Network and remote-interface map
Deployment topology matters
The current hrsdk_configs/main.yaml uses host networking for the main stack, perception, speech and some databases. A ports stanza on a host-networked service does not provide the same isolation as bridge networking. The development Compose uses bridge networking and explicit host port publications. Check the effective topology before deciding an endpoint is internal or remotely reachable.
| Surface | Default endpoint/port in inspected source | Remote-use notes |
|---|---|---|
| Host console | HTTP 80 packaged default | Administrative robot-LAN UI/API; no built-in login |
| Robot WebUI | HTTP 8000 deployment default | REST, JSON /ws, audio /ws/audio; ingress may add auth/TLS |
| Unity animation | WebSocket 9099 | Streamer; remote WebGL uses same-origin /unity_wss proxy |
| Browser audio | WebSocket 3033 | PCM/control bridge; WebUI proxies through /ws/audio |
| Audio helper | HTTP 3034 | Static helper client and GET /status |
| LLM tools | HTTP 127.0.0.1:8005 | POST /tools/call; loopback by default, no built-in auth |
| TTS synthesis | HTTP 10001 / 10002 in deployment | Provider synthesis servers; actual image/plugin selection matters |
| Redis | TCP 6379 | Configured Redis7 file binds loopback with protected mode; verify the selected image/config and protect access |
| MySQL | TCP 3306 | Enabled data functions; use engine-specific access policy |
| MongoDB | TCP 27017 | Enabled data functions; published endpoint in current Compose |
| Optional Spark | HTTP 8588; database UI 8589 | Separate image/integration, disabled unless selected |
| ROS 2 | DDS transport/discovery | Domain/interface/QoS/message compatibility required |
| Documentation | HTTPS 443 | Static public docs only; no robot API proxy |
These are source defaults, not an assertion about a particular robot's open ports. CLI overrides, environment, launch conditions, proxy routing and firewall policy can change reachability.
API schema discovery
The console and Robot WebUI construct FastAPI applications with default schema/documentation routes. On the intended service origin inspect /api/openapi.json, /api/docs, or /redoc where the deployment exposes them. OpenAPI describes HTTP handlers and typed models; it does not fully describe WebSocket commands, delegated dictionary bodies, physical side effects or deployment authentication.
The route declarations, console routes, request models and service guides supplement those schemas. TTS uses Flask and the tool bridge uses a standard-library HTTP handler; they do not inherit FastAPI's schema routes.
Browser helper status
On the browser-audio helper listener, GET /status returns status JSON including clients, input ownership, output subscribers and timing/stream state as implemented by the bridge. Static assets send Cache-Control: no-store to avoid keeping an old audio client after an SDK update. This is separate from WebUI health and console health.
ROS graph access
Use matching installed interfaces and configure ROS_DOMAIN_ID, RMW and the intended network interface/profile on the remote ROS machine. Platform topic QoS is often best effort. Read the running graph before choosing a subscriber's reliability/durability.
Do not expose raw ROS/database/control listeners as a consequence of making the documentation public. The documentation domain serves static content and requires no robot credentials.
Evidence: hrsdk_configs/main.yaml, development Compose, CLI constants/start logic, console config, WebUI main, browser audio bridge and tools server.