Port map — dudoxx-web-boot

Every host port lives in the 163XX band (Q3, invariant 3). This page is the one source. Compose files, `.env.example` files and `./ddx-manage.sh` use these values. | Service | Host port | Container port | Owner | Where the port is set | |---|---|---|---|---| | ddx-web (Next.js) | 16300 | — (host process) | `ddx-web/` | `--port 16300` in `ddx-web/package.json` (`dev`, `start`); `PORT` set by `./ddx-manage.sh` | | ddx-api (NestJS) | 16310 | — (host process) | `ddx-api/` | `PORT=16310` in `ddx-api/.env`; ddx-web server-only `DDX_BFF_POOL_STATIC_NODES=api-dev-001=http://127.0.0.1:16310` | | ddx-api second node `api2` (NestJS) | 16311 | — (host process) | `ddx-api/` | `./ddx-manage.sh start api2`; node id `api-dev-002`; listed in `DDX_BFF_POOL_STATIC_NODES` / `DDX_BFF_REGISTRY_SEEDS` (`ddx-web/CLAUDE.md` §Environment) | | PostgreSQL 18 | 16330 | 5432 | `ddx-docker-postgres/` | compose maps `127.0.0.1:16330:5432` (fixed, no env key); `DATABASE_URL_*` use host port 16330 | | Redis 7+ | 16340 | 6379 | `ddx-docker-redis/` | compose maps `127.0.0.1:16340:6379` (fixed); `REDIS_URL=redis://127.0.0.1:16340` ([ADR 0016](/en/docs/adr/0016-sse-bus)) | | MinIO S3 API | 16350 | 9000 | `ddx-docker-minio/` | compose maps `127.0.0.1:16350:9000` (fixed); `DDX_API_MINIO_ENDPOINT=http://127.0.0.1:16350` | | MinIO console | 16351 | 9001 | `ddx-docker-minio/` | compose maps `127.0.0.1:16351:9001` (fixed) | | Qdrant HTTP/REST | 16360 | 6333 | `ddx-docker-qdrant/` | compose maps `127.0.0.1:16360:6333` (fixed); `DDX_API_QDRANT_URLS=http://127.0.0.1:16360` | | Qdrant gRPC | 16361 | 6334 | `ddx-docker-qdrant/` | compose maps `127.0.0.1:16361:6334` (fixed) | | Docs | 16370 | — | reserved | RESERVED, unused (Q8: docs render inside ddx-web) | | Mail SMTP (GreenMail, dev) | 16380 | 3025 | `ddx-docker-mail/` | compose maps `127.0.0.1:16380:3025` (fixed); `DDX_API_SMTP_HOST`/`DDX_API_SMTP_PORT` in `ddx-api/.env` | | Mail IMAP (GreenMail, dev) | 16381 | 3143 | `ddx-docker-mail/` | compose maps `127.0.0.1:16381:3143` (fixed); `DDX_API_IMAP_HOST`/`DDX_API_IMAP_PORT` in `ddx-api/.env` | | Mail REST API (GreenMail) | 16382 | 8080 | `ddx-docker-mail/` | compose maps `127.0.0.1:16382:8080` (fixed) | ## Production ports (target `forge`) Same band, same numbers as local. Data-tier ports bind to `127.0.0.1` on the target only. Runbook: [deploy/README.md](/en/docs/deploy/README); target keys: `context/DEPLOY_TARGETS.md`. | Service | Host port | Notes | |---|---|---| | ddx-web live | 16300 | Apache :80 vhost on the target proxies to it; the home edge terminates TLS on :443 | | ddx-api live | 16310 | node `api-prod-001`; server-only address | | ddx-web canary | 16302 | smoke check before the switch; node `web-prod-901` | | ddx-api canary | 16312 | smoke check before the switch; node `api-prod-901` | | PostgreSQL | 16330 | `127.0.0.1` only | | Redis | 16340 | `127.0.0.1` only | | MinIO API / console | 16350 / 16351 | `127.0.0.1` only | | Qdrant HTTP | 16360 | `127.0.0.1` only | The canary nodes leave the cluster registry after a deploy (`quarantined`, `lost`). ## Rules - The container port column is the only place 5432, 6379, 9000 and 9001 may appear. A compose file maps `16330:5432`, `16340:6379`, `16350:9000`, `16351:9001` — never the default on the host side (failure mode 5, AC1.4). - Redis 16340 was free on dudoxxmac on 2026-10-23 (`lsof -nP -iTCP:16340 -sTCP:LISTEN` → no listener, exit 1; sse-bus task 001). - The ddx-api addresses are server-only (`DDX_BFF_POOL_STATIC_NODES` in static mode, `DDX_BFF_REGISTRY_SEEDS` in registry mode). The browser never gets a ddx-api address: no `NEXT_PUBLIC_API_URL`, no `localhost:16310` in `ddx-web/src` (invariant 1, AC3.2/AC3.3). The browser calls ddx-web `api/v1`, and the BFF calls ddx-api through `BffApiBridge`. The single-URL key was removed on 2026-10-24; static mode without `DDX_BFF_POOL_STATIC_NODES` is a boot error `BFF_POOL_STATIC_NODES_REQUIRED`. - The dudoxx-sandbox-creator default band (3400-3490) is overridden per service (Q9, [ADR 0001](/en/docs/adr/0001-scaffold-route)). No service keeps a creator default. - The sibling HMS stack ports are not reused. The 163XX band was free on dudoxxmac on 2026-10-23 (`lsof` check, Q3 in `ddx-wip/rewrite_ui-shell-rnd-workspace/ANSWERS.md`). - Resolve a live port with `lsof -nP -iTCP:<port> -sTCP:LISTEN` before you start a service. `./ddx-manage.sh` owns start and stop. --- Last reconciled: 2026-10-25 · plan deploy-pipeline task 022