Paths and Ports
Purpose
Give operators the listen ports and filesystem families they will actually see, without inventing a unified layout.
Filesystem prefix
These prefixes all appear in units/docs. Do not silently merge them in runbooks:
Scroll sideways to see the full table. Use the arrow keys when focused.
| Prefix | Typical use | Authority |
|---|---|---|
/etc/zcs | Virt Agent --config /etc/zcs/agent.yml; some Community README Manager YAML | zwall-agent.service |
/etc/zwall-manager | Enterprise Manager manager.yml, manager-nonsecret.env | zwall-manager.service |
/etc/zwall-hosting | Hosting YAML + hosting-ebpf.env | Hosting units |
/opt/zcs | Virt Agent binary + eBPF objects | virt unit |
/opt/zwall-manager | Manager binary | Manager unit |
/opt/zwall-hosting | Hosting Agent + hosting_observe.o | Hosting units |
/var/lib/zwall-manager | Manager state | Manager WorkingDirectory |
/var/lib/zwall-hosting | Hosting state + identity | Hosting units |
/var/log/zcs | example Agent/Manager log files | example YAML |
/var/log/zwall-manager | Manager unit ReadWritePaths | Manager unit |
Stale path warning: zwallctl start still prints /etc/zwall/agent.yml — do not copy that stale string.
Manager port and zwallctl default URL
Scroll sideways to see the full table. Use the arrow keys when focused.
| Listener | Example / default | Notes |
|---|---|---|
Manager server.port / server.api_port | 8443 | example YAML |
zwallctl manager_url | http://localhost:8080 | code default |
| Enterprise zwallctl example YAML | https://manager.example.com:8443 | match TLS |
Always pass --manager-url until config matches the live listener.
Ports
Scroll sideways to see the full table. Use the arrow keys when focused.
| Listener | Example / default | Required | Restart | Notes |
|---|---|---|---|---|
Manager server.port / server.api_port | 8443 | no | yes | used if api_port unset |
Manager web.port | 8443 unless split-mode | no | yes | must differ from API when split_mode_enabled |
PostgreSQL database.port | 5432 | no | n/a (DB) | |
zwallctl unconfigured manager_url | http://localhost:8080 | no | n/a | does not match Manager example port |
| Agent metrics (if enabled) | 127.0.0.1:9090 | if metrics.enabled | yes | localhost unless allowed_cidrs |
| Manager metrics | path /metrics on the API listener | if metrics.enabled | yes | admin JWT + RoleAuth admin |
| Cluster gRPC | example 50051 | if cluster.enabled | yes | not a public HA product |
| Let’s Encrypt HTTP-01 | example 80 | if enabled | yes | Enterprise, not certified |
| Hosting network socket | UNIX /run/zwall-hosting-ebpf/observer.sock | Hosting v2 network | loader | not a TCP port |
Do not publish lab hostnames. Do not assume Kubernetes Service ports.
Path families (table)
Scroll sideways to see the full table. Use the arrow keys when focused.
| Family | What lives there | Source authority |
|---|---|---|
/etc/zcs | Virt Agent YAML; some Community Manager YAML | zwall-agent.service |
/etc/zwall-manager | Enterprise Manager config | zwall-manager.service |
/etc/zwall-hosting | Hosting Agent YAML, hosting-ebpf.env | Hosting units |
/etc/zwall/release-trust-root.json | Verifier trust root example | installer examples |
/opt/zcs | /opt/zcs/bin/zwall-agent, eBPF objects | virt unit |
/opt/zwall-manager | Manager binary | Manager unit |
/opt/zwall-hosting | Hosting Agent, loader, hosting_observe.o | Hosting units |
/usr/local/libexec/zwall-release | Customer verifier example | database-install example |
/var/lib/zwall-manager | Manager WorkingDirectory / State | Manager unit |
/var/lib/zwall-hosting | Hosting state, agent.identity | Hosting units |
/var/backups/zwall | maintenance.backup_dir example | manager.example.yml |
/sys/fs/bpf / /sys/fs/bpf/fw | pinned maps | virt unit; zwallctl pin_dir |
~/.zwallctl/config.yml | CLI config mode 0600 | zwallctl config.go |