What to open in a firewall
A standard install needs one way in and none out: clients reach SecretHive over HTTPS. Everything outbound on this page applies only if you switched that feature on.
In
| From | To | Port | Why |
|---|---|---|---|
| People, hosts, CI jobs | the reverse proxy in front of SecretHive, or SecretHive itself | 443/tcp, or 8443/tcp directly | Everything: the pages and the API |
| That proxy | the SecretHive container | 8443/tcp | HTTPS; the proxy re-encrypts and trusts the server's own certificate |
| The monitoring system, the container's health check | the SecretHive container | 8080/tcp | /health only. Everything else on this port is sent to HTTPS |
Nothing else listens. There is no separate admin port and no management agent.
The server reads the visitor's address from the proxy only when the proxy's own address is listed in
SecretHive__Proxy__Trusted. If anything other than that proxy can connect to 8443, it is seen with its own address,
which is what you want: a forwarded address from an unlisted sender is ignored.
A host that fetches its secrets at deploy time should reach the server directly where it can, with the server's certificate pinned, rather than around through a public name: fewer places the values pass through, and a key limited to the host's address then means something.
Out
Only what a setting of yours asks for. A server with local accounts and SQLite needs no egress at all.
| To | Port | Why | Needed when |
|---|---|---|---|
| Your identity provider | 443/tcp | Discovery, signing keys and the token exchange during sign-in | A sign-in provider is set up |
| Your CI platform's issuer address | 443/tcp | Its published signing keys, to check a job's token | A provider accepts tokens on the API |
| Your SQL Server | 1433/tcp | The database | SecretHive__Database__Provider is SqlServer |
| Your collector | as configured | Audit events, traces and metrics | OTEL_EXPORTER_OTLP_ENDPOINT is set |
Plus DNS and NTP, as for any container. Token checks depend on the clock: a job's token is valid for minutes, and SecretHive accepts none that lives longer than a day.
SecretHive contacts nothing on its own behalf. There is no telemetry, no update check and no licence call.
The hosts that fetch
| From | To | Port | Why |
|---|---|---|---|
A host running secrethive render |
SecretHive | 8443/tcp, or 443/tcp through the proxy | Reading its stacks' secrets at deploy time |
| A CI runner | SecretHive | the same | A job reading with its token |
| The same CI runner | its own platform | 443/tcp | Asking for the token |
When the server cannot be reached, a host with a sealed bundle deploys from that and says so. A refusal is not "cannot be reached": a host whose key was revoked is refused and does not fall back.