Skip to main content

Restricted networks and regions

The agent makes outbound connections only: one HTTPS request for the one-time bootstrap, then the persistent WebSocket, plus downloads from the release channel for self-update and APM artifacts. No inbound ports are ever needed. In a locked-down network the only thing to arrange is outbound reachability to the Wakora endpoint.

What to allow​

Allow outbound TCP 443 to get.wakora.io (installer and binaries) and outbound TCP 8443 to the regional endpoint baked into the binary (for the EU region, eu.gw.wakora.io). Everything the agent sends and receives, including updates and staged APM artifacts, rides these.

TLS interception does not work, by design​

The data plane is certificate-pinned: the agent validates the server's public key against a pin baked into the binary and ignores the CA chain. A TLS-inspecting proxy or an internal PKI that re-signs traffic presents a different key, so the agent refuses the connection. This is deliberate. It means nobody, including a compromised corporate middlebox, can sit between the agent and the server. Give the agent direct egress to the endpoint instead of routing it through an inspecting proxy.

Outbound proxy​

Planned

Explicit proxy support (HTTPS_PROXY for the WebSocket and the release channel) is planned. Today the agent connects directly, so a host that can only reach the internet through a proxy is not yet supported.

Data region​

The backend is a managed SaaS. There is no on-premise or self-hosted backend. The server endpoint is baked into the binary at build time, so the region choice is a build choice: you install the regional build and there is no server address in any host file.

The EU region (eu.gw.wakora.io) is live. Further regions (US, Asia) are planned and will be separate regional builds with their own endpoints and keys.

Host labels and groups​

The hostname travels as the display label at registration. Grouping and labeling hosts is done in the console, not on the host.

What is never in a host file​

The endpoint, the certificate pin, and the publisher key are all baked into the binary at build time. None of them live in an on-host file, so there is nothing to tamper with or leak.