Ports
Every port a control plane instance listens on, and which ones to expose.
| Port | Serves | Who connects | Expose |
|---|---|---|---|
6420 | API, Rivet Actor traffic and node connections | Clients, nodes, your backend | Yes, through a load balancer with TLS |
6421 | Internal traffic between instances | Other control plane instances only | Never. Private network only. |
6430 | Prometheus metrics at /metrics | Your monitoring | Private network only |
Change a port with guard.port, api_peer.port or metrics.port. See Configuration.
6420: public traffic
Clients, nodes and your backend all use this port. Put a load balancer in front of every instance and terminate TLS there. Probe /health on this port.
Raise the idle timeout
Nodes and clients hold long-lived WebSocket connections on this port. Most load balancers and ingress controllers close idle connections after 30 to 60 seconds, which causes reconnect storms. Raise the idle, read and send timeouts to one hour (3600 seconds) on every proxy in the path:
- NGINX Ingress: annotations
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"andnginx.ingress.kubernetes.io/proxy-send-timeout: "3600". - AWS Load Balancer Controller:
alb.ingress.kubernetes.io/load-balancer-attributes: idle_timeout.timeout_seconds=3600. - GKE Ingress:
timeoutSec: 3600on theBackendConfigof the Service.
6421: between instances
Instances send each other internal storage and coordination traffic on this port. It is plaintext and unauthenticated, so anyone who can reach it can read and change Rivet Actor data. Allow it only between control plane instances, with a firewall rule, a security group or a Kubernetes NetworkPolicy. See the example in Kubernetes.
Each instance binds this port to the host of its api_peer.advertise_address, or to 127.0.0.1 when none is set. Set advertise_address to the instance’s private IP and port, such as 10.0.0.11:6421. When it is a DNS name, also set api_peer.host to the private IP to bind.
6430: metrics
Scrape http://<instance>:6430/metrics from each instance with Prometheus. Keep it on your private network.