Plan your deployment

Day 0 is everything you decide before the first firewall connects. Most choices are easy to change later. Three are not: the hostname agents dial, the token pepper, and whether you use NATS TLS. Decide those now.

The network flows

fig. — network flows for a typical install

From	To	Port	When	Notes
Admins’ browsers	Reverse proxy	443	Always	HTTPS for the web UI and API
Reverse proxy	pfCentral	2808	Always	Plain HTTP on a private network
Firewalls	pfCentral	24222	Always	NATS. One long-lived TCP connection per firewall
Firewalls	Reverse proxy	443	At enrollment	POST /enroll and, with TLS, GET /nats-ca.crt
Firewalls	GitHub	443	At install and upgrade	Downloads the package and agent. See offline installs.
pfCentral	PostgreSQL	5432	Always
pfCentral	SMTP relay or email API	587, 465 or 443	Optional	Only with email delivery

Nothing connects to a firewall.

Checklist

1. Where the server runs

Option	Good for
Docker Compose on one VM	Most installs
Kubernetes with one replica	Teams that already run Kubernetes
Kubernetes with several replicas	High availability. Needs an external NATS broker.

The server is a single Go binary. It needs little CPU or memory: most of its work is passing small messages. PostgreSQL can be a managed service or a container.

2. The names agents dial

Agents store two addresses: the NATS URL (for example tls://pf.example.com:24222) and the enroll URL (https://pf.example.com/enroll). Changing them later means touching every firewall. Use a DNS name you control, not an IP address.

If firewalls reach the server across the internet, publish port 24222 on a public address. If they reach it over a VPN or MPLS, use the internal name.

3. TLS on the agent link

Agents talk to NATS in plain text unless you turn on TLS. Turn it on for any link you do not fully trust, including site-to-site VPNs you do not run. You need to list every name agents dial in PFCENTRAL_NATS_TLS_HOSTS before the first start with TLS. See TLS for the agent link.

4. HTTPS for people

The server speaks plain HTTP only. Put a reverse proxy (Caddy, nginx, Traefik, a cloud load balancer) in front for HTTPS. See HTTPS for the web UI.

5. Secrets

Generate these once and store them in your secret manager:

Secret	Generate with	Notes
Token pepper	openssl rand -hex 32	Set PFCENTRAL_TOKEN_PEPPER_CURRENT and PFCENTRAL_TOKEN_PEPPER_VERSIONS to the same value. Never change it without the rotation procedure.
Database password	your usual tool	Goes in PFCENTRAL_DATABASE_URL.
Email encryption key	openssl rand -base64 32	Only with email delivery.
First owner password	your usual tool	Only for headless installs with PFCENTRAL_SUPERUSER_*.

Set the pepper before the first start

If you leave the pepper unset, pfCentral uses a well-known default. Changing it later without keeping the old value locks out every firewall and API token at once.

6. The first owner

Two ways:

• Interactive (default): the server prints a one-time setup link on first start. Open it and create the owner.
• Headless: set PFCENTRAL_SUPERUSER_EMAIL and PFCENTRAL_SUPERUSER_PASSWORD (12 characters or more). The server creates the owner on first start and prints no link. Good for Terraform or Ansible.

7. Backups

Plan backups of the database and the state volume together from the start. See Back up and restore.

8. Monitoring

pfCentral serves Prometheus metrics for every firewall at /metrics. Decide whether you will scrape it. See Watch fleet health.

Embedded or external NATS?

 Embedded (default)                         External
 ┌───────────────────────────┐              ┌───────────────┐     ┌────────────────────┐
 │ pfCentral                 │              │ pfCentral ×N  │────▶│ your NATS cluster  │
 │  ├ web UI + API           │              │ (stateless)   │     │ or Synadia Cloud   │
 │  └ NATS broker :24222 ◀───┼── agents     └───────────────┘     └─────────▲──────────┘
 └───────────────────────────┘                                              └── agents

	Embedded	External
Setup	Nothing to do	You provision an account, keys and creds with nsc or your provider
Replicas	One	Many
TLS	Built-in, self-signed CA	Your broker’s TLS
Online detection	Instant on disconnect, 15 s on loss	15 s (no $SYS access)

Start with embedded unless you already run NATS or need more than one server replica.

Next

• Docker and Compose
• Kubernetes