Network requirements
What the InfraNest agent connects to, so you can allow it through a firewall. In short: one outbound HTTPS connection, to ingest.infranest.io, and nothing inbound, ever. The agent opens no port and takes no instructions. Installing and upgrading it also downloads from get.infranest.io.
What it connects to
| Host | Port | When | What for |
|---|---|---|---|
ingest.infranest.io | TCP 443 (HTTPS) | Every interval, 60 seconds by default | Sends readings to POST /api/metrics/push |
get.infranest.io | TCP 443 (HTTPS) | Only while you install or upgrade | The installer and the agent itself |
github.com and the download host it redirects to | TCP 443 (HTTPS) | Only while you install or upgrade, and only if get.infranest.io cannot be reached | The installer's fallback: the same release files |
| Your DNS resolver | 53 | When it looks up the names above | Name resolution, as for any program |
That is the whole list. The agent sends nothing to analytics, error reporting or a CDN, and contacts no other host. Its only other connection is local: on Linux it reads services and containers from the systemd D-Bus socket on the same machine.
- Encrypted, always. The agent refuses an
INFRANEST_URLthat is nothttps://, and refuses one with a username or password in it. - IPv4 and IPv6.
ingest.infranest.iohas both an IPv4 and an IPv6 address, and the agent uses whichever your network gives it, so an IPv6-only server works.get.infranest.ioserves over both too. GitHub has no IPv6 address, which is why the installer triesget.infranest.iofirst. - Allow it by name, not by address. The addresses behind
ingest.infranest.iocan change without notice. If your firewall only takes addresses, use a proxy that allows by name (below). - It follows no HTTP redirect. A push response can move the agent to another ingest host, but only over HTTPS and only to a host under
infranest.io. Anyone who manages to answer one push cannot point your servers somewhere else. A move to a different domain needs the installer run again, and would be announced first. - Your own address. Self-hosted installations set
INFRANEST_URLto their own host; the same rules apply.
Nothing inbound
InfraNest never connects to your server. There is no listening port, no remote shell and no command channel: the agent only sends. You do not need to open anything in a firewall or a cloud security group.
Behind a proxy
The agent uses the standard HTTPS_PROXY and NO_PROXY environment variables. With the systemd service, add them to /etc/infranest/agent.conf, which the service loads as its environment, and restart it:
echo 'HTTPS_PROXY=http://proxy.example.com:3128' | sudo tee -a /etc/infranest/agent.conf
sudo systemctl restart infranest-agentA proxy that inspects TLS needs its certificate authority in the machine's trust store, which the agent reads. On Windows, and with the OpenRC and runit services, the agent does not load agent.conf as its environment. Set the variable for the agent's process another way, or use a proxy that needs no setting.
When it cannot reach InfraNest
Nothing is lost while the connection is down, for up to about eight hours:
- Readings are still taken on time, and kept on disk in
/var/lib/infranest-agentuntil InfraNest confirms it stored them. A request that merely completed, such as an error page from a proxy, does not count. - The agent tries again after 30 seconds, then waits twice as long each time, up to 15 minutes.
- When the connection is back, it sends what it kept, oldest first, in batches of up to 60 readings.
- It keeps at most 500 readings, about eight hours at the default interval, and drops the oldest after that so it never fills your disk.
- InfraNest accepts readings up to 24 hours old. A reading more than 300 seconds ahead of InfraNest's clock is refused, so keep the server's clock in sync.
If InfraNest refuses the token, because it was deleted or the server was removed, the agent tries again every 15 minutes rather than every few seconds. sudo infranest-agent status says what is happening without reaching the network.
A firewall rule to copy
Outbound only. With a proxy or firewall that allows by host name:
# InfraNest agent: outbound HTTPS only, nothing inbound
allow tcp/443 to ingest.infranest.io # readings, all the time
allow tcp/443 to get.infranest.io # install and upgrade onlyAdd github.com only if get.infranest.io is blocked where you install. To check the connection from the server, send a push without a token:
curl -sS -o /dev/null -w '%{http_code}\n' -X POST https://ingest.infranest.io/api/metrics/push401 means the connection works and only the token is missing. A timeout or a TLS error means something blocks it.
Related
- What it sends: every field, how often, and how long it is kept.
- Install the agent on many servers.
- The agent's source and README: https://github.com/InfraNest-Infrastructure-Organized/infranest-agent.