Ports And Networking

Ports and networking

What listens where

Port	Service	Notes
443, 8443	Web UI over HTTPS	The same UI on two ports. 8443 is the one the documentation uses
80, 8011	HTTP	Redirects to HTTPS, and serves ACME challenges when Let's Encrypt is configured
3128	Squid forward proxy	Point clients here. Only RFC1918 and localhost sources are accepted by default
5001	Backend API	Bound to 127.0.0.1 on the host. The UI proxies it internally, so it is not reachable from other machines

Port 80 is why a first install can fail on a machine that already serves HTTP: see Known issues.

Checking before you install

sudo ss -tulpn | grep -E ':(80|443|8443|8011|3128)\b'

Anything already bound to 80 or 443 will collide. Either free it, or change the published ports in docker-compose.yml before the first start.

The stack

Five containers, plus an optional sixth:

Service	Tech	Role
web	React 19 and Vite, served by nginx	UI and HTTPS entry point. Terminates TLS, proxies the API and the WebSocket
backend	Go, chi, SQLite, JWT	REST API, log ingestion, settings, auth, background workers. Around 20 MB of RAM
waf	Go ICAP service	Inspects what Squid hands off over ICAP
proxy	Squid on Ubuntu 26.04 (digest-pinned), squid-openssl	The forward proxy itself, on 3128, wired to the WAF
dns	dnsmasq	Sinkholes blacklisted domains at resolve time
tailscale	Tailscale, optional	Remote access sidecar, behind a compose profile

The backend reaches Squid and dnsmasq through the Docker Engine API, which is how a blacklist change reaches the proxy in a couple of seconds without restarting anything.

Why clients are not being filtered

In order of likelihood:

1. The client's proxy setting. It has to point at http://<host>:3128. Settings, Client Setup generates per-OS instructions and a PAC file
2. The source address. Only RFC1918 and localhost are accepted. A client on a public address is refused, not filtered
3. HTTPS without SSL bump. By default HTTPS is filtered by host, IP and DNS only. WAF body rules never see it until you enable SSL inspection and install the generated CA as trusted on the client

Exposing it

Port 3128 is meant for a private network. Publishing it without a network boundary turns your gateway into an open proxy for anyone who finds it. If clients are remote, use the Tailscale sidecar or a VPN rather than opening the port.

The SSL-bump CA is generated per deployment at first boot and lives under config/. That private key can decrypt the inspected traffic of every client that trusts it. Treat it accordingly, and never copy it between deployments.