Self-hosting
Networking
Understand the harness, webhook, and companion network boundaries.
Dash Bot separates its network surfaces by trust level.
| Surface | Default bind | Purpose |
|---|---|---|
| Harness | 127.0.0.1:8799 | Full app API and event stream |
| Webhook receiver | 127.0.0.1:8800 | Health and secret hook endpoints only |
| Companion sidecar | 0.0.0.0:8810 when enabled | Paired-device, token-authenticated allowlist |
| Companion control | 127.0.0.1:8811 | Pairing and device administration |
Remote access
Use the companion sidecar rather than exposing the harness. Tailscale is the recommended remote route because it encrypts and authenticates the network path without making the machine public.
For webhook delivery, proxy only the dedicated webhook receiver. Never forward the main harness port to the public internet.
Port overrides
Source and advanced deployments can change documented ports with the relevant environment settings. When the default harness port is occupied, packaged builds may fall back to another local port and communicate the selected address internally.