Skip to content

Adding gRPC / polling Tentacles over HTTPS information to existing documentation #3205

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
briggs-octo merged 11 commits into from
Jun 11, 2026
+14 −13
Merged

Adding gRPC / polling Tentacles over HTTPS information to existing documentation #3205

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
5186d91
Adding gRPC port to inbound port table
briggs-octo Jun 10, 2026
bb7b525
Adding initial Tentacle registration note to table for port 443
briggs-octo Jun 10, 2026
cf77426
Adding Polling Tentacles over HTTPS to HTTPS/port 443 row
briggs-octo Jun 10, 2026
5140aec
Adding KLOS to installation components ports section
briggs-octo Jun 10, 2026
613ca8f
Update mod date
briggs-octo Jun 10, 2026
5990ca5
Updating mod date
briggs-octo Jun 10, 2026
0240b13
Updating wording for TCP 443 row
briggs-octo Jun 11, 2026
777e0f1
Fixing linter errors
briggs-octo Jun 11, 2026
7cda0e4
Merge branch 'main' into briggs-octo-grpc-updates
briggs-octo Jun 11, 2026
91dd813
Fixing spellcheck error
briggs-octo Jun 11, 2026
c661ba5
Fixing linter error
briggs-octo Jun 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/pages/docs/installation/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
layout: src/layouts/Default.astro
pubDate: 2023-01-01
modDate: 2024-05-01
modDate: 2026-06-10
title: Install Octopus Server
subtitle: How to install Octopus Server
icon: fa-solid fa-server
Expand Down Expand Up @@ -31,7 +31,7 @@ Relevant ports include:
- **Inbound** port 8080: Container Host - service / load balancer to container
- **Inbound** port 443/80 (http/https): Windows Host - load balancer to Windows Server
- **Inbound** port 10943: Polling tentacles (Octopus Deploy agents) running on application hosts or runners (workers).
- **Inbound** port 8443 (gRPC): Octopus Deploy Argo CD Gateway
- **Inbound** port 8443 (gRPC): Octopus Deploy Argo CD Gateway and Kubernetes Live Object Status
- **Outbound** port 10933: Listening tentacles (Octopus Deploy agents) running on application hosts or runners (workers).
- **Outbound** port 22 (SSH): For application hosts or runners (workers).

Expand Down
23 changes: 12 additions & 11 deletions src/pages/docs/security/hardening-octopus.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
layout: src/layouts/Default.astro
pubDate: 2023-01-01
modDate: 2023-10-04
modDate: 2026-06-10
title: Hardening Octopus
description: If you are hosting Octopus Deploy yourself, this guide will help you harden your network, host operating system, and Octopus Server itself. This includes things such as configuring malware protection (antivirus), and using allow lists.
navOrder: 10
Expand Down Expand Up @@ -45,7 +45,7 @@ Depending on your familiarity with Octopus Server, or SQL Server, or networking,

### Upgrade to the latest version

Generally speaking, the latest available version of Octopus Server will be the most secure. You should consider a strategy for keeping Octopus Server updated. We follow a [responsible disclosure policy](#disclosure-policy) so it is possible for you to be aware of any known issues which affect the security and integrity of your Octopus Server.
Generally speaking, the latest available version of Octopus Server will be the most secure. You should consider a strategy for keeping Octopus Server updated. We follow a [responsible disclosure policy](https://octopus.com/security/disclosure) so it is possible for you to be aware of any known issues which affect the security and integrity of your Octopus Server.

### Securely expose your Octopus Server

Expand Down Expand Up @@ -150,7 +150,7 @@ All communication between Octopus Server and Tentacles is performed over a secur

#### Disable SSLv3, TLS 1.0 and 1.1 on Windows \{#disable-weak-tls-protocols-windows}

On Windows, the easiest way to disable weak versions of SSL and TLS are by using a tool like [IISCrypto](https://www.nartac.com/Products/IISCrypto) to change the Windows Registry.
On Windows, the easiest way to disable weak versions of SSL and TLS are by using a tool like [IISCrypto](https://www.nartac.com/Products/IISCrypto) to change the Windows Registry.

:::div{.problem}

Expand Down Expand Up @@ -198,14 +198,14 @@ Once the TLS versions are disabled, reboot your Server and importantly [verify t

On Ubuntu `20.04` using OpenSSL `1.1.1f` (the latest at time of writing), you can specify the minimum TLS version to use to be `TLSv1.2` by setting the `MinProtocol` directive in the `/etc/ssl/openssl.cnf` OpenSSL config file:

```
```text
[system_default_sect]
MinProtocol = TLSv1.2
```

On Ubuntu `18.04`, if the `MinProtocol` directive doesn't work, you can try this alternative. When using OpenSSL `1.1.1` (the latest at time of writing), you can specify the available TLS Protocols explicitly in the `/etc/ssl/openssl.cnf` OpenSSL config file:

```
```text
[system_default_sect]
Protocol = -SSLv3, -TLSv1, -TLSv1.1, TLSv1.2
```
Expand Down Expand Up @@ -320,10 +320,11 @@ The TCP ports listed below are defaults, and can be changed if required - refer
|Name|Type|Source|Target|Allow/Deny|Description|
|---|---|---|---|---|---|
|HTTP|`TCP 80`|Users|Octopus Server|ALLOW|We recommend only using HTTPS over SSL, however it can be convenient to allow HTTP for the initial connection which is then forced to HTTPS over SSL.|
|HTTPS|`TCP 443`|Users, Polling Tentacles, external services|Octopus Server|ALLOW|Required for HTTPS over SSL. Also required if using [Polling Tentacles](/docs/infrastructure/deployment-targets/tentacle/tentacle-communication/#polling-tentacles) over [Web Sockets](/docs/infrastructure/deployment-targets/tentacle/windows/polling-tentacles-web-sockets).|
|HTTPS|`TCP 443`|Users, Polling Tentacles, external services|Octopus Server|ALLOW|Required for HTTPS over SSL. Also required for initial Tentacle registration and if using [Polling Tentacles](/docs/infrastructure/deployment-targets/tentacle/tentacle-communication/#polling-tentacles) over [Web Sockets](/docs/infrastructure/deployment-targets/tentacle/windows/polling-tentacles-web-sockets) or [Polling Tentacles over HTTPS](/docs/infrastructure/deployment-targets/tentacle/polling-tentacles-over-port-443).|

@scme0 scme0 Jun 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
|HTTPS|`TCP 443`|Users, Polling Tentacles, external services|Octopus Server|ALLOW|Required for HTTPS over SSL. Also required for initial Tentacle registration and if using [Polling Tentacles](/docs/infrastructure/deployment-targets/tentacle/tentacle-communication/#polling-tentacles) over [Web Sockets](/docs/infrastructure/deployment-targets/tentacle/windows/polling-tentacles-web-sockets) or [Polling Tentacles over HTTPS](/docs/infrastructure/deployment-targets/tentacle/polling-tentacles-over-port-443).|
|HTTPS|`TCP 443`|Users, Polling Tentacles, external services|Octopus Server|ALLOW|Required for HTTPS over SSL. Also required for initial Tentacle registration if using [Polling Tentacles](/docs/infrastructure/deployment-targets/tentacle/tentacle-communication/#polling-tentacles) over [Web Sockets](/docs/infrastructure/deployment-targets/tentacle/windows/polling-tentacles-web-sockets) or [HTTPS](/docs/infrastructure/deployment-targets/tentacle/polling-tentacles-over-port-443).|

As far as I'm aware it's not required for Listening Tentacles because you register them on Octopus manually. You need to do this because Octopus generates the thumbprint. It's been a little while since I've setup a listening tentacle though.

@briggs-octo briggs-octo Jun 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, you do need access to port 443 for Listening Tentacles as well. I was trying to figure out the best way to word that, which is why I had put Tentacle registration AND Polling Tentacles over websockets/HTTPS. This is needed for Listening Tentacles because of the register-with command, like we show in our automation script here:

https://octopus.com/docs/infrastructure/deployment-targets/tentacle/windows/automating-tentacle-installation#AutomatingTentacleinstallation-Example-ListeningTentacle

|Polling Tentacle|`TCP 10943`|Polling Tentacles|Octopus Server|ALLOW|Required when using [Polling Tentacles](/docs/infrastructure/deployment-targets/tentacle/tentacle-communication/#polling-tentacles) via TCP as deployment targets or external workers.|
|SSH|`TCP 22`|Octopus Server|SSH deployment targets|ALLOW|Allows Octopus Server to securely connect to any SSH deployment targets.|
|RDP|`TCP 3389`|Remote Desktop Users|Octopus Server|ALLOW|Allows your system administrators to perform maintenance tasks on your Octopus Server.|
|gRPC|`TCP 8443`|Kubernetes Live Object Status (KLOS)/ArgoCD Gateway|Octopus Server|ALLOW|Required for Kubernetes Live Object Status (KLOS)/ArgoCD Gateway|
|All inbound|`ALL`|Anywhere|Octopus Server|DENY|Prevent any other unwanted inbound traffic.|

### Outbound rules
Expand All @@ -340,19 +341,19 @@ The TCP ports listed below are defaults, and can be changed if required - refer

## Harden your containers

If you run an [Octopus Deploy container](/docs/installation/octopus-server-linux-container), in addition to your usual security measure for running apps out of containers, take the following steps to secure it:
If you run an [Octopus Deploy container](/docs/installation/octopus-server-linux-container), in addition to your usual security measure for running apps out of containers, take the following steps to secure it:

- Move your Docker data directory (the default location is `/var/lib/docker`) so that your containers are stored on a separate partition.
- Move your Docker data directory (the default location is `/var/lib/docker`) so that your containers are stored on a separate partition.
- Assign resources carefully:
- Consider pinning CPUs to namespaces in order to give them a boundary.
- Consider the amount of memory required, if you assign too much the container is susceptible to denial of service attacks, but if you assign too little or make use of memory ballooning performance will be impacted.
- Consider pinning CPUs to namespaces in order to give them a boundary.
- Consider the amount of memory required, if you assign too much the container is susceptible to denial of service attacks, but if you assign too little or make use of memory ballooning performance will be impacted.
- Consider which containers reside in each network namespace as all processes in a namespace can talk to the namespace interface.

The security of your Linux container host and its Docker configuration can be analyzed in detail by using [Docker Bench for Security](https://github.com/docker/docker-bench-security) from the [Center for Internet Security](https://www.cisecurity.org/about-us/). For more generalized advice for your platform they provide their benchmarks as [PDF documents](https://www.cisecurity.org/benchmark/docker/).

## Samples

We have an [Octopus Admin](https://oc.to/OctopusAdminSamplesSpace) Space on our Samples instance of Octopus. You can sign in as `Guest` to take a look at some examples of how we have used Octopus for hardening tasks.
We have an [Octopus Admin](https://oc.to/OctopusAdminSamplesSpace) Space on our Samples instance of Octopus. You can sign in as `Guest` to take a look at some examples of how we have used Octopus for hardening tasks.

## Getting help

Expand Down