Local Port and Host Binding Registry
Use the checked-in binding sources below to select a local address. DNS entries, Docker network aliases, source-process listeners and published container ports are separate facts. A hostname alone does not establish HTTP or HTTPS reachability.
Verified against: 818afdc7523c57b24370f841d99a1ce622cfd9ee (2026-10-07). Re-verify with
python tools/scripts/generate/service-inventory.py --check, then inspect the selected Compose chain’sportsandnetworksdeclarations. This document describes checked-in source configuration, not a live probe.
Binding authorities
| Surface | Authority | How to use it |
|---|---|---|
| Deployables and family ownership | Generated service inventory | Find the owner, source project and Compose file. |
| Host port publication | devops/compose/docker-compose.stella-ops.yml and included family files | Read the selected service’s ports; family aliases do not publish a port. |
| Local host resolution | devops/compose/hosts.stellaops.local | Setup installs this file; verify the name also has a current listener. |
| Direct source-process dev ports | The owning project’s Properties/launchSettings.json, ASPNETCORE_URLS or explicit Kestrel:Endpoints | Use the selected launch profile or actual process configuration. |
| Optional friendly direct-source listeners | src/Authority/StellaOps.Authority/StellaOps.Auth.ServerIntegration/StellaOpsLocalHostnameExtensions.cs | TryAddStellaOpsLocalBinding conditionally binds 80/443 after resolving the service name and checking availability. |
The old 10000 + slot × 10 allocation table does not describe every current host or Compose publication. Do not calculate an endpoint from a slot number. Explicit Kestrel endpoints take precedence in the local-binding helper; worker roles do not acquire an externally reachable port by applying a numeric offset.
Gateway and consolidated owners
The local frontdoor publishes 127.1.0.1:80 and 127.1.0.1:443 from docker-compose.stella-services.yml; the installed stella-ops.local entry resolves to that address. Owner API prefixes below are gateway namespaces, not collection root promises: use a concrete mapped endpoint from the owner’s source.
| Owner / Compose role | Docker discovery alias | Owning API/source | Host publication in the checked-in family definition |
|---|---|---|---|
Evidence / evidence-web | evidence.stella-ops.local, evidence-web.stella-ops.local | /api/evidence/v1/*; src/Evidence/StellaOps.Evidence.WebService | No ports declaration in docker-compose.evidence.yml. |
Vulnerabilities / vulnerabilities-web | vulnerabilities.stella-ops.local, vulnerabilities-web.stella-ops.local | /api/vulnerabilities/v1/*; src/Vulnerabilities/StellaOps.Vulnerabilities.WebService | No ports declaration in docker-compose.vulnerabilities.yml. |
OfflineKit / offlinekit-web | offlinekit.stella-ops.local, offlinekit-web.stella-ops.local | /api/offlinekit/v1/*; src/OfflineKit/StellaOps.OfflineKit.WebService | No ports declaration in docker-compose.offlinekit-consolidated.yml. |
Findings / findings-web | findings.stella-ops.local, findings-web.stella-ops.local | /api/findings/v1/*; src/Findings/StellaOps.Findings.WebService | No ports declaration in docker-compose.findings.yml. |
JobEngine / jobengine-web | jobengine.stella-ops.local, jobengine-web.stella-ops.local | Scheduling and PacksRegistry composition; src/JobEngine/StellaOps.JobEngine.WebService | 127.1.0.19:80:80 in docker-compose.stella-services.yml. |
AdvisoryAI / advisoryai-web | advisoryai.stella-ops.local, advisoryai-web.stella-ops.local | Assistance, OpsMemory and remediation composition; src/AdvisoryAI/StellaOps.AdvisoryAI.WebService | No ports declaration in docker-compose.advisoryai.yml. |
Platform / platform | platform.stella-ops.local | Platform read models and Doctor aggregate | 127.1.0.3:80:80 in docker-compose.stella-services.yml. |
These are internal aliases; the table does not assert that each name resolves on the host, exposes HTTPS or answers in the current deployment. Use the gateway for operator API traffic unless an owning procedure explicitly selects a direct service endpoint. An overlay may add a publication; inspect the whole selected chain before using it.
Platform’s service-URL settings are explicit configuration. In the verified docker-compose.stella-services.yml, STELLAOPS_EVIDENCE_URL selects the Evidence host, STELLAOPS_SCHEDULER_URL and STELLAOPS_PACKSREGISTRY_URL select JobEngine, STELLAOPS_FINDINGS_LEDGER_URL selects Findings, and STELLAOPS_OPSMEMORY_URL selects AdvisoryAI. Consult the Platform dossier and the actual environment-settings source before deriving Console URLs.
Hosts-file setup
Run tools/scripts/setup.ps1 or tools/scripts/setup.sh to install the checked-in hosts file. For manual setup, review that file and append the required current entries to C:\Windows\System32\drivers\etc\hosts on Windows or /etc/hosts on Linux/macOS with the necessary administrator privileges. Avoid maintaining a second copied hosts block in this document.
The checked-in file also retains some predecessor allocations. Validate each entry against the selected service’s current publication. A retained hosts entry neither starts a service nor proves that the predecessor alias is claimed by its successor.
Infrastructure and optional integrations
| Local host entry | Checked-in default publication | Service definition |
|---|---|---|
db.stella-ops.local → 127.1.1.1 | ${POSTGRES_PORT:-5432}:5432 | PostgreSQL in docker-compose.stella-infra.yml. |
cache.stella-ops.local → 127.1.1.2 | ${VALKEY_PORT:-6379}:6379 | Valkey in docker-compose.stella-infra.yml. |
s3.stella-ops.local → 127.1.1.3 | ${RUSTFS_HTTP_PORT:-8333}:8333 | The rustfs Compose service uses the SeaweedFS S3 provisioning contract. |
keycloak.stella-ops.local → 127.1.2.10 | 127.1.2.10:443:443 (profile lab-mfa-provider only) | Lab-only Keycloak MFA provider in docker-compose.lab-mfa-provider.yml; never part of a release bundle. |
Image digests and configurable port overrides come from the selected environment; this page does not duplicate image-version snapshots. Sigstore and integration fixtures are profile/overlay selections. See the generated inventory and the corresponding Compose definition before selecting a fixture address.
Historical allocation and probe notes withdrawn 2026-10-07
- Attestor and EvidenceLocker’s predecessor projects, host aliases and worker allocations are retired; the Evidence family owns their carried APIs. Neither predecessor alias is claimed in
docker-compose.evidence.yml. - Concelier, Excititor, BinaryIndex and Symbols’ predecessor hosts are frozen; Vulnerabilities is their successor. Retained loopback names are not a direct address for the hub.
- Scheduler and PacksRegistry were folded into JobEngine on 2026-09-12; the soak aliases, including
packsregistry.stella-ops.local, were retired at JOB-10. - Doctor’s separate host and OpsMemory/Remediation’s separate hosts are retired; per-service checks/Platform and AdvisoryAI respectively own the surviving roles.
- ExportCenter’s host was replaced by OfflineKit in September 2026. The dated 2026-09-14 comparison (
GET /v1/exports→ 404 and the successor profile read → 401) is historical probe evidence, not a current reachability check. Current export ownership is defined by OfflineKit’sProgram.cscomposition.
The freeze records and successor project paths are preserved in the generated inventory. No retired slot is an instruction to launch a frozen project, restore a predecessor route or assign a successor to that numeric port.