docs: Move Cloud Firewall config into Cloud Folder #556

gavinelder · 2025-04-22T20:22:43Z

Currently the network configuration requirements for Cloud are within the Enterprise section as such these have been moved to the Cloud under enterprise/advanced-topics/firewall-configuration.md

The original content can be viewed at https://docs.seqera.io/platform-enterprise/25.1/enterprise/advanced-topics/firewall-configuration

Further to that for Enterprise customers self-hosting their own installation

Seqera Cloud requires no inbound connectivity to their environment.
The customers Seqera Self-Hosted instance should be allowed to communicate with licences.seqera.io on port 443 the ip addresses for this are
- 35.179.197.5/32
- 18.175.79.222/32
- 3.11.38.17/32

Enterprise Plugins & Fusion

Seqera Enterprise plugins & fusion have licence checking built-in as such it's not sufficient to only allow outbound traffic to port 443 from the Seqera Enterprise installation , they will also have to allow network traffic from the Compute Environment executing the Nextflow jobs.

Wave

If the customer is using Seqera Cloud hosted Wave and they're using the Mirror or Freeze functionality which requires Wave to store built containers within their container registry then they will have to ensure that the wave-build VPC is allowed to push to their container registry, for most cloud providers this requires additional configuration to lock down as such it's not normally a problem.

These would be the following IP addresses on port 443

"18.135.7.45/32",
"18.169.21.18/32",
"18.171.4.252/32"

If the customer would like to restrict outbound traffic from their installation they would be responsible for ensuring they allow access to Seqera Assets hosted on Cloudflare along with Nextflow assets hosted on Github artifacts along with any code hosting solutions or third party dependancies they're using such as Github / Gitlab / Artifactory.

TODO

Update Sidebar for Enterprise & cloud.
Update Cloud language / Contents to ensure it only makes reference to cloud.
Create networking document for Enterprise covering the content here.
Ensure Wave Networking is documented.

netlify · 2025-04-22T20:23:04Z

✅ Deploy Preview for seqera-docs ready!

Name	Link
🔨 Latest commit	`815606e`
🔍 Latest deploy log	https://app.netlify.com/projects/seqera-docs/deploys/684739f552698d0008d256e6
😎 Deploy Preview	https://deploy-preview-556--seqera-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

…egorize egress and ingress IPs

ShahzebMahmood · 2025-06-09T19:47:02Z

We need to update the IP addresses listed in the documentation. I'm also wondering if it makes sense to include them there at all. Additionally, we should add a list of the services that sit behind those IPs for better clarity.

At the moment, the documentation focuses only on the Enterprise offering, but there are scenarios where Cloud customers also need access to this information, so we may want to expand the scope accordingly.

On a related note, we've recently updated meta.seqera.io to display both ingress and egress IPs, which should make it easier to surface and maintain this information. I updated this PR to show the correct IPs, which should look like below.

{
  "egress": [
    "18.169.21.18/32",
    "18.135.7.45/32",
    "18.171.4.252/32"
  ],
  "ingress": [
    "35.179.197.5/32",
    "3.11.38.17/32",
    "18.175.79.222/32"
  ]
}

bebosudo

Seqera Cloud requires no inbound connectivity to their environment.

I'm not sure that's correct; take the case of customers who are using the wave service with mirror and/or freeze functionalities, they'd need to allowlist our egress IPs in order for wave to store images in their Container Registry of choice, or for Fusion to call home, etc

bebosudo · 2025-06-13T09:38:06Z

platform-enterprise_versioned_docs/version-25.1/enterprise/configuration/networking.md

+
+### Fusion and other Enterprise plugins
+
+[Fusion file system](../../supported_software/fusion/overview.md) and other Seqera Enterprise plugins have built-in licence checking built-in. As such, you must also allow network traffic from the your Seqera compute environment executing Nextflow jobs. 


Suggested change

[Fusion file system](../../supported_software/fusion/overview.md) and other Seqera Enterprise plugins have built-in licence checking built-in. As such, you must also allow network traffic from the your Seqera compute environment executing Nextflow jobs.

[Fusion file system](../../supported_software/fusion/overview.md) and other Seqera Enterprise plugins have built-in license checking. As such, you must also allow network traffic from your Seqera compute environment executing Nextflow jobs.

Which service is validating fusion licenses? Is it license manager? We should specify that customers should allowlist our ingress IPs then

bebosudo · 2025-06-13T09:38:28Z

platform-enterprise_versioned_docs/version-25.1/enterprise/configuration/networking.md

+
+### Studios
+
+See [Studios deployment](../studios.md) for details on the Seqera-hosted URLs, and internal subdomains of your Platform instance host domain, that must be allowed for ingress and egress traffic. 


Suggested change

See [Studios deployment](../studios.md) for details on the Seqera-hosted URLs, and internal subdomains of your Platform instance host domain, that must be allowed for ingress and egress traffic.

See [Studios deployment](../studios.md) for details on the Seqera-hosted URLs and internal subdomains of your Platform instance host domain, which must be allowed for ingress and egress traffic.

bebosudo · 2025-06-13T09:40:44Z

platform-enterprise_versioned_docs/version-25.1/enterprise/configuration/networking.md

+
+### Wave
+
+To use Seqera Cloud-hosted [Wave](https://docs.seqera.io/wave) with the Mirror or Freeze functionality, which requires Wave to store built containers within your container registry, you must to ensure that the wave-build VPC is allowed to push to your container registry. For most cloud providers, this requires additional configuration to lock down, but is generally allowed by default.


Suggested change

To use Seqera Cloud-hosted [Wave](https://docs.seqera.io/wave) with the Mirror or Freeze functionality, which requires Wave to store built containers within your container registry, you must to ensure that the wave-build VPC is allowed to push to your container registry. For most cloud providers, this requires additional configuration to lock down, but is generally allowed by default.

To use Seqera Cloud-hosted [Wave](https://docs.seqera.io/wave) with the Mirror or Freeze functionality, which requires Wave to store built containers within your container registry, you must ensure that the wave-build VPC is allowed to push to your container registry. For most cloud providers, this is generally permitted by default; you may contact your network administrators to verify whether additional firewall rules have been defined.

bebosudo · 2025-06-13T09:41:30Z

platform-enterprise_versioned_docs/version-25.1/enterprise/configuration/networking.md

+Your Seqera Enterprise must be allowed to communicate with licences.seqera.io on port 443. The IP addresses for this service are:
+- 35.179.197.5/32
+- 18.175.79.222/32
+- 3.11.38.17/32


here we should just reference meta.seqera.io and specify that administrators should allowlist the ingress IPs

bebosudo · 2025-06-13T09:41:53Z

platform-enterprise_versioned_docs/version-25.1/enterprise/configuration/networking.md

+Ensure your Enterprise instance can communicate with the following Seqera-hosted Wave service IP addresses on port 443:
+
+- 18.135.7.45/32
+- 18.169.21.18/32
+- 18.171.4.252/32


here we should just reference meta.seqera.io and specify that administrators should allowlist the egress IPs

bebosudo · 2025-06-13T09:42:31Z

platform-enterprise_versioned_docs/version-25.1/enterprise/configuration/networking.md

+
+### Restricting outbound traffic
+
+To restrict outbound traffic from your Enterprise installation, you must allow access to Seqera assets hosted on Cloudflare, Nextflow assets hosted on Github artifacts, and any code hosting solutions or third party dependancies you require, such as Github, Gitlab, or Artifactory.


Suggested change

To restrict outbound traffic from your Enterprise installation, you must allow access to Seqera assets hosted on Cloudflare, Nextflow assets hosted on Github artifacts, and any code hosting solutions or third party dependancies you require, such as Github, Gitlab, or Artifactory.

To restrict outbound traffic from your Enterprise installation, you must allow access to Seqera assets hosted on Cloudflare, Nextflow assets hosted on GitHub artifacts, and any code hosting solutions or third-party dependencies you require, such as GitHub, GitLab, or Artifactory.

It's not clear to me which assets we're referring to, and we're not specifying IPs/DNS entries to allowlist

Also, the wording isn't really clear in general

bebosudo · 2025-06-13T10:21:14Z

platform-cloud/docs/enterprise/advanced-topics/firewall-configuration.md

+$ python3
+>>> import requests
+>>> requests.get("https://meta.seqera.io").json()
+{
+  "egress": [
+    "18.169.21.18/32",
+    "18.135.7.45/32",
+    "18.171.4.252/32"
+  ],
+  "ingress": [
+    "35.179.197.5/32",
+    "3.11.38.17/32",
+    "18.175.79.222/32"
+  ]
+}


shall we drop the actual IPs and just show the python code? this avoids spreading IPs that would then need to be updated
people should get the most up-to-date IPs from the meta endpoint

Suggested change

$ python3

>>> import requests

>>> requests.get("https://meta.seqera.io").json()

{

"egress": [

"18.169.21.18/32",

"18.135.7.45/32",

"18.171.4.252/32"

],

"ingress": [

"35.179.197.5/32",

"3.11.38.17/32",

"18.175.79.222/32"

]

}

$ python3

>>> import requests

>>> requests.get("https://meta.seqera.io").json()

I'd also change the endpoint customers should hit to https://meta.seqera.io/v3, so they'll subscribe to a specific version of our list of IPs (we don't list specific services anymore and we now also provide ingress IPs, since we set up a Network Load Balancer in front of our Application Load Balancer)

bebosudo · 2025-06-13T10:22:02Z

platform-enterprise_versioned_docs/version-25.1/enterprise/configuration/networking.md

@@ -5,6 +5,37 @@ date: "21 Apr 2023"
 tags: [networking, configuration]
 ---

+To self-host your installation of Seqera Platform Enterprise, a number of inbound and outbound connections must be allowed within and external to your environment. This page details the ingress and egress networking considerations required for your Seqera Enterprise deployment. 


Suggested change

To self-host your installation of Seqera Platform Enterprise, a number of inbound and outbound connections must be allowed within and external to your environment. This page details the ingress and egress networking considerations required for your Seqera Enterprise deployment.

To self-host your installation of Seqera Platform Enterprise, a number of inbound and outbound connections must be allowed on your firewall. This page details the ingress and egress networking considerations required for your Seqera Enterprise deployment.

bebosudo · 2025-06-13T10:28:45Z

platform-cloud/docs/enterprise/advanced-topics/firewall-configuration.md

+
+Seqera Platform Cloud ([cloud.seqera.io](https://cloud.seqera.io)) may need to connect to resources within your network, e.g., your storage server. To do so, your firewall must be configured to allow certain IPs to reach your resources.
+
+A dynamic list of IPs is kept up-to-date at https://meta.seqera.io.


Suggested change

A dynamic list of IPs is kept up-to-date at https://meta.seqera.io.

A dynamic list of IPs is kept up-to-date at https://meta.seqera.io/v3.

let's make customers subscribe to a specific version
if in the future we'll rework the meta endpoint to use a new formatting we'll create a new version (this won't be the case for a simple IP update)

docs: Move Cloud Firewall config into Cloud Folder

608383e

justinegeffen added the draft/WIP label Apr 29, 2025

gavinelder and others added 3 commits May 6, 2025 13:08

Merge branch 'master' into ge/docs/firewall-config

99b2d5f

Merge branch 'master' into ge/docs/firewall-config

dd85a4a

Fix sidebars, add ingress/egress info to Enterprise networking config

198ea77

llewellyn-sl self-assigned this May 23, 2025

Fix JSON structure in firewall configuration example to correctly cat…

815606e

…egorize egress and ingress IPs

bebosudo reviewed Jun 13, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs: Move Cloud Firewall config into Cloud Folder #556

docs: Move Cloud Firewall config into Cloud Folder #556

gavinelder commented Apr 22, 2025 •

edited by llewellyn-sl

Loading

Uh oh!

netlify bot commented Apr 22, 2025 •

edited

Loading

Uh oh!

ShahzebMahmood commented Jun 9, 2025

Uh oh!

bebosudo left a comment

Uh oh!

bebosudo Jun 13, 2025

Uh oh!

bebosudo Jun 13, 2025

Uh oh!

bebosudo Jun 13, 2025

Uh oh!

bebosudo Jun 13, 2025

Uh oh!

bebosudo Jun 13, 2025

Uh oh!

bebosudo Jun 13, 2025

Uh oh!

bebosudo Jun 13, 2025

Uh oh!

bebosudo Jun 13, 2025

Uh oh!

bebosudo Jun 13, 2025

Uh oh!

bebosudo Jun 13, 2025

Uh oh!

bebosudo Jun 13, 2025

Uh oh!

bebosudo Jun 13, 2025

Uh oh!

Uh oh!


		### Fusion and other Enterprise plugins

		[Fusion file system](../../supported_software/fusion/overview.md) and other Seqera Enterprise plugins have built-in licence checking built-in. As such, you must also allow network traffic from the your Seqera compute environment executing Nextflow jobs.


		### Studios

		See [Studios deployment](../studios.md) for details on the Seqera-hosted URLs, and internal subdomains of your Platform instance host domain, that must be allowed for ingress and egress traffic.


		### Wave

		To use Seqera Cloud-hosted [Wave](https://docs.seqera.io/wave) with the Mirror or Freeze functionality, which requires Wave to store built containers within your container registry, you must to ensure that the wave-build VPC is allowed to push to your container registry. For most cloud providers, this requires additional configuration to lock down, but is generally allowed by default.


		### Restricting outbound traffic

		To restrict outbound traffic from your Enterprise installation, you must allow access to Seqera assets hosted on Cloudflare, Nextflow assets hosted on Github artifacts, and any code hosting solutions or third party dependancies you require, such as Github, Gitlab, or Artifactory.

	To self-host your installation of Seqera Platform Enterprise, a number of inbound and outbound connections must be allowed within and external to your environment. This page details the ingress and egress networking considerations required for your Seqera Enterprise deployment.
	To self-host your installation of Seqera Platform Enterprise, a number of inbound and outbound connections must be allowed on your firewall. This page details the ingress and egress networking considerations required for your Seqera Enterprise deployment.


		Seqera Platform Cloud ([cloud.seqera.io](https://cloud.seqera.io)) may need to connect to resources within your network, e.g., your storage server. To do so, your firewall must be configured to allow certain IPs to reach your resources.

		A dynamic list of IPs is kept up-to-date at https://meta.seqera.io.

docs: Move Cloud Firewall config into Cloud Folder #556

Are you sure you want to change the base?

docs: Move Cloud Firewall config into Cloud Folder #556

Conversation

gavinelder commented Apr 22, 2025 • edited by llewellyn-sl Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Enterprise Plugins & Fusion

Wave

TODO

Uh oh!

netlify bot commented Apr 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for seqera-docs ready!

Uh oh!

ShahzebMahmood commented Jun 9, 2025

Uh oh!

bebosudo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gavinelder commented Apr 22, 2025 •

edited by llewellyn-sl

Loading

netlify bot commented Apr 22, 2025 •

edited

Loading