Networking

​

Network topology

​

Traffic flow

1. HTTP/S traffic — Internet → Cloudflare → atl.network (Nginx Proxy Manager) → Tailscale tunnel → atl.chat (containers)
2. TCP traffic (IRC/XMPP) — Internet → atl.network (NPM stream pass-through) → Tailscale tunnel → atl.chat (TCP ports)

​

Docker network model

• Services discover each other by container name (e.g., the bridge connects to atl-irc-server).
• Only services that need external access bind host ports.
• There is no network segmentation between containers — all services can reach each other on the bridge network.
• Atheme uses network_mode: service:atl-irc-server, sharing UnrealIRCd’s network namespace. It connects via 127.0.0.1:6901 (localhost within the shared stack) and its HTTP API (port 8081) is exposed through UnrealIRCd’s port bindings.

​

Port registry

​

External ports (host-mapped)

Note: Dozzle is only available under the dev profile (docker compose --profile dev up). It is not started in production.

​

Internal ports (container-to-container only)

​

Bind address behaviour

​

Tailscale overlay

​

Setup

1. Install Tailscale on both the gateway (atl.network) and the services node (atl.chat):
   # Ubuntu/Debian
   curl -fsSL https://tailscale.com/install.sh | sh
   sudo tailscale up --advertise-tags=tag:server
   
2. Assign stable IPs in the Tailscale admin console:
   • atl.network → 100.64.1.0
   • atl.chat → 100.64.7.0
3. Set the IPs in .env:
   ATL_GATEWAY_IP=100.64.1.0
   ATL_CHAT_IP=100.64.7.0
   
4. Run just init to regenerate configs, then just prod to start services bound to the Tailscale IPs.

​

Service discovery

​

ACLs

{
  "acls": [
    {
      "action": "accept",
      "src": ["tag:gateway"],
      "dst": ["tag:server:6697,8000,5222,5223,5269,5270,5280,5281,9000,8080"]
    }
  ],
  "tagOwners": {
    "tag:gateway": ["autogroup:admin"],
    "tag:server": ["autogroup:admin"]
  }
}

​

DNS zone layout

​

A/AAAA records

​

SRV records for XMPP

; Client-to-server (C2S) — STARTTLS on port 5222
_xmpp-client._tcp.atl.chat.  3600  IN  SRV  5 0 5222  xmpp.atl.chat.

; Client-to-server (C2S) — Direct TLS on port 5223
_xmpps-client._tcp.atl.chat. 3600  IN  SRV  5 0 5223  xmpp.atl.chat.

; Server-to-server (S2S) — STARTTLS on port 5269
_xmpp-server._tcp.atl.chat.  3600  IN  SRV  5 0 5269  xmpp.atl.chat.

; Server-to-server (S2S) — Direct TLS on port 5270
_xmpps-server._tcp.atl.chat. 3600  IN  SRV  5 0 5270  xmpp.atl.chat.

Note: The _xmpps-* records (with the s) advertise Direct TLS ports (5223/5270), which skip the STARTTLS negotiation step. Both STARTTLS and Direct TLS records should be published for maximum client compatibility.

​

SRV records for IRC

; IRC client (TLS on port 6697)
_ircs._tcp.atl.chat.  3600  IN  SRV  5 0 6697  irc.atl.chat.

​

MUC and component subdomains

​

Firewall rules

​

Gateway node (atl.network)

# Web
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# IRC
sudo ufw allow 6697/tcp

# XMPP
sudo ufw allow 5222/tcp
sudo ufw allow 5223/tcp
sudo ufw allow 5269/tcp
sudo ufw allow 5270/tcp

# TURN/STUN
sudo ufw allow 3478/udp
sudo ufw allow 5349/tcp

​

Services node (atl.chat)

# Allow Tailscale interface
sudo ufw allow in on tailscale0

# Allow SSH (for management)
sudo ufw allow 22/tcp

# Deny everything else from public interfaces
sudo ufw default deny incoming
sudo ufw enable

Warning: Docker bypasses ufw rules by inserting its own iptables chains. If you bind a container port to 0.0.0.0, it will be accessible from the public internet regardless of ufw settings. Always use ATL_CHAT_IP to restrict bind addresses in production.

​

Related pages

• Architecture Overview — system diagram, compose structure, design decisions
• Data Model — persistent data locations, volume mounts
• Ports Reference — quick-reference port table
• SSL/TLS — certificate management and renewal
• Security — network isolation, secret management
• Deployment — production deployment runbook