Network
Weik.io 2026.2Every connection between the hub, the agents, the CLI and your API callers, with its port and protocol, and the firewall rules that follow from them. Product page · Video
Watch: What runs where, 3:42
The video shows where the hub and the agents run and the two outbound connections an agent makes on port 443.
This part of the video couldn't be loaded.
On this page
Weik.io never opens an inbound port at a site. An agent makes two outbound connections to the hub, both on port 443, and everything else it does is the integrations’ own traffic to your systems. The hub publishes port 443 and nothing else, and it terminates TLS for its own names and for every gateway hostname.
What leaves a site#
| From | To | Port and protocol | Carries |
|---|---|---|---|
| The agent’s leaf node | The hub’s link address, such as nats. |
443, WebSocket over TLS (wss) |
The agent’s control traffic, events in both directions and the built integration versions the agent fetches |
| Each integration’s Java process and the agent | The hub’s address, /, / and / |
443, HTTPS | Logs, metrics and traces over OpenTelemetry (OTLP), each process with its deployment’s own credential |
Both connections go to port 443 of the hub, so an agent that can reach the hub can do both. A host that also runs a gateway uses the same two connections. Logs, metrics and traces don’t travel on the link the agent’s control traffic uses, which keeps the bulk of the data off the connection the agent depends on.
An integration’s own traffic, such as calls to an ERP, a bank’s SFTP server or a database, leaves from the site on that system’s own port. Weik.io neither opens nor manages it.
What stays inside a site#
| Between | On |
|---|---|
| The Java processes and the local leaf node | Port 4222 on the site’s own container network, never published |
| The agent and each process’s health and metrics endpoint | One loopback port per process, from a configured range |
The agent and a running integration, for weikio invoke |
Files in the integration’s run folder, with no network port |
| An integration’s own HTTP listener | Port 8080 on every interface, as plain camel run serves it, unless the integration sets its own server settings. The site’s firewall decides who reaches it. |
A partner the hub serves can call an API in front of an integration at a site through a hub gateway that relays to the site’s gateway, with no port opened at the site. Gateways at sites describes the relay.
Ports at the hub#
| Listener | Port | Reached by |
|---|---|---|
| The backend: the API, the admin UI, the token issuer and the OTLP ingest | 443, through your load balancer | The CLI, pipelines, browsers and every agent |
| APIM, the API gateway | 443, one or more hostnames per environment | Your API callers |
| The message server’s link listener | 443, WebSocket | The leaf node of every agent |
| The message server’s client port | The hub’s own network only | The backend and APIM, and an agent’s credential is refused there |
| The log, metric and trace stores | The hub’s own network only | The backend only |
/ and / |
443, on the hub’s address | Your monitoring and weikio platform health |
/ |
The hub’s own network, never through port 443 | Your monitoring |
Port 443 at the hub passes each connection on by the name it asks for. The terminator gives its replies the Referrer-Policy, X-Content-Type-Options and Permissions-Policy headers the hub gives its own, and a request no route serves gets an empty 404 with these headers and Strict-Transport-Security. The hub’s own names terminate TLS at the hub’s terminator, and every gateway hostname goes to APIM, which terminates TLS with that gateway’s certificate. TLS 1.2 and 1.3 are accepted, and on TLS 1.2 only the AEAD cipher suites, AES-GCM and ChaCha20. On a hub of several servers, the message servers’ routes between the servers use TLS too.
The hub publishes port 443 and nothing else, and four DNS names point at it. Port 443 passes each connection on by the name it asks for. The CLI, pipelines, browsers and each agent's telemetry use acme.example, and each agent's leaf node links to nats.acme.example. The terminator ends TLS for these two names of the hub's own and passes them to the backend, with the API, the admin UI, the token issuer and the OTLP endpoint, and to the message server's link listener. Callers of production APIs use api.acme.example and callers of devtest APIs use api-test.acme.example. These go to the API gateway, which ends TLS itself with the certificate of each environment's gateway.
The platform obtains and renews every certificate itself. A name that points at the hub is proved to the public authority on port 443, and a name behind a CDN’s proxy or on an internal network is proved through DNS. A name no public authority signs, such as an .internal name, gets a certificate from the platform’s own authority. Certificates describes each source and when the platform uses it.
The hub’s four names#
An installation with two environments has four DNS names, all pointing at the hub’s address:
| Name | Goes to | Used by |
|---|---|---|
acme. |
The backend and the admin UI | The CLI, pipelines, browsers and the telemetry of every agent |
nats. |
The message server’s link listener | The leaf node of every agent, as wss:// |
api. |
APIM, the gateway of production | Callers of production APIs |
api- |
APIM, the gateway of devtest | Callers of devtest APIs |
The two API names are the hostnames of each environment’s gateway. Adding a gateway or a hostname adds a name here and in DNS, and the platform obtains its certificate. When the names are behind Cloudflare’s proxy, the CLI uploads large integration files in parts under the proxy’s request size limit and resumes an interrupted upload.
Firewall rules#
| Direction | Rule |
|---|---|
| Inbound to the hub | Port 443 only, from wherever the CLI, pipelines, API callers and agents connect from |
| Inbound to a site | Nothing |
| Outbound from a site | Port 443 to the hub’s address. The integrations’ own traffic to your systems is separate. |
| Outbound from the hub | The Maven repositories the builder resolves dependencies from, which an air-gapped hub replaces with one mirror, and, when you set them up, a Dapr secrets sidecar and the systems telemetry forwarding sends to |
The hub never connects to a Git repository. Pipelines push changes to Weik.io with the weikio CLI, so the hub needs no Git credentials and no network path to your Git host.
An agent beside the hub, in the hub’s own network, can link to the message server’s listener on port 7422 directly instead of through port 443. It’s enrolled with --via hub-network and needs no public name. The hub’s allowed networks limit which addresses can reach the hub’s names, and Allowed networks and TLS describes them.