Hostnames and ports to allow

The outbound hostnames and ports a screen needs, for allowlisting on a restricted network: Screenly's own hosts, the Anywhere app hosts, and the Ubuntu Core hosts a ScreenlyOS player needs too.

Allow these outbound. Nothing inbound is required, unless you collect metrics from ScreenlyOS players. A Screenly Anywhere screen needs the Screenly and Screenly Anywhere tables; a ScreenlyOS player needs the Screenly and operating system tables, and makes the network checks. What the dashboard itself needs from the browser you manage screens in is a separate, shorter list in Dashboard requirements.

[!IMPORTANT] Allow the hostnames themselves. If you resolve them to IP addresses and allow those instead, your deployment will break, because we use Cloudflare in front of our infrastructure and the addresses change.

Screenly

Screenly Anywhere

An Anywhere screen runs inside a browser or an app on the device, so it also fetches the app itself. App-store installs (Google Play, the Amazon Appstore) use the device's own store hosts, which the device already reaches.

Operating system (ScreenlyOS)

ScreenlyOS is built on Ubuntu Core, so it needs Canonical's endpoints as well.

Network checks (ScreenlyOS)

A player confirms it has a route out before it reports a fault, using two well-known targets.

Metrics (ScreenlyOS, optional)

This is the only inbound connection a ScreenlyOS player takes, and only when Node Exporter is turned on in a screen's advanced settings. It is off by default, so most deployments need nothing here.

From ScreenlyOS 26.9.0, the player serves the metrics over HTTPS and identifies itself with its own device certificate. Verify that certificate against the Screenly certificate authority, and set the expected server name to the player's hostname, the one that starts with srly-. Screenly support can send you the Screenly CA certificate. Older releases serve the metrics over plain HTTP.

For a Prometheus scrape job, that means scheme: https, with a tls_config whose ca_file points at the Screenly CA certificate and whose server_name is the player's hostname. The port stays 9100.

If wildcards are not allowed

Some firewalls cannot match on a wildcard. These are the names behind each one, all on port 443 TCP.

In place of *.snapcraftcontent.com

In place of *.cdn.snapcraft.io

In place of *.snapcraft.io

You may also need to allow your DNS servers on port 53 UDP.

[!NOTE] This list changes as our infrastructure does. If you are building a long-lived firewall rule, check back rather than treating a copy as permanent.