---
created: '2026-04-16T00:45:31+00:00'
id: 7cf418e8-d700-43dc-a870-78c333a08e58
keywords:
- traefik
- port-forward
- phasefinal.com
- VIP
- virtual-host
- synapse
- element
- gitea
- seafile
- vaultwarden
- mattermost
- mailrise
links: []
modified: '2026-04-16T00:45:31+00:00'
summary: Complete public-to-internal port map for all ana-colo services, including
  Traefik virtual host routes and direct port forwards.
tags:
- infrastructure
- ana-colo
- network
- ports
- traefik
- docker
title: Ana Colo — Public Port Map
---

# Ana Colo — Public Port Map

> **Last surveyed:** 2026-04-15

## Via 38.120.12.44 → ana-docker (10.250.50.70)

| Public Port | Internal Port | Service | Notes |
|---|---|---|---|
| :80 | :80 | Traefik HTTP | Routes all HTTP vhosts |
| :443 | :443 | Traefik HTTPS | Routes all HTTPS vhosts with TLS |
| :8025 | :8025 | Mailrise | Apprise notification relay |
| :8443 | :8443 | Mattermost calls | UDP/WebRTC |
| (service) | (multi) | RustDesk | hbbs + hbbr on host network |

## Via 38.120.12.44 → ana-nas (10.250.50.50)

| Public Port | Internal Port | Service | Notes |
|---|---|---|---|
| :8444 | :8444 | WebDAV (NAS) | Raw TCP — see security issue #5 |

## Via 38.120.12.45 → ana-webhost (10.250.50.52)

| Public Port | Internal Port | Service | Notes |
|---|---|---|---|
| :80 | :80 | Webhost HTTP | |
| :443 | :443 | Webhost HTTPS | |
| (mapped) | :22 | Webhost SSH | Via ssh-mapped-2223 service |

## Via 38.120.12.46 → ana-tacticalrmm (10.250.50.57)

| Public Port | Internal Port | Service |
|---|---|---|
| :443 | :443 | TacticalRMM HTTPS |

## Via 38.120.12.42 → various

| Public Port | Target | Service |
|---|---|---|
| :8880 | 10.250.50.51:8880 | Kokoro TTS |
| :31337 | 10.250.50.252:31337 | WireGuard |

## Traefik Virtual Host Routes

All routes via `*.phasefinal.com` → 38.120.12.44 (Traefik on ana-docker).

| Hostname | Service | Internal Port | Notes |
|---|---|---|---|
| `matrix.phasefinal.com` | Synapse | :8008 | HTTP + WebSocket |
| `chat.phasefinal.com` | Element Web | :80 | HTTP |
| `gitea.phasefinal.com` | Gitea | :3000 | HTTP |
| `seafile.phasefinal.com` | Seafile | :80 | HTTP |
| `vaultwarden.phasefinal.com` | Vaultwarden | :80 | HTTP + WebSocket |
| `mm.phasefinal.com` | Mattermost | :8065 | HTTP + WebSocket |
| `*.phasefinal.com` | Traefik (catch-all) | — | Default route |

## Direct-Port Services (not Traefik-routed)

These services are exposed on direct ports rather than through the Traefik reverse proxy:

| Service | Port | Host | Notes |
|---|---|---|---|
| SillyTavern | :8100 | ana-docker | Direct |
| Open WebUI | :3100 | ana-docker | Direct |
| Dockge | :5001 | ana-docker | Direct |
| Portainer | :9000, :9001 | ana-docker | Direct — legacy, consider removal |
| IT Tools | :8780 | ana-docker | Direct |
| Mailrise | :8025 | ana-docker | Direct |
| Traefik Dashboard | :8380 | ana-docker | Direct — unprotected, see security issue #12 |
| RustDesk | Multi (host net) | ana-docker | Host network mode |

See [Security Issues](ana-colo-security-issues.md) for related findings.