Service Port Map
Only one port faces outbound
In the AI stack, only plantpulse-proxy (nginx) holds host ports 80 / 443.
The chat interface, admin console, and all APIs reach through this proxy.
Before 2026-08, AI Chat Web published directly on 80:8080. Now it does not publish;
it opens only inside the container (expose: 8080). This consolidates the exposure point so
firewall, audit, and TLS are handled in one place. If you were reading old documentation
and looking for port 80 on the app container, check the proxy instead.
Routed by hostname
The proxy reads the Host header and selects the backend. You must point these names
to the proxy IP in DNS so each service is reachable.
| Hostname | Backend | What |
|---|---|---|
| Everything else (default) | copliot-web:8080 | AI Chat Web — chat interface |
admin.* | admin-web:80 | Admin console |
llm.* | litellm-proxy:4000 | LLM gateway (OpenAI-compatible) |
rag.* | rag-api:7115 | RAG search API |
timeseries.* | insight-api:8970 | Time series insight API |
parser.* | document-understanding-api:7120 | Document parsing API |
vision.* | vision-api:7130 | Vision API |
The proxy listens on 443 as well, but in deployments with a separate load balancer
or reverse proxy in front, TLS terminates there and plaintext enters the proxy.
Ignoring frontend termination causes infinite redirects. Check which form you have first.
Ports open directly to the LAN
These ports are published to the host without passing through the proxy. Binding is
not 127.0.0.1 but to all interfaces — use a firewall to block access from outside the
corporate network.
| Port | Service | Why open |
|---|---|---|
| 80 / 443 | plantpulse-proxy | Only user entry point |
| 4000 | LiteLLM | Direct LLM gateway access (also reachable via llm.*) |
| 7115 | RAG API | Direct access for MCP clients (Claude Desktop, etc.) |
| 8970 | TimeSeries Insight API | Direct access for MCP clients |
| 9080 | Admin console (admin-web) | For operators. Also reachable via admin.* |
| 7474 | Neo4j Browser | Graph DB admin UI |
| 7687 | Neo4j Bolt | Graph DB query protocol |
Enabled only with profiles
These are not in the default startup and appear only when the corresponding compose profile is enabled.
| Port | Service | Profile |
|---|---|---|
| 6006 | Arize Phoenix — trace UI | observability |
| 5000 | Local image registry | registry |
| 5080 | Registry admin UI | registry |
| 9090 | Old Copilot Web | archived |
It dropped from the default stack in the 2026-07 redesign but can be restored with the
observability profile. It is also viewable through the proxy in the admin console. The Langflow
(7860) and Jupyter (3500) that dropped in the same redesign are truly removed and cannot
be restored.
Internal only (not published)
Reachable by service name only within the compose network. Probing from the host with
nc -z returns no response — this is normal.
| Service | Internal address | Role |
|---|---|---|
| AI Chat Web | copliot-web:8080 | Chat interface (default proxy backend) |
| Admin console backend | admin-api | Auth source. nginx at admin-web forwards to it |
| Document parsing API | document-understanding-api:7120 | Backend for parser.* |
| Vision API | vision-api:7130 | Backend for vision.* |
| LightRAG | lightrag:9621 | RAG engine. Document management WebUI at /webui |
| Qdrant | qdrant:6333 | Vector DB |
| Docling | docling-serve:5001 | Document conversion |
| vLLM (generation) | vllm-llm:8000 | Local LLM inference |
| vLLM (embedding) | vllm-emb:8000 | Embedding |
| vLLM (reranking) | vllm-rerank:8000 | Reranking |
| Time series inference | timeseries-inference:8980 | Insight model serving |
| DCGM Exporter | dcgm-exporter | GPU metrics |
plantpulse-mcp-server (50000) and plantpulse-ontology (8888) no longer exist as independent services.
MCP and ontology tools are now provided by the platform's server-web integrated MCP
(/api/v5/mcp, api_key auth).
Borrowed from the platform
PostgreSQL (5432) · Cassandra (9042) · Redis/Valkey (6379) · MinIO (9000/9001) are not launched by the AI stack. They use a shared PlantPulse platform installation. Firewall and account settings for these ports follow the platform's security settings.
Check port status
Full status check
cd /home/kopens/plantpulse-ai/bin
./status.sh
health.sh probes the health endpoint of each service. A container running and actually
responding are different things; use this for troubleshooting.
Individual port check
# 특정 포트 리스닝 확인
nc -z 127.0.0.1 <port> && echo "OK" || echo "DOWN"
# 포트 사용 프로세스 확인
ss -tlnp | grep <port>
What to open in the firewall
| Target | Open ports |
|---|---|
| All users | 80 / 443 (proxy) |
| Operators (corporate network) | 9080 admin console, 7474 Neo4j Browser |
| MCP clients (corporate network) | 7115 RAG, 8970 TimeSeries |
No reason to open any other ports, even within the corporate network. Database ports (5432 · 9042 · 6333 · 6379 · 7687 · 9000) must never be exposed externally under any circumstances.