part of Binions — each daemon, the databases, the cache, the object store’s S3 API — is loopback-only. Those services bind to 127.0.0.1, which means they accept connections only from the host itself. They have no externally reachable ports, so there is nothing on the network for an attacker to scan or connect to.
One process at the edge, by design. All inbound traffic is concentrated in the single edge router, so you secure and watch one process, not a dozen services. The admin entry points are authenticated and meant for operators — keep them on a trusted network. TLS termination at the edge is covered in TLS & the Traefik edge.
For reference, these are the supporting services Binions runs on the host. They all listen on 127.0.0.1 (loopback) only and are not reachable from the network — you do not open firewall holes for any of them. The edge router reaches them on your behalf; the network never does.
| Service | Bind address | Reachable from the network? |
|---|---|---|
| PostgreSQL | 127.0.0.1:5432 | No |
| MinIO (object storage) | 127.0.0.1:9000 · console 127.0.0.1:9001 | No |
| Per-daemon Redis | 127.0.0.1, one instance per daemon | No |
| Daemon health endpoints | 127.0.0.1:91xx (one port per daemon) | No |
| Daemon HTTP servers | 127.0.0.1 — e.g. showman on :9099 (served to the network only through the edge) | No |
| Jaeger OTLP collector | 127.0.0.1:4317 (daemons export spans here) | No |
Because these are bound to loopback, the host can use them freely while the network sees nothing. You only need to think about the network for the edge router and for outbound HTTPS.
The recommended baseline matches how a Binions host ships: default-drop on inbound, allowing only what the edge actually serves.
:8443 and the HTTP redirect :8081 — plus whatever you use for administration, such as SSH.:8444, MinIO console :8445, and Showman hub :8446 are operator tools. They are authenticated, but for defence in depth limit them to a trusted admin network or VPN rather than exposing them to the open internet.127.0.0.1 — never add rules to expose them to the network.Don’t publish internal ports. Exposing PostgreSQL, MinIO, Redis, or a health endpoint to the network defeats the loopback-only design. Keep them private and route all external access through the edge. Hardening steps live in Hardening.