Networking
Understand the harness, webhook, and companion network boundaries.
Maven separates its network surfaces by trust level.
| Surface | Default bind | Purpose |
|---|---|---|
| Harness | 127.0.0.1:8799 (every private address with serve --lan) | Full app API and event stream |
| Webhook receiver | 127.0.0.1:8800 | Health and secret hook endpoints only |
| Companion sidecar | 0.0.0.0:8810 when enabled | Paired-device, token-authenticated allowlist |
| Companion control | 127.0.0.1:8811 | Pairing and device administration |
Remote access
Never forward the harness port yourself. A self-hosted server is reached through one of maven serve's ways in:
--public-url https://…: your own cloudflared tunnel, Caddy or nginx in front;--domain HOST: a managed Caddy that gets the certificate;--tailscale: your tailnet, with Tailscale's HTTPS;--lan: this network only, plain http. It listens on every address, but answers only connections whose two ends are both private;--tunnel: a free Maven web address.
Each prints one pairing link; paste it into the desktop app under ＋ → Connect to a server. The app accepts plain http only on private networks: LAN addresses, Tailscale's 100.64/10 and *.ts.net, and *.local.
A loopback request counts as the owner only when it really comes from this machine; a LAN client that writes Host: 127.0.0.1 is still a stranger. For webhook delivery, proxy only the dedicated webhook receiver. Never forward the main harness port to the public internet.
Port overrides
Source and advanced deployments can change documented ports with the relevant environment settings. When the default harness port is occupied, packaged builds may fall back to another local port and communicate the selected address internally.