Outbound connections¶
On its own, calServer V2 sends only two things to the outside: the licence check and the update query. Both can be switched off, and neither transfers customer, device or calibration data. Everything else only goes to targets you configure yourself.
There is no telemetry, no error reporting to third parties and no analytics. The interface ships its own fonts and libraries and loads nothing from CDNs or Google Fonts.
On its own¶
| Target | When | What is sent | Switch off |
|---|---|---|---|
calHelp licence service (LICENSE_SERVER_URL) |
task license:check, once a day |
licence key, random instance ID, version, image tag (details) | leave LICENSE_SERVER_URL empty; without internet: offline confirmation (licence) |
Image registry (registry.calhelp.de or Docker Hub), via the updater container |
task updates:check, daily at 0:00, and when opening Administration → Updates |
login with the pull credentials, query of available versions | UPDATE_AUTO_CHECK=false stops the daily query; without the updater container none happens |
Release notes for a new version come from the changelog file shipped with the update. calServer does not query any further service for them.
Only when you configure a target¶
| Feature | Target | Setting |
|---|---|---|
| your SMTP server | ||
| SAML or LDAP sign-in | your identity provider or directory | SSO and LDAP |
| AI assistant | default is the local model in the calserver-ai container; external only if you configure a provider |
Administration → AI |
| Seal with timestamp | timestamp authority (TSA) and revocation data (OCSP/CRL) of your certificate authority; for remote seals its signing service | Seal |
| Backup | your backup target | Backup |
| DMS inbox | your mailbox or share | Administration → File management |
| MET/TEAM sync | your MET/TEAM database | MET/TEAM |
Report runner, seal service, updater and MET/BASE run as containers in the same network and do not count as outbound connections.
Links the browser opens¶
Some pages link to the calHelp download page
(calhelp.github.io/calServer-reports), for report packages or the calServer
Runner. Only the browser opens them, and only when someone clicks the link. You
can mirror the runner locally (CALSERVER_RUNNER_LOCAL_DIR); calServer then
serves the packages itself.
Firewall¶
To run without internet, open no outbound connection at all. Updates are then installed from the images, the licence via the offline confirmation. With internet, these rules are enough:
| Target | Port | Purpose |
|---|---|---|
licence service (host from LICENSE_SERVER_URL) |
443 | licence check |
registry.calhelp.de or registry-1.docker.io and auth.docker.io |
443 | update query and images |