...
Canopy communicates over the following TCP ports:
| Service Group | Service | Port (Protocol) | Publicly Accessible? | Security | Notes |
|---|---|---|---|---|---|
| Canopy application server | Web Server | 443 (https) | Yes | Yes - hardened TLS configuration out of the box | This is a standard web service, running on nginx as standard (apache also supported). It is also the primary, and only, interface that needs to be accessible to users of the application. The Web Service acts as a reverse proxy to the Application Service, for both user access and API (RESTful) access. A self-signed certificate is used by default, which should be replaced with a production ready certificate. |
| Canopy application server | Application Service | 8000 (http) | No | Localhost configuration by default. | The Application Service is built on top of django and is typically bound to localhost only. If network communication is required (e.g. for large scale deployments), this service is wrapped (reverse proxy) via another Web Server layer, which would use the default TLS hardened configuration. |
| Canopy application server | RabbitMQ server | 5672 (amqp) | No | Localhost configuration by default; default username/password. | RabbitMQ is a backend message queue for running asynchronous jobs via celery. RabbitMQ can be configured to run over TLS, which may be a requirement under larger/enterprise deployments. Specific guidelines are available on the RabbiMQ site: https://www.rabbitmq.com/ssl.html It is recommended that the default username/password be changed on install, even though the service is restricted to localhost. |
| Canopy database server | PostgreSQL (default) | 5432 (pgql) | No | Localhost configuration by default; default username/password accessible through a user-restricted admin script. | PostgreSQL is the primary database supported by Canopy. Oracle may also be used (REF). Additional PostgreSQL hardening guidelines are provided at: REF. |
| Canopy report server | Docserver | 8181 (http) | No | Localhost configuration by default; no authentication required. | This service accepts a docx (template) and an XML (data source) and returns a generated docx file to the application server. This service can be run on alternative server (for load distribution). In such a scenario, we recommend using nginx as a frontend proxy, which can be secured via TLS. |
| Canopy report server | PDF converter | 9016 (http) | No | Localhost configuration by default; no authentication required. | This service accepts a docx and returns a docx and PDF to the calling application. This service can be run on alternative server (for load distribution). In such a scenario, we recommend using nginx as a frontend proxy, which can be secured via TLS. |
| Other | Mail routing | 25 (smtp) | No | Outbound only service, for mail routing. | This is a dependency for sending mail-based notifications to users. Outbound firewall requirement. |
Deployment scenarios
Single server
...