Ports and network
Listening
| What | Where | Notes |
|---|---|---|
| The Workspace and its API | ALMA_LISTEN, default 127.0.0.1:8787 (Mac app: 127.0.0.1:8790) | Publish with tailscale serve, never directly |
| The generated DHL API | A random loopback port | Reached only through /v1/* on the main address |
| Webhooks | MANDALA_WEBHOOK_LISTEN, default 127.0.0.1:8788 | Serves only /hooks/github, /hooks/meta, /hooks/meta-media; exposed through a Cloudflare tunnel (Cloudflare and webhooks) |
| The device mesh (iroh) | UDP, a port chosen at start | QUIC, mutual authentication by device key; also used to join a node by code |
Between your nodes
Paired nodes sync every 20 seconds, both ways, in one of two ways:
- HTTP to the peer's address (on your tailnet), with each pull signed by the device key.
- The device mesh (endpoint
iroh): nodes dial each other by device key, with direct QUIC connections and hole punching. A node's addresses are found through signed records it publishes on the Mainline DHT, and on the local network by mDNS (only once the node trusts another device, so a fresh install sends nothing on your LAN). Connections from devices that are not trusted are refused at once.
Nothing goes through a third party's servers. Where hole punching fails, a relay of your own (iroh-relay on your VPS, named in MANDALA_IROH_RELAY) forwards encrypted traffic. Without it, relays are off.
MANDALA_MDNS=1 or 0 forces local discovery on or off.
Outbound connections
Depending on what you connect: your model providers; Cloudflare (cloudflared); Google APIs; Telegram; WhatsApp; Inworld (voice); Brave (search); WaveSpeed (pictures); TypeSafe (Jev); PostHog, Ahrefs, Meta, GitHub and your MCP servers; browser push services and Apple Push. A firewall that blocks outbound traffic needs these allowed.
Between businesses
Signed exchange documents arrive at POST /api/exchange/receive on the recipient's address. Today counterparts exchange addresses by hand, typically over a shared tailnet. Coming soon — reaching businesses through the public network and discovery records.