Shellius needs very little opened. The only listener that must be reachable by people is HTTPS on the Shellius host. Everything else is either internal to the Compose stack or an outbound connection.
What to allow
| From | To | Port | Why | When |
|---|---|---|---|---|
| People | Shellius | 443/tcp | Portal, API, browser terminals (WebSocket) | Always |
| Managed hosts | Shellius | 443/tcp | check-principals on every SSH login, and the heartbeat | Always, for bootstrapped hosts |
| Shellius | Managed hosts | 22/tcp | Browser terminals, Quick Connect | If you use browser SSH |
Shellius (guacd) | Windows hosts | 3389/tcp | Browser RDP | If you use RDP |
| People | Managed hosts | 22/tcp | The shellius terminal client and downloaded keys connect directly | If you use the terminal client |
| Shellius | Your identity provider | 443/tcp | OIDC discovery and token exchange | If you use SSO |
| Shellius | Your mail server | 587/tcp or as configured | Notifications, invites, emailed codes | If you use email |
| Shellius | AWS / Azure / GCP APIs | 443/tcp | Cloud connector sync | If you use cloud connectors |
If a host uses a non-standard SSH port, substitute it for 22.
What stays closed
PostgreSQL (5432), Redis (6379) and guacd (4822) are for the stack's internal network only. Do not publish them on the host. Shellius never opens a listening port on a managed host: bootstrapping reconfigures the existing sshd and adds an outbound timer.
A host that cannot reach Shellius cannot validate logins
check-principals calls the API on every connection. If the host's outbound HTTPS to Shellius is blocked, certificate logins to that host fail. Keep a break-glass path to your hosts that does not depend on Shellius — see the hardening checklist.
TLS
Terminate TLS at your reverse proxy. The shipped docker-compose.prod.yml carries Traefik labels and expects TRAEFIK_HOST; any proxy works as long as it passes WebSocket upgrades through to the portal.