DNS and firewall

Do this before you run the installation. The Let's Encrypt certificates are only issued once the names point at the server and ports 80 and 443 are reachable from the internet.

The examples use the domain example.se and the public address 203.0.113.10.

DNS records

All names are A records pointing at the server's public IPv4 address.

Name	Needed	Used for
app.example.se	Always	The app
api.example.se	Always	The API used by the app and the admin portal, and the SSO sign-in callback
admin.example.se	Always	The admin portal and Grafana (/grafana)
meet.example.se	Always	Meeting links and guests
turn.example.se	When features.video is on (default)	The TURN/STUN server for calls. Clients are given the address turn.example.se:3478.
office.example.se	When features.office is on	Document editing (Collabora)
grafana.example.se	When monitoring.grafana_public: true	Grafana on its own name

app.example.se.     IN A  203.0.113.10
api.example.se.     IN A  203.0.113.10
admin.example.se.   IN A  203.0.113.10
meet.example.se.    IN A  203.0.113.10
turn.example.se.    IN A  203.0.113.10
office.example.se.  IN A  203.0.113.10

Check before you install

for h in app api admin meet turn; do dig +short $h.example.se; done

Every line should show the server's public address.

Keep the default names

The admin portal works out the addresses of the API and the app by replacing admin. with api. and app.. So do not change app, api and admin under subdomains in the configuration.

A single name

With routing: single and hostname: eurion.example.se (see The configuration file) you only need one A record and one certificate:

eurion.example.se.  IN A  203.0.113.10

The TURN server for calls is reached on the same name, port 3478. The ports are the same as below. If you use e-mail in Eurion (features.mail), the mail server needs a name of its own in mail.hostname, with an MX record.

Inbound ports

These must be open from the internet to the server, in an external firewall or as port forwarding in the router.

Port	Protocol	Needed	For
80	TCP	Always	Traefik: Let's Encrypt validation and redirect to HTTPS
443	TCP	Always	Traefik: all web traffic (app, API, admin, meetings, Office)
3478	TCP and UDP	When features.video is on	TURN/STUN (coturn)
49152–65535	UDP	When features.video is on	TURN-relayed media streams (coturn)
10000–10100	UDP	When features.video is on	Media streams straight to the meeting server (mediasoup)
22	TCP	For administration	SSH. Preferably restrict it to your own addresses.

All other services (PostgreSQL, Redis, Kafka, MinIO, search, Grafana, Prometheus and the services' own ports) listen only on 127.0.0.1 or inside Docker's internal network and must not be opened.

The server's own firewall

The kit configures ufw (or firewalld) with 22, 80, 443, 3478 TCP/UDP, 5349 TCP and 49152–65535 UDP. Ports 10000–10100 UDP are published by Docker, which lets them through past ufw. In an external firewall you must open them yourself, otherwise calls work poorly or not at all.

Why 5349 is not in the table

The kit opens 5349 (TURN over TLS) in the server's firewall, but in 1.6.4 the TURN server gets no certificate for that port. Clients use 3478. You do not need to open 5349 in an external firewall.

Server behind NAT

If the server has a private address and is reached via port forwarding:

• server.host in the configuration is the server's private address and server.public_ip the public one. The TURN server and the meeting server announce the public address to clients.
• Forward every port in the table above, with the same port number, to the server's private address.
• Users on the internal network must be able to reach app.example.se and the other names. Use internal DNS that points at the private address, or NAT reflection in the router.

Outbound traffic

The server needs to reach the following over HTTPS:

What	When
Ubuntu/Debian package repositories and download.docker.com	The installation
Docker Hub and ghcr.io (third-party images)	The installation, and updates that add a new third-party service
Let's Encrypt	Certificates are issued and renewed
updates.eurion.se	Checking for and downloading updates (can be switched off, see Updates)
ClamAV's signature database	Virus scanning downloads new signatures (when features.virus_scan is on)
registry.ollama.ai	Language models for AI (when features.ai is on)
huggingface.co	Speech model for transcription (when features.transcription is on)
Your SMTP server	Outgoing e-mail, see Outgoing e-mail
Microsoft's sign-in	If you use Microsoft Entra ID

Checklist

• [ ] A records for app, api, admin, meet (and turn, office if used) point at the public address
• [ ] 80/TCP and 443/TCP open from the internet
• [ ] 3478/TCP+UDP, 49152–65535/UDP and 10000–10100/UDP open (calls)
• [ ] SSH open only to your administrators
• [ ] The server can reach the internet outbound
• [ ] SMTP details ready