# Hostnames and ports


> The outbound hostnames and ports a ScreenlyOS player needs, for allowlisting on a restricted network.
Allow these outbound. Nothing inbound is required.

> [!IMPORTANT]
> Allow the hostnames themselves. If you resolve them to IP addresses and allow those instead, your deployment will break, because we use Cloudflare in front of our infrastructure and the addresses change.

## Screenly

| Hostname | Port | Purpose |
| --- | --- | --- |
| `api.screenlyapp.com` | 443 TCP | Our API |
| `mtls.screenlyapp.com` | 443 TCP | Alternative path to the API |
| `login.screenlyapp.com` | 443 TCP | Access to Screenly services |
| `us-assets.screenlyapp.com` | 443 TCP | Asset storage |
| `ws.screenlyapp.com` | 443 TCP | Web socket, for real-time updates on players |
| `sentry.screenlyapp.com` | 443 TCP | Error tracking and monitoring |

{{% comment %}}
Withheld until these channels ship. Asking customers to open a port for a
host we do not use yet is roadmap disclosure and attack surface in one row.

| `mqtt.screenlyapp.com` | 443 and 8883 TCP | Reserved for future real-time updates |
| `vpn.screenlyapp.com` | 51820 UDP | Reserved for a future alternative channel |
{{% /comment %}}

## Operating system

ScreenlyOS is built on Ubuntu Core, so it needs Canonical's endpoints as well.

| Hostname | Port | Purpose |
| --- | --- | --- |
| `snapcraft.io` and `*.snapcraft.io` | 443 TCP | Ubuntu Core |
| `*.cdn.snapcraft.io` | 443 TCP | Ubuntu Core |
| `*.snapcraftcontent.com` | 443 TCP | Ubuntu Core |
| `login.ubuntu.com` | 443 TCP | Ubuntu Core |
| `myapps.developer.ubuntu.com` | 443 TCP | Ubuntu Core |
| `search.apps.ubuntu.com` | 443 TCP | Ubuntu Core |
| `public.apps.ubuntu.com` | 443 TCP | Ubuntu Core |
| `upload.apps.ubuntu.com` | 443 TCP | Ubuntu Core |
| `serial-vault-partners.canonical.com` | 443 TCP | Initial link with Ubuntu's application store |
| `ntp.ubuntu.com` | 123 UDP and TCP | Time synchronisation |

## Network checks

| Hostname | Protocol | Purpose |
| --- | --- | --- |
| `google.com` | ICMP | Network check |
| `8.8.8.8` | ICMP | Network check |

## If wildcards are not allowed

Some firewalls cannot match on a wildcard. These are the names behind each one, all on port 443 TCP.

### In place of `*.snapcraftcontent.com`

| Hostname |
| --- |
| `storage.snapcraftcontent.com` |
| `canonical-lgw01.cdn.snapcraftcontent.com` |
| `canonical-lcy01.cdn.snapcraftcontent.com` |
| `canonical-lcy02.cdn.snapcraftcontent.com` |
| `canonical-bos01.cdn.snapcraftcontent.com` |
| `cloudfront.cdn.snapcraftcontent.com` |

### In place of `*.cdn.snapcraft.io`

| Hostname |
| --- |
| `fastly.cdn.snapcraft.io` |
| `fastly-global.cdn.snapcraft.io` |
| `cloudfront.cdn.snapcraft.io` |
| `canonical-lgw01.cdn.snapcraft.io` |
| `canonical-lcy01.cdn.snapcraft.io` |
| `canonical-bos01.cdn.snapcraft.io` |

### In place of `*.snapcraft.io`

| Hostname |
| --- |
| `api.snapcraft.io` |
| `dashboard.snapcraft.io` |

You may also need to allow your DNS servers on port 53 UDP.

> [!NOTE]
> This list changes as our infrastructure does. If you are building a long-lived firewall rule, check back rather than treating a copy as permanent.