Skip to main content

Network requirements

{/* notion-sync: page_id=1df1928df74d80d6b4eec3ba8028c32c /} {/ Notion is the source of truth: https://app.notion.com/p/1df1928df74d80d6b4eec3ba8028c32c — re-sync from Notion before treating this file as authoritative. */}

Requirements when installing a Welotec (or equivalent IPC) on the customer network to run Roasthubs:

  • A static IP address for the Linux host (so the instance can be reached on the local network).
  • Inbound and outbound UDP and TCP port 9993 (ZeroTier VPN access to the Welotec).
  • Inbound and outbound UDP ports 443 and 7844 (Cloudflare tunnel).

We also prefer a static IP so day-to-day operations do not depend solely on an external internet connection. Please reserve an address and share it with Roasthubs before install.

Cloudflare tunnels (summary)​

Tunnels are managed under Cloudflare Zero Trust → Networks → Tunnels. Prefer creating the tunnel with the Ansible playbook: it creates the tunnel, installs credentials, registers the service, enables it on startup, and verifies it is running.

External / customer domains​

Prerequisites:

  • A tunnel up and running.
  • A proxied Cloudflare CNAME pointing at the tunnel (for example staging.roasthubs.com → <TUNNEL_ID>.cfargotunnel.com).

Ingress is configured for the tunnel (dashboard for remotely managed tunnels, or /etc/cloudflared/config.yml where locally managed). Example shape:

tunnel: staging
credentials-file: /home/roasthubs/.cloudflared/<tunnel-id>.json
ingress:
  - hostname: staging.roasthubs.com
    service: http://127.0.0.1:80
  - hostname: rhs.example.com
    service: http://127.0.0.1:80
  - service: http_status:404

Restart the tunnel service after local config changes, for example:

sudo systemctl restart cloudflared-tunnel.service

Custom hostname on a non-Cloudflare customer domain​

The client domain must be authenticated as a Cloudflare Custom Hostname (certificate provided by Cloudflare; validation via TXT). Provide the customer:

  1. A CNAME for their hostname (for example rhs.customer.com) to the Roasthubs-proxied hostname (not raw <TUNNEL_ID>.cfargotunnel.com).
  2. The Hostname pre-validation TXT name and value from the Custom Hostname UI.

After both DNS records exist, Cloudflare issues the certificate and the app becomes reachable on the customer hostname.

Always keep a proxied CNAME under the Roasthubs Cloudflare zone that fronts the tunnel. Pointing customers only at <TUNNEL_ID>.cfargotunnel.com is not supported.

Network design notes​

Desired access patterns:

  • SSH to the IPC
  • Database access on the IPC (preferably not exposed LAN-wide; see edge hardening docs)
  • PLC network access
  • DNS to the application

Typical PLC network: 10.18.0.0/24 with 10.18.0.5 on the Welotec interface (may be down). Prefer separate CIDR routes to avoid collisions, for example:

  • 10.18.0.0/24 → PLC network
  • a dedicated /32 → IPC management interface
  • published application hostname → <subdomain>.roasthubs.com