Firewall Configuration
This page covers the network access requirements for PrimeCalendar and guidance for firewall rules at the infrastructure level.
Ports in Use
| Service | Default Port | Config | Exposed to? |
|---|---|---|---|
| NestJS backend API | 8081 | PORT env var | Frontend, internal tools |
| Vite dev server / frontend | 8080 | FRONTEND_PORT env var | End users / browser |
| PostgreSQL database | 5432 | DB_PORT env var | Backend only |
There are no hardcoded ports in the application. All use environment variables with fallback defaults.
Network Access Requirements
Backend server must reach
- PostgreSQL database —
taseventeeen.tarhely.eu:5432(TCP) — outbound from the backend server - Google OAuth endpoints —
accounts.google.com,oauth2.googleapis.com(HTTPS/443) — ifENABLE_OAUTH=true - Microsoft OAuth/Graph endpoints —
login.microsoftonline.com,graph.microsoft.com(HTTPS/443) — ifENABLE_OAUTH=true - Stripe API —
api.stripe.com(HTTPS/443) — if payment features are enabled - Email services — if you use an external SMTP provider, outbound SMTP (465/587) may be needed
Backend server inbound rules
| Port | Protocol | Source | Purpose |
|---|---|---|---|
| 8081 | TCP | Frontend origin / load balancer | Backend API |
| 22 (or SSH alternative) | TCP | Management IP only | Server administration |
The backend does not need to be directly reachable by end users. It should be behind a reverse proxy or load balancer with the API only accessible via the proxy.
Frontend static file server inbound rules
| Port | Protocol | Source | Purpose |
|---|---|---|---|
| 443 | HTTPS | Public internet | Serving the React SPA to users |
| 80 | HTTP | Public internet | Redirect to HTTPS |
Database Firewall (External Provider)
The PostgreSQL database at taseventeeen.tarhely.eu:5432 is managed by a third-party hosting provider. You do not control this firewall directly, but the hosting provider typically offers IP allowlisting.
Important constraints:
DB_SSL=false— the server does not support SSL; do not add TLS-requiring firewall policies on the database port- Do not add the PrimeCalendar database to any Docker Compose or Kubernetes setup — use the external hosted database only
- Do not create a database container — this is explicitly prohibited in
CLAUDE.md
If you need to restrict which IPs can reach the database, configure the allowlist in the hosting provider's control panel to permit only the backend server's IP.
CORS vs. Firewall
CORS is an application-level control enforced by the backend, not a network firewall. It prevents browsers from making cross-origin requests that are not allowed — but it does not prevent server-to-server or curl requests. Network firewall rules are a separate and complementary control.
To configure CORS allowed origins:
SECURITY_ALLOWED_ORIGINS=https://yourfrontend.domain.com
FRONTEND_URL=https://yourfrontend.domain.com
See Security Hardening for full CORS configuration details.
Reverse Proxy Recommendations
If you place a reverse proxy (Nginx, Caddy, Azure Application Gateway, Cloudflare) in front of the backend:
- Terminate TLS at the proxy — the backend can run HTTP internally behind the proxy
- Forward
X-Forwarded-For— the backend reads this header for IP-based rate limiting and audit logging; ensure the proxy sets it correctly - Forward
X-Request-Id/ generate correlation IDs — the backend accepts anx-request-idheader and includes it in all log entries - Expose only port 443/80 to the internet — keep port 8081 internal
- Set rate limits at the proxy level in addition to the application-level throttler
Outbound Webhook Traffic
If the automation system is sending webhooks or the application triggers outbound HTTP calls, the backend server needs outbound HTTPS (443) access to those targets. No specific port allowlisting is needed unless you are in a restrictive egress environment.
Inbound webhooks (e.g. Stripe webhook events, automation webhook.incoming triggers) arrive at the backend API port (8081 or whatever is configured). Ensure that port is reachable from the sending service.
Development vs. Production
In development mode (NODE_ENV=development), CORS allows several localhost origins by default (ports 3000, 4200, 5173, 8080, and whatever FRONTEND_PORT is set to). This is intentional for developer convenience and must not be used in production.
In production, always set:
NODE_ENV=production
SECURITY_ALLOWED_ORIGINS=https://your-production-frontend.com
FRONTEND_URL=https://your-production-frontend.com
The CORS blocked request from origin warning log is your signal when a request is hitting the wrong origin allowlist.