Skip to content
Nexus Docs
↑↓Navigate↵SelectescClose

Ports

Port reference for Nexus services

Last updated on:

This page lists the ports used by the local nexus development stack. Production deployments may bind different ports through ingress, service discovery, or platform configuration.

Nexus Services

Section titled “Nexus Services”

Most service ports fall in the sequential block 14449–14462. The two administrator components sit just below it: admin-control-plane on 14431 and admin-console on 14432.

Component Port Protocol Bind / host mapping Visibility Source / notes
admin-control-plane 14431 HTTP BIND_ADDR, default 0.0.0.0:14431; host 14431:14431 in Compose Host-published Deployment-administrator REST API (/api/platform/readiness, /api/users, /api/workspaces), health, readiness, and metrics.
admin-console 14432 HTTP PORT=14432; host 14432:14432 in Compose Host-published Next.js platform-administrator console and its administrator session API routes.
console 14449 HTTP PORT=14449; host 14449:14449 in Compose Host-published Next.js console and API proxy routes.
gateway 14450 HTTP 0.0.0.0:14450; host 14450:14450 in Compose Host-published OpenAI-compatible API, health, readiness, and metrics.
control-plane 14451 HTTP 0.0.0.0:14451; host 14451:14451 in Compose Host-published REST management API, health, readiness, and metrics.
control-plane 14452 gRPC CONTROL_PLANE_GRPC_ADDR, default 0.0.0.0:14452 Compose network Org, project, API-key, and provider-key services.
auth 14453 HTTP 0.0.0.0:14453; host 14453:14453 in Compose Host-published User/session REST API, health, readiness, and metrics.
auth 14454 gRPC AUTH_GRPC_ADDR, default 0.0.0.0:14454 Compose network Auth service used by service-to-service checks.
policy 14455 HTTP 0.0.0.0:14455 Compose network Policy service health, readiness, and metrics.
policy 14456 gRPC POLICY_GRPC_ADDR, default 0.0.0.0:14456 Compose network Policy evaluation RPC.
ingest 14457 HTTP 0.0.0.0:14457; host 14457:14457 in Compose Host-published Ingest health, readiness, and metrics.
trace-ingest 14458 HTTP 0.0.0.0:14458; host 14458:14458 in Compose Host-published OTLP/HTTP trace ingest, health, readiness, and metrics.
audit 14459 HTTP 0.0.0.0:14459; host 14459:14459 in Compose Host-published Audit health, readiness, metrics, and the bearer-authenticated /api/audit/* read facade (with the opt-in docker-compose.traefik.yml overlay, Traefik routes PathPrefix(/api/audit) on the nexus hostname here).
audit 14460 gRPC AUDIT_GRPC_ADDR, default 0.0.0.0:14460 Compose network Audit read and proof service.
query 14461 HTTP 0.0.0.0:14461; host 14461:14461 in Compose Host-published Request/session query API, body proxy, health, readiness, and metrics.
query 14462 gRPC QUERY_GRPC_ADDR, default 0.0.0.0:14462; host 14462:14462 in Compose Host-published Query service RPC.

Third-Party Dev Stack

Section titled “Third-Party Dev Stack”
Component Port Protocol Bind / host mapping Visibility Source / notes
Postgres 5432 PostgreSQL Container default Compose network by stock Compose postgres service. Host access requires an override or separate local database.
ClickHouse 8123 HTTP Container default Compose network by stock Compose clickhouse service HTTP API and /ping.
ClickHouse 9000 Native TCP Container default Compose network by stock Compose Native ClickHouse protocol; can conflict with MinIO S3 if both are host-published.
NATS 4222 NATS Container config Compose network by stock Compose JetStream, audit fan-out, registry sync, and live request streams.
NATS 8222 HTTP http: 8222 in nats.conf Compose network NATS monitoring endpoint (/healthz), used by just status.
Valkey 6379 Redis-compatible Container default Compose network by stock Compose Redis-compatible cache reachable internally as redis://redis:6379. just redis-it layers docker-compose.redis-it.yml to publish it on 127.0.0.1:6379 for host-side cache tests. Stock Compose leaves it network-only because it is unauthenticated. Services read NEXUS_REDIS_URL for caching and rate limits; stock Compose does not set it, so those features remain inactive until configured.
MinIO 9000 S3 HTTP Host 9000:9000 in Compose Host-published S3-compatible API for body and audit archive buckets.
MinIO Console 9001 HTTP Host 9001:9001 in Compose Host-published MinIO browser console.
OTel Collector 4317 OTLP/gRPC 0.0.0.0:4317 inside collector Compose network Receives traces, metrics, and logs from services.
OTel Collector 4318 OTLP/HTTP 0.0.0.0:4318 inside collector Compose network HTTP OTLP receiver.
OTel Collector 8888 Prometheus metrics 0.0.0.0:8888; host 18888:8888 in Compose Host-published as 18888 Collector self-metrics.
Prometheus 9090 HTTP Container default Compose network Scrapes every Rust service /metrics endpoint and collector self-metrics.
Tempo 3200 HTTP http_listen_port: 3200 Compose network Tempo HTTP API.
Tempo 4317 OTLP/gRPC 0.0.0.0:4317 inside Tempo Compose network Collector exports traces to tempo:4317.
Tempo 4318 OTLP/HTTP 0.0.0.0:4318 inside Tempo Compose network Tempo OTLP HTTP receiver.
Loki 3100 HTTP / OTLP HTTP http_listen_port: 3100 Compose network Collector exports logs to http://loki:3100/otlp.
Grafana 3000 HTTP Host 14470:3000 in Compose Host-published as 14470 Browser UI for the dev observability stack.

Notes

Section titled “Notes”
  • Host-published ports are reachable from the developer machine with the stock Compose file.
  • Compose-network-only ports are reachable by other containers on the vortex network.
  • Several .env.example values describe host-local access for workflows that publish extra infrastructure ports; those values are not all published by the stock Compose file.
  • MinIO is published on host 9000; if you also publish ClickHouse’s native port 9000, the two conflict — remap one of them.