Allow these outbound. Nothing inbound is required.
Important
Allow the hostnames themselves. If you resolve them to IP addresses and allow those instead, your deployment will break, because we use Cloudflare in front of our infrastructure and the addresses change.
Screenly
| Hostname | Port | Purpose |
|---|---|---|
api.screenlyapp.com | 443 TCP | Our API |
mtls.screenlyapp.com | 443 TCP | Alternative path to the API |
login.screenlyapp.com | 443 TCP | Access to Screenly services |
us-assets.screenlyapp.com | 443 TCP | Asset storage |
ws.screenlyapp.com | 443 TCP | Web socket, for real-time updates on players |
sentry.screenlyapp.com | 443 TCP | Error tracking and monitoring |
Operating system
ScreenlyOS is built on Ubuntu Core, so it needs Canonical’s endpoints as well.
| Hostname | Port | Purpose |
|---|---|---|
snapcraft.io and *.snapcraft.io | 443 TCP | Ubuntu Core |
*.cdn.snapcraft.io | 443 TCP | Ubuntu Core |
*.snapcraftcontent.com | 443 TCP | Ubuntu Core |
login.ubuntu.com | 443 TCP | Ubuntu Core |
myapps.developer.ubuntu.com | 443 TCP | Ubuntu Core |
search.apps.ubuntu.com | 443 TCP | Ubuntu Core |
public.apps.ubuntu.com | 443 TCP | Ubuntu Core |
upload.apps.ubuntu.com | 443 TCP | Ubuntu Core |
serial-vault-partners.canonical.com | 443 TCP | Initial link with Ubuntu’s application store |
ntp.ubuntu.com | 123 UDP and TCP | Time synchronisation |
Network checks
| Hostname | Protocol | Purpose |
|---|---|---|
google.com | ICMP | Network check |
8.8.8.8 | ICMP | Network check |
If wildcards are not allowed
Some firewalls cannot match on a wildcard. These are the names behind each one, all on port 443 TCP.
In place of *.snapcraftcontent.com
| Hostname |
|---|
storage.snapcraftcontent.com |
canonical-lgw01.cdn.snapcraftcontent.com |
canonical-lcy01.cdn.snapcraftcontent.com |
canonical-lcy02.cdn.snapcraftcontent.com |
canonical-bos01.cdn.snapcraftcontent.com |
cloudfront.cdn.snapcraftcontent.com |
In place of *.cdn.snapcraft.io
| Hostname |
|---|
fastly.cdn.snapcraft.io |
fastly-global.cdn.snapcraft.io |
cloudfront.cdn.snapcraft.io |
canonical-lgw01.cdn.snapcraft.io |
canonical-lcy01.cdn.snapcraft.io |
canonical-bos01.cdn.snapcraft.io |
In place of *.snapcraft.io
| Hostname |
|---|
api.snapcraft.io |
dashboard.snapcraft.io |
You may also need to allow your DNS servers on port 53 UDP.
Note
This list changes as our infrastructure does. If you are building a long-lived firewall rule, check back rather than treating a copy as permanent.