ports.md

Port map (authoritative)

N = SITE_INDEX from that site's sites.d/<site>.env. Derivations live in hub/scripts/fleet-lib.sh (shell) and hub/status/adsb-status.py (python) — change them together or not at all.

Nodes (every feeder Pi)

Port	What	Reachable from
30005	readsb BEAST out (1090)	tailnet (hub) + localhost only (nftables)
30978	dump978-fa raw out	tailnet (hub) + localhost only
8080	tar1090 web UI	tailnet + localhost only
22	ssh (bench + tailscale ssh)	open; tailnet is the intended path

Hub, per site

Port	What	Binds
32000 + N*10	ingest readsb BEAST in (--net-bi-port)	see note
32001 + N*10	ingest readsb beast-reduce out — consumed by ssh-forward@ and the site's feed containers	see note
29010 + N	tunnel local sink (-L) → friend's server	127.0.0.1

Ingest ports bind 127.0.0.1 normally, but 0.0.0.0 for sites with feed containers enabled (feeds/<site>/feeds.env exists) so the docker bridge can reach them via host.docker.internal.

Grandfathered exception: site home (N=0) predates the scheme and keeps SITE_LOCAL_SINK_PORT=29004 / SITE_REMOTE_SINK_PORT=30004 via explicit overrides in its env file. Home also has no ingest instance — its "ingest port" is the hub readsb's own 30005.

Friend's server, per site

Port	What
30010 + N	per-site BEAST listener (30004 for home, grandfathered)
8008	reverse-forwarded hub web UI (-R)
8009	reverse-forwarded status page (-R, only when STATUS_FORWARD=true)

New sites must be coordinated with him: one new listener per site, port 30010+N, bound to his VPN_IP.

Open question (record the answer here): which ingest format does his server expect per site — plain BEAST (current home behavior, batcher path) or beast_reduce_plus with in-band UUID (SITE_DIRECT_CONNECT=true path)? Until answered, new sites default to the batcher path.

Hub, global

Port	What	Binds
30005	hub's own readsb BEAST out (home site)	as configured by readsb
80	hub tar1090 (lighttpd)	LAN/localhost; reverse-forwarded to 8008
8090	status webpage	127.0.0.1 (ADSB_STATUS_BIND to widen to tailnet)