Use this file to discover all available pages before exploring further.
This page describes the network access patterns and endpoint requirements for Jitera Self-Hosted. Use this as a reference when configuring firewalls, network security groups, or network policies.
An egress firewall is recommended for production but optional for evaluation and pilot deployments. Without a firewall, all outbound traffic from the cluster is allowed — the endpoint tables below still serve as a reference for DNS resolution and connectivity requirements, but no active filtering is applied.An egress firewall (AWS Network Firewall ~300/mo,AzureFirewall900/mo) adds FQDN-based outbound filtering, restricting pod traffic to only the endpoints listed below. Consider the cost impact when deciding whether to deploy one.
Domain placeholders used in this page: app.example.com (main domain, configured as ingress.domainName) and chat.example.com (chat domain, configured as ingress.chatDomainName). Replace with your actual domain names.
If you use an L7 firewall with TLS/SNI inspection (e.g., AWS Network Firewall, Azure Firewall, Palo Alto, Zscaler), additional configuration beyond the domain list below may be required. See your cloud provider’s documentation:
Jitera Self-Hosted requires the following network access patterns:
Ingress: HTTPS (443/tcp) for web application access
Egress: HTTPS (443/tcp) for external API calls and container image pulls, SMTP (25/tcp or 587/tcp) for outbound email, DNS (53/tcp, 53/udp) for domain resolution, NTP (123/udp) for time synchronization
Pod-to-Pod: All internal services communicate within the Kubernetes cluster network using service discovery and internal DNS
Inbound rules control traffic from external sources into the cluster.
Purpose
Source
Destination
Required
Description
Jitera App Access
User’s web browser
https://app.example.com
Required
Main application domain
Jitera Chat API Access
User’s web browser
https://chat.example.com
Required
Chat domain
Grafana
User’s web browser
https://grafana.example.com
Conditional
Required only if Grafana ingress is enabled
Prometheus
User’s web browser
https://prometheus.example.com
Conditional
Required only if Prometheus ingress is enabled
MinIO Access
User’s web browser
https://minio.example.com
Conditional
Required only if using MinIO with ingress enabled
MinIO Console
User’s web browser
https://minio-console.example.com
Conditional
Required only if using MinIO Console
Cert-Manager HTTP01 Challenges
ACME (Let’s Encrypt)
http://*.example.com
Conditional
Required only if using cert-manager HTTP01 challenges
Pod Hairpin Traffic (AWS)
NAT Gateway EIP
https://app.example.com, https://chat.example.com
Conditional
Required on AWS when inbound filtering is configured on the Kong LoadBalancer Service’s Security Group. Pods resolve the public app domain via public DNS and egress through the NAT Gateway back to the CLB; without the NAT Gateway EIP(s) in the SG allow-list, intra-cluster calls that traverse the public domain are dropped. On Azure, filter at the AKS subnet NSG — include the VirtualNetwork service tag in the inbound allow rules so intra-VNet hairpin traffic is preserved.
Endpoints required for the Kubernetes control plane and managed add-ons themselves. These are not Jitera-specific — they are prerequisites for the cluster to bootstrap, pull system images, and report managed metrics. Refer to the cloud provider’s documentation as the authoritative source; the list below reflects the default allow-list enforced by the Jitera Terraform scripts.
Conditional endpoints required by specific features.AI / LLM Providers:
Purpose
Destination
Description
Azure OpenAI
https://*.openai.azure.com
Required only if using Azure OpenAI API
OpenAI
https://api.openai.com
Required only if using OpenAI API
Anthropic Claude
https://api.anthropic.com
Required only if using Anthropic API
AWS Bedrock
https://bedrock-runtime.*.amazonaws.com
Required only if using Amazon Bedrock API
Google Generative AI
https://generativelanguage.googleapis.com
Required only if using Google Generative AI API
Google Vertex AI
https://*-aiplatform.googleapis.com
Required only if using Google Vertex AI
LLM token encoding
https://tiktoken.pages.dev
Required only if using chat v1 (Ultron)
Code Source Integrations:
Purpose
Destination
Description
GitHub Integration
https://github.com
Required only if using GitHub integration
GitHub Integration
https://api.github.com
Required only if using GitHub integration
GitHub Integration
https://raw.githubusercontent.com
Required only if using GitHub integration
GitHub Integration
https://codeload.github.com
Required only if using GitHub integration — 302 redirect target from api.github.com/.../zipball/<ref> that serves the actual zip bytes
GitLab Integration
https://<your-gitlab-host>
Required only if using self-managed GitLab integration
GitHub’s api.github.com/repos/<owner>/<repo>/zipball/<ref> returns a 302 redirect to https://codeload.github.com/.... An L7 egress firewall that allow-lists api.github.com but not codeload.github.com will silently drop the redirect fetch, causing repository import to fail with a misleading fetch failed error whose URL still points at api.github.com. Allow-list both hosts when GitHub integration is enabled behind a firewall.
Web Search & URL Reading (Boost):
Purpose
Destination
Description
Tavily Search API
https://api.tavily.com
Required only if using Tavily as the web search backend
SearXNG
https://<your-searxng-host>
Required only if using self-hosted SearXNG as the web search backend
Jina Reader
https://r.jina.ai
Required for boost__read_webpage tool — no fallback exists
Jina Rerank API
https://api.jina.ai
Optional — used by Document Agent / Code Agent for RAG reranking
Cohere Rerank API
https://api.cohere.ai
Optional — alternative reranker for Document Agent / Code Agent
Wikipedia
https://en.wikipedia.org
Supplementary search tool
ArXiv
https://export.arxiv.org
Supplementary search tool (HTTP/HTTPS)
PubMed
https://eutils.ncbi.nlm.nih.gov
Supplementary search tool
HackerNews
https://hacker-news.firebaseio.com
Supplementary search tool
Yahoo Finance
https://query1.finance.yahoo.com
Supplementary search tool
Yahoo Finance
https://query2.finance.yahoo.com
Supplementary search tool
User-provided URLs
* (any URL)
MarkItDown / WebsiteTools / Jina fetch target URLs provided by users
Error Monitoring & Other Integrations:
Purpose
Destination
Description
Rollbar
https://api.rollbar.com
Required only if using Rollbar error tracking
Playwright Tracing
https://jitera-trace-viewer.pages.dev
Required only if Playwright tracing viewer is used in the frontend
Required if using Amazon SES, Azure Communication Services, or SendGrid
NTP
Kubernetes worker node
Various NTP servers (123/udp)
Required
On public cloud IaaS environments such as AWS and Azure, outbound port 25/tcp is usually blocked by default. If you need to use a local SMTP relay, contact your cloud provider in advance to request that this restriction be removed.
