Skip to main content

Publishing ports

Anything listening inside a lab is already reachable privately from your devices at http://<your-lab-ip>:<port>. This page explains how to make a port reachable by anyone on the internet.

There are four ways, from simplest to most flexible:

WayProtocolWhere it is setNeeds
Port 80 on your domainsHTTPSLab Preferences → Public ExposureA domain
The lab's own app linksHTTPSBuilt into the lab; you can pick the domainNothing
HTTP proxiesHTTPSLab Preferences → HTTP ProxiesA domain; the lab's template must allow it
TCP portsRaw TCP, optionally TLSLab Preferences → Expose TCP PortsPaid plan or 5,000 Zeal; the template must allow it
Everything here applies on redeploy

All of these settings are saved with Save Preferences and take effect only when the lab is redeployed. Use Apply & Redeploy now, or set them in the Redeploy dialog.

Port 80 on your domains​

This is the simplest case. Set Expose to Web (port 80) to Public, 80 exposed over 443 and pick your domains. Whatever your app serves on port 80 inside the lab is served over HTTPS on those names. For step-by-step instructions, see Domains.

Some labs come with apps already wired up — a notebook, an automation tool, a dashboard. Each one gets an HTTPS address on a platform domain automatically, and the first one is what the lab's Launch button opens.

Under Public Exposure, each app has a Domain for app (Port N) field. Leave it on the default, or pick one of your own domains to serve that app on a name you choose.

HTTP proxies​

Map any port in your lab to one or more of your domains. The platform handles TLS for you, so your app can use plain HTTP.

Shown on labs.selfmade.ninja, the Selfmade Ninja Academy platform. On your own platform you will see your own domain and data.
  1. In the lab's Preferences, find HTTP Proxies and select Add HTTP Proxy.
  2. Enter the port your app listens on inside the lab.
  3. Choose one or more domains for it.
  4. Add more rows for more apps, then Save Preferences and redeploy.

After the deploy, each proxy appears in the lab's connection information as HTTP proxy (port N) with its https:// address.

Ports you cannot use here. These ports are already taken. If you try one, you get Port N is reserved or invalid for custom proxies:

  • 22 (SSH)
  • the port VS Code in the browser uses
  • 80, when the lab is already public on port 80
  • ports the lab's own app links already use

If HTTP Proxies does not appear, the lab's template does not allow it.

Only your own verified domains are kept on a proxy row. A domain that is unverified when you save is dropped from the row without an error, and a row left with no domains is not saved. First check that the domain shows verified on My Domains.

TCP ports​

Use TCP ports for things that are not websites: a database you want to reach from outside, a game server, or a custom protocol.

  1. In the lab's Preferences, find Expose TCP Ports and select Add TCP Port.
  2. Enter the Container Port — the port inside the lab.
  3. Optionally choose a domain (below).
  4. Save Preferences and redeploy.

After the deploy, the lab's connection information shows a TCP port N row with the public address and port to connect to.

RuleDetail
Who can use itA paid plan or 5,000 Zeal. Otherwise the section is shown but locked, with how much Zeal you have.
Which labsMachine labs with persistent storage, whose template allows it
How manyUp to 3 ports per lab. Each container port can appear once; extra rows are ignored.
Which portsAny port from 1 to 65535 except the reserved ones listed under HTTP proxies
Public portChosen by the platform, not by you, and can change when the lab is redeployed. Always read it from the connection information.
EncryptionNone by default — it is a raw TCP port. Use a protocol that encrypts, or add a domain.

TLS with a domain​

Pick one of your domains on a TCP row and the port is also reachable over TLS, routed by name. Each domain can be used on only one TCP row, and it must be one of your own domains — otherwise the row is kept as a plain port without the domain. The certificate is issued automatically, like any other domain. Your client must connect with TLS and send the domain name (SNI) — hover the domain field to see the port to use.

Choose No domain for plain TCP

No domain — raw port only is the default. Use it when your client does not support TLS.

Do it with an AI assistant​

You can also do this by asking an AI assistant connected to your account — see Connect an AI assistant to set one up.

AskWhat the assistant does
“Serve port 8080 of my lab on app.example.com and redeploy”Checks that the domain is verified with list_domains, then configure_lab_routing with apply, which saves and redeploys
“Expose the PostgreSQL port in my lab over TCP”configure_lab_routing with a TCP port
“What is published on my lab right now?”lab_info
“Stop publishing port 3000”configure_lab_routing, removing that port
Saving is not publishing

Routing changes take effect only when the lab is redeployed, so ask for it to be applied. A domain that is not yet verified is silently left out of an HTTP proxy, so first check that it shows as verified.

Next​

Last updated on