av — host TCP/UDP port allocation¶
How the homelab publishes ports on the host. Most services are not here — they're
reached only through Traefik (*.fmm.house over 443) via Docker labels and publish no
host port at all. This doc covers the services that do bind a host port, and the
convention for the arbitrary ones.
Consolidated in the 2026-07-14 session. Companion to docs/av-usb-port-map.md (USB).
Convention: arbitrary app ports live in 2001–2100¶
A handful of services are routed by Traefik file provider entries
(stacks/traefik/dynamic/*.yaml) that point at http://192.168.86.49:<port> — i.e. Traefik
reaches them via the host IP + a published port rather than a container label. Those ports are
arbitrary, so they're parked in a tidy 2001–2100 block. Moving one = edit both the
stack's ports: and its dynamic/<svc>.yaml URL, then recreate.
| Host port | Service | Container port | Traefik route |
|---|---|---|---|
| 2001 | trmnl byos-next |
3000 | dynamic/trmnl.yaml → 172.30.0.1:2001 |
| 2002 | immich (immich_server) |
2283 | dynamic/immich.yaml |
| 2003 | AdGuard web UI | 8083 | dynamic/adguard.yaml |
| 2004 | peertube | 9000 | dynamic/peertube.yaml |
| 2005 | ocis | 9200 | dynamic/ocis.yaml |
| 2006 | livekit SFU (Element Call) | 2006 | dynamic/livekit.yaml → 172.30.0.1:2006 (HTTP/WS signaling; internal — Traefik only) |
Skip 2049 (NFS) if extending the block. 2000 is free. Not every 20xx port is a Traefik
Fixed / protocol ports — do not renumber¶
These are client-facing or protocol-standard; moving them breaks the clients that expect them.
| Port(s) | Service | Why it's pinned |
|---|---|---|
| 80, 443 | traefik | HTTP/HTTPS — everything web |
| 53 tcp+udp | adguard | LAN DNS (every device queries :53) |
| 1883 | mosquitto | MQTT — HA, Zigbee2MQTT, Diun, controller-watch |
| 8554 / 8555 / 1984 / 8971 / 5000 | frigate + go2rtc | RTSP / WebRTC / camera-relay protocols |
| 40000–40100 udp | moonlight-web | game-streaming session ports (101-port range) |
| 10200 / 10300 | wyoming-piper / -whisper | HA voice integration points at these |
| 5432 | ha-postgres | Postgres (bound to 127.0.0.1 only) |
| 2222 | forgejo | git-over-SSH (→ Forgejo's built-in SSH server, container :2222); clone URLs bake this in |
| 25 | postmoogle | SMTP — email→Matrix bridge; senders use fmm.house:25. Reachable on LAN + tailnet with no ufw rule (Docker publish bypasses ufw); no internet forward |
| 2007 tcp + 50100–50200 udp | livekit (Element Call) | WebRTC media, client-facing (advertised on av's Tailscale IP). Host-networked → DOES need ufw (allow in on tailscale0 for both) — host networking is not Docker-published, so it doesn't bypass ufw. :2007 is the TCP media fallback (redundant on-tailnet — Tailscale's DERP covers it — but kept for off-tailnet/belt-and-suspenders); the UDP media range can't fit the 2001–2100 block → the documented exception |
Also off-limits (not homelab): Sunshine/Moonlight gaming 47984–48010 and 1716 —
see CONTEXT.md / docs/gaming/. And the external dev projects in ~/apps and ~/gen-test
grab low ports (3000–3003) — not part of this repo.
Label-fronted services (no host port)¶
homarr, beszel, uptime-kuma, arcane, zigbee2mqtt
(frontend), matrix (continuwuity/element), music-assistant, audiobookshelf (ab, container :80),
calibre-web-automated (eb, container :8083), etc. are reached only through
Traefik via
traefik.* container labels on the proxy network. They deliberately publish no host
port. During the 2026-07-14 cleanup the vestigial direct-access ports on arcane (3552) and
zigbee2mqtt (8080) were removed for this reason — Traefik never needed them.