Ports
Published on ${SOCIETY_BIND_IP:-0.0.0.0}. Development Makefile usually binds localhost. On VPS: 0.0.0.0 closed by firewall.
The on-prem bundle publishes to the host only 8093 / 8094 / 8091. Development compose publishes more, for debugging.
| Port | Service | Job |
|---|---|---|
| 8093 | society-graph-ui | Console |
| 8094 | society-chat | Conversation Gateway /v1 |
| 8091 | society-telemetry | Console backend + graph |
| 8090 | society-governance | inbox (UI goes through telemetry) |
| 8092 | society-evaluator | LLM-as-judge / fitness |
| 8095 | society-copilot | Console runtime de copiloto |
| 8088 | society-fleet-manager | spawn / Task Queue proxy |
| 8099 | society-executor | not published; compose network only |
| 4000 | society-LLM Router | LLM router |
| 5432 | society-pg | society + LLM Router DB |
| 6333 | society-vectordb | vectors |
| 9000 / 9001 | society-object-store | S3 + console |
| 8642 / 7474 | society-agents-host | Profile API / agent dashboard (if START_runtime del agente_DASHBOARD=1) |
| 8654 / 7486 | society-agents-host-operaciones | second host |
| 6080 / 5900 | society-agents-runtime-template | noVNC / VNC |
| 3000 | conversation-ui container | outside SIS compose |
| 3080 | sis-conversation-ui | Conversation UI (alt stack) Conversation UI (outside SIS compose; stack infra/conversation-ui/) |
| 3081 | sis-conversation-ui-admin | Conversation UI (alt stack) user admin panel (same stack; on clients no public vhost → private mesh/SSH) |
| 8010 | ontology-catalog-rele | loopback → explorer (clients; sis-interna ignores ports:) |
| 8000 | ontology catalog Explorer | local Development (127.0.0.1); not on VPS — there it is onto.<client>.do |
| 6379 | graph store | ontology catalog explorer graph store (local Dev; with the ontology catalog stack) |
Conversation UI (alt stack) is not in the R6 bundle: separate Compose project sis-conversation-ui, default bind conversation-ui_BIND=127.0.0.1. On VPS, edge proxy publishes the UI at chat.<client>.do → :3080 and admin at chat-admin.<client>.do → :3081 (snippet infra/conversation-ui/edge-proxy-vhosts.snippet). Stack Meilisearch does not publish a host port.
ontology catalog is also outside the R6 compose: in Dev usually local compose on :8000 + graph store :6379; on clients, edge proxy onto.<client>.do (identity provider (OIDC)) and relay :8010. See Ontology and Deploy ontology.
A new SIS port without sis-firewall.sh is open. Copilots are named copilot-* / sis-*: the firewall must cover ^(society|copilot|sis-).