Network Requirements for Terraform Enterprise

The Linux instance that runs Terraform Enterprise must allow several kinds of incoming network access. Terraform Enterprise also needs to access several external services to handle updates and resource downloads.

Ingress

Source — User/Client/VCS

• 443: Terraform Enterprise application access (HTTPS)

Source — Administrators

• 22: SSH access (administration and debugging)
• 8800: Replicated (TFE setup dashboard, HTTPS)

Source - Metrics

• 9090 TCP port on which Terraform Enterprise handles HTTP metrics requests
• 9091 TCP port on which Terraform Enterprise handles HTTPS metrics requests

The metrics endpoints are optional. You can enable them in the application settings when you install Terraform Enterprise.

Source — TFE Server(s)

• 8201: Vault HA request forwarding (only necessary when operating in Active/Active mode)

Additionally, the following ports are used by various application components internally. This list serves as a point of reference; it is not necessary to expose these ports for accessibility in a firewall:

• 2003: Graphite (Carbon) feeding port (monitoring, metrics)
• 2004: Graphite (Carbon) feeding port (monitoring, metrics)
• 3121: Terraform Enterprise private registry
• 4150-4151, 4160-4161, 4170-4171: Replicated NSQD (messaging platform daemon for internal communication)
• 5432: PostgreSQL
• 6379: Redis (application-level caching and coordination)
• 7586: Terraform Enterprise ingress (pulls in version control system data for application, stores it via Archivist)
• 7588: Terraform Enterprise state parser
• 7675: Terraform Enterprise Archivist (stores data in object storage, encrypts it via Vault)
• 8086: InfluxDB default UDP Service (monitoring, metrics)
• 8125: StatsD (monitoring, metrics)
• 8200: Vault (encryption service)
• 9292: Atlas engine (old name of Terraform Enterprise engine)
• 9870-9880 (inclusive): host and subnet traffic only; not publicly accessible
  • 9873: Replicated Retraced engine API (Replicated audit subcomponent)
  • 9874-9879: Replicated entry point span
• 23000-23100 (inclusive): host and subnet traffic only; not publicly accessible
  • 23005: Terraform Enterprise health check point
  • 23020: Nomad (scheduler for Sentinel runs)
• 32774-32776, 49150-49165: Replicated internal Graphite and StatsD ports (mapped to external ports 2003, 2004, and 8125)

Egress

Destination - Online Installations

If Terraform Enterprise is installed in online mode, it accesses the following hostnames to get software updates:

• api.replicated.com
• get.replicated.com
• registry-data.replicated.com
• registry.replicated.com
• *.quay.io
• cdn.quay.io
• quay-registry.s3.amazonaws.com
• *.cloudfront.net
• hub.docker.com
• index.docker.io
• auth.docker.io
• registry-1.docker.io
• download.docker.com
• production.cloudflare.docker.com
• install.terraform.io

The following hostnames are accessed unless a custom Terraform bundle is supplied:

• registry.terraform.io (when using Terraform 0.12 and later)
• releases.hashicorp.com
• https://yy0ffni7mf-dsn.algolia.net/ - this URL is specific to the Terraform Registry’s Algolia application. The Terraform Registry uses Algolia to index the current resources in the registry and power Terraform Cloud public-facing search for public providers and module curation.
• github.com - Public providers and modules are hosted in Github.

Additionally, unless you have opted out of license entitlement reporting, Terraform Enterprise will need egress access to:

• reporting.hashicorp.services

Destination - Additional Outbound Network Targets

Terraform Enterprise also needs egress access to:

• any VCS servers/services that will be utilized
• login/authentication servers if SAML will be configured (ADFS, Okta, etc)
• the various cloud API endpoints that will be managed with Terraform
• any other third party services that will either be integrated with the Terraform Enterprise server or managed with it.

Destination - Cost Estimation APIs

When Cost Estimation is enabled, it uses the respective cloud provider's APIs to get up-to-date pricing info.

• api.pricing.us-east-1.amazonaws.com
• cloudbilling.googleapis.com
• prices.azure.com

Other Configuration

1. If a firewall is configured on the instance, run one of the following to allow traffic to flow out of the docker0 interface to the instance's primary address. We recommend doing this before you install Docker.

   • To use UFW, run: ufw allow in on docker0
   • To use firewalld, run: firewall-cmd --permanent --zone=trusted --change-interface=docker0

2. Get a domain name for the instance. Using an IP address to access the product is not supported as many systems use TLS and need to verify that the certificate is correct, which can only be done with a hostname at present.

3. For GCP only: Configure Docker to use an MTU (maximum transmission unit) of 1460, as required by Google (GCP Cloud VPN Documentation: MTU Considerations).

   To configure Docker's MTU, create an /etc/docker/daemon.json file with the following content:

   {
     "mtu": 1460
   }
   

   Note: The above only affects the default network bridge aka docker0. To apply this to the networks tfe_services and tfe_terraform_isolation, it is required to delete these two networks and recreate them with the correct MTU for an existing install or to create these two networks prior to installing Terraform Enterprise for a new install.

4. Ensure the Docker bridge network address is not in use elsewhere on the network. If it is, please refer to the Docker documentation for information on how to change it.