Endpoints and ports
The ports each obleth component listens on, and how Docker Compose, the Helm chart and HAProxy expose them.
3 min readUpdated for v2.4.0Edit on GitHub
obleth listeners
The gateway binary opens three listeners.
| Listener | Default bind | Set with | Serves |
|---|---|---|---|
| Data plane | 0.0.0.0:8080 | OBLETH_PROXY_LISTEN | Client API, /mcp/…, /health |
| Management API | 0.0.0.0:9180 | OBLETH_ADMIN_LISTEN | /api/v1/… |
| Metrics | 0.0.0.0:9091 | OBLETH_METRICS_LISTEN | /metrics |
The other components listen on: control plane 3000, compression sidecar
8080, benchmark backend 8081 (BENCHMARK_BACKEND_LISTEN). The provisioner
has no listener. Routes are listed in
Data-plane routes and
Management API.
Docker Compose host ports
| Service | Container port | Host binding | Profile |
|---|---|---|---|
obleth data plane | 8080 | 8088 | core |
obleth Management API | 9180 | 127.0.0.1:9180 | core |
obleth metrics | 9091 | 127.0.0.1:9091 | core |
control-plane | 3000 | 3002 | core |
postgres | 5432 | 127.0.0.1:5432 | core |
redis | 6379 | 127.0.0.1:6379 | core |
clickhouse HTTP, native | 8123, 9000 | 127.0.0.1:8123, 127.0.0.1:9000 | core |
benchmark-backend | 8081 | 8081 | benchmark |
haproxy | 80 | 80 | edge |
prometheus | 9090 | 127.0.0.1:9090 | observability |
grafana | 3000 | 3001 | observability |
jaeger UI, OTLP gRPC, OTLP HTTP | 16686, 4317, 4318 | 127.0.0.1 for each | observability |
dex | 5556 | 5556 | sso-dev |
A binding without an address listens on all host interfaces. These ports
reach only the Compose network: HAProxy 8404 (metrics and /stats), the
compressor's 8080, ClickHouse 9363 (metrics), postgres-exporter 9187 and
redis-exporter 9121.
Kubernetes service ports (Helm)
Every Service is ClusterIP; <release> is the Helm release name.
| Service | Ports | Present when |
|---|---|---|
<release>-obleth | proxy 8080, admin 9180, metrics 9091 | always |
<release>-control-plane | 3000 | controlPlane.enabled |
<release>-compressor | http 8080 | compressor.enabled |
<release>-postgres | 5432 | postgres.enabled |
<release>-redis | 6379 | redis.enabled |
<release>-clickhouse | http 8123, native 9000 | clickhouse.enabled |
<release>-benchmark-backend | 8081 | benchmarkBackend.enabled |
The optional Ingress routes to ingress.servicePort (8080, the data plane).
The ServiceMonitor scrapes the metrics port. The provisioner has no Service.
With networkPolicy.enabled, the chart allows only this inbound traffic:
| Target | Allowed from |
|---|---|
obleth 8080, 9091 | anywhere |
obleth 9180 | control plane and provisioner pods |
Postgres 5432 | obleth and control plane pods |
Redis 6379, ClickHouse 8123 and 9000 | obleth pods |
See Helm values for the settings.
HAProxy frontend
The Compose edge profile runs HAProxy; the Helm chart does not.
| Port | Serves |
|---|---|
80 | Round-robin to the obleth data plane on 8080 |
8404 | HAProxy /metrics and /stats (Compose network only) |
The shipped config is plaintext and assumes TLS ends in front of it. See HAProxy.
Health checks
GET /health on the data plane and GET /api/v1/health on the Management API
need no token and return ok.
curl http://localhost:8088/health # data plane, Compose host port
curl http://localhost/health # through HAProxy (edge profile)
curl http://localhost:9180/api/v1/health # Management API
curl -s http://localhost:9091/metrics | head
A plain cargo run binds 8080 directly, so there the data plane is on
localhost:8080. GET /v1/models needs an API key, so use /health for
liveness probes.