Service connectivity¶

Allow outbound access from each AntFlow component to the services shown below. Use these diagrams when configuring firewall rules or checking service reachability. Arrows show the direction of access, not the flow of results. Dashed arrows represent conditional connections.

Browser connections¶

flowchart LR
  browser["User browser"] --> ui["AntFlow UI"]
  browser --> api["Server API"]
  browser --> identity["Identity provider"]
  browser -.-> storage["Object storage for direct downloads"]

Direct result downloads require browser access to the storage endpoint; see Result delivery. Optional integrations also require browser access to their configured endpoints.

For public endpoints, follow Expose AntFlow over HTTPS. For browser requests across origins, follow Configure cross-origin access.

Server connections¶

flowchart LR
  server["Server API"] --> gitlab["GitLab"]
  server --> identity["Identity provider"]
  server --> database["PostgreSQL"]
  server --> storage["Object storage"]
  server -.-> cache["Cache, if configured"]
  server -.-> stac["STAC API, if configured"]

Use endpoints reachable from the server, not addresses that work only from an operator's workstation. Configure the services through GitLab projects, Authentication, Configure the application database, Store and serve workflow results, Publish results to STAC, and Configure caching.

Launcher and job connections¶

flowchart LR
  runners["Launchers and workflow jobs"] --> api["Server API"]
  runners --> storage["Object storage"]
  runners --> registries["Container registries"]
  runners --> services["Workflow services"]

Required workflow services depend on the process being executed. Storage endpoints must also be reachable from runner hosts, including hosts outside Kubernetes. For restricted outbound access, company-issued certificates, or TLS inspection, see Launcher behind company firewall.