Skip to content
CatalystCatalyst Docs

Networking

Panel access (HTTPS)

Section titled “Panel access (HTTPS)”

Serve the panel behind Caddy (automatic certificates) or Traefik. Both ship as overlay compose files in catalyst-docker/; you layer one on top of the base stack with -f.

For Caddy, the fastest path:

  1. Set a DNS A record pointing your domain at the panel host.

  2. In catalyst-docker/.env, set DOMAIN=panel.example.com (required) and ACME_EMAIL=admin@example.com (optional, for certificate notifications).

  3. Start the stack with both files:

    Terminal window
    cd catalyst-docker
    docker compose -f docker-compose.yml -f docker-compose.caddy.yml up -d

Caddy obtains and renews the Let’s Encrypt certificate, redirects HTTP → HTTPS, and proxies to the frontend. Ports 80 and 443 must be reachable from the internet for the ACME challenge — the overlay publishes them as HTTP_PORT=0.0.0.0:80 and HTTPS_PORT=0.0.0.0:443.

For Traefik, use docker-compose.traefik.yml the same way. It discovers the frontend through Docker labels and exposes its dashboard on TRAEFIK_DASHBOARD_PORT (127.0.0.1:8080 by default).

Terminating TLS at the proxy and running the panel behind it over plain HTTP is the normal layout — but then only the proxy may reach the panel port. The overlays remove the frontend’s direct host exposure; if you use podman-compose (which merges port lists instead of replacing them), also set FRONTEND_PORT=127.0.0.1:8080 in .env to keep direct access off the public interface.

PUBLIC_URL must be the exact URL users type (scheme + host) — the single source of truth for CORS, auth, and email links. The installer derives PASSKEY_RP_ID from its hostname. See configuration for the full environment reference.

Node ↔ panel

Section titled “Node ↔ panel”

Agents call home over HTTPS/WebSocket, so nodes need outbound access to the panel URL. No inbound holes toward nodes are required for management. If a node shows unreachable while its servers run fine, the management path (DNS, proxy, panel) is broken — not the games. See node issues.

Game traffic

Section titled “Game traffic”

Players connect directly to nodes, so each game port in your allocations must be reachable from the internet (or your LAN). UDP matters — many games use UDP, and a TCP-only test will mislead you.

The agent opens the ports itself: when a server starts it allows the server’s allocated ports through the firewall it detects (ufw, firewalld, or ipset/iptables) and removes them when the server is deleted. On firewalld it writes both the runtime and the permanent rule, so the port is reachable immediately and survives a reboot, without reloading the daemon. Anything in front of the node — a cloud security group, an upstream NAT — is still yours to configure. The panel port is the one thing nobody opens for you: the installer checks firewalld/ufw and prints the command (installation). Debugging steps live in networking issues.

SFTP

Section titled “SFTP”

SFTP is served by the node agent, not the panel — the default port is 2022. The per-node port is set in Admin → Nodes and written into the agent’s config; the agent opens it on the node’s firewall when it starts.

Checklist for a new site

Section titled “Checklist for a new site”
  1. DNS → panel, TLS valid, login works in a private window.
  2. Node checks in healthy.
  3. A test server’s game port answers from outside your network.
  4. SFTP port reachable if you offer it to users.
Section titled “Related”