---
title: "Prepare the server network"
description: "Allow the outbound connections Alpamon and Alpacon clients need. Check workspace, download, proxy, and firewall destinations before restricting server traffic."
---

> Full documentation index: https://docs.alpacax.com/llms.txt

# Prepare the server network

<span id="infrastructure-configuration-guide" />
# Prepare the server network

Guide for securely configuring Alpacon in enterprise environments.

## Firewall configuration

### Server systems

Alpacon agents use outbound HTTPS/WSS connections. If you have whitelist-based firewall or proxy on server systems, you need to allow outbound connections to the following destinations.

| Domain | Purpose | Required | Notes |
|--------|---------|----------|-------|
| `https://<workspace>.<region>.alpacon.io` | Core features | Required | Workspace name and region vary by setup |
| `https://api.github.com` | Latest release lookup | When checking or installing the latest release | A Linux package-manager upgrade can continue without this lookup |
| `https://github.com` | Agent install and update downloads | Required on Windows and macOS | Linux installs and updates through the package repository |
| `https://release-assets.githubusercontent.com`, `https://objects.githubusercontent.com` | GitHub release asset downloads | Required for applicable Windows and macOS downloads | GitHub may redirect release downloads to these hosts |
| `https://s3.*` | WebFTP uploads/downloads | Optional | Optional if not using WebFTP features |

If you don't allow these domains, you may not be able to use full Alpacon features. Allow only the destinations your workspace and installation path require. Review third-party download domains against your organization's network policy.

#### Using proxy systems (Optional)

Alpamon 2.8.5 and later connect through the proxy set in the `HTTPS_PROXY` or `HTTP_PROXY` variable of the agent's service, and reach the hosts listed in `NO_PROXY` directly. Setting these variables with `export` in a shell has no effect on the agent. See [Proxy support](/learn/security/network/#proxy-support) to set them for the agent's service.

### Client systems

Alpacon clients (Web/CLI) use outbound HTTPS/WSS connections. If you have whitelist-based firewall or proxy on client systems, allow outbound connections to:

| Domain | Purpose | Required | Notes |
|--------|---------|----------|-------|
| `https://alpacon.io` | Core features | Required | |
| `https://<workspace>.<region>.alpacon.io` | Core features | Required | Workspace name and region vary by setup |
| `https://auth.alpacon.io` | Authentication | Required | |
| `https://portal.alpacax.com` | Profile | Required | |
| `https://pay.alpacax.com` | Payment | Optional | Only for billing managers |
| `https://s3.*` | WebFTP uploads/downloads | Optional | Optional if not using WebFTP features |

## Security considerations

### Transitioning from SSH to Alpacon

With Alpacon, you transition from perimeter-based port protection to zero-trust approach.

#### Recommended actions

1. **Block SSH port**
   - Block user access to port 22
   - Keep only emergency access
   - Simplify firewall configuration

2. **Restrict direct SSH access**
   ```bash
   # /etc/ssh/sshd_config example
   PermitRootLogin no
   PasswordAuthentication no
   PubkeyAuthentication no  # For Alpacon-only systems
   AllowUsers emergency-admin  # Allow only emergency accounts
   ```

3. **Remove VPN dependency**
   - VPN access to internal network with unlimited server access is a security threat
   - Complex VPNs or jump hosts reduce visibility
   - Simplify access with Alpacon single platform

### Security best practices

#### 1. Principle of least privilege

- Allow access only to necessary servers per user
- Use group-based permission management
- Regular permission reviews

#### 2. Audit logging

Every workspace records audit events automatically.

1. Review activity under **Audit** → **Events** (Websh, sudo, commands, files)
2. Set up notifications for privileged operations in your workspace **Settings**

#### 3. Mandatory MFA

Configure MFA policies in [Policies > Authentication](/use/workspace/settings/#authentication) (Superuser only):

1. Go to **Policies** → **Authentication**
2. Enable **MFA enforced** for all users
3. Select the allowed MFA methods (hardware security key, biometric, one-time password). With biometric or hardware security key allowed, a passkey sign-in also counts as MFA; see [Passkeys and allowed MFA methods](/use/workspace/settings/#passkeys-and-allowed-mfa-methods)
4. Set the **MFA timeout** for how long a verification stays valid

<span id="high-availability-configuration" />

## Region and service interruptions

<span id="regional-configuration" />

### Choose a region

Choose a hosted region when the workspace is created. The region cannot be changed afterward, so consider where your team and servers work.

| Region | Endpoint | Typical audience |
| --- | --- | --- |
| US1 | `*.us1.alpacon.io` | Americas and Europe |
| AP1 | `*.ap1.alpacon.io` | Asia-Pacific |

<span id="availability-posture" />
<span id="disaster-recovery" />

### During an interruption

Your servers keep running if Alpacon is unavailable. Agents reconnect when the service returns. An existing session may reconnect while its access window remains valid; new work that needs an Alpacon decision waits for recovery. Check [service status](https://status.alpacax.com) for current and past incidents. Keep your own emergency access route if your operations require one.

## Compliance

### Regulatory compliance readiness

Alpacon follows industry-standard frameworks and best practices:

- **SOC 2 framework**: Audit preparation is underway and currently in the internal-audit stage
- **ISO 27001 alignment**: Security controls aligned with ISO 27001 standards
- **GDPR compliance**: Data handling practices designed to support GDPR requirements (EU customers)
- **HIPAA readiness**: Infrastructure designed with healthcare industry requirements in mind

### Data residency

- Workspace data and core service records are primarily stored in the selected region
- Alpacon AI processing may occur in South Korea
- Customer-controlled cloud and on-premises deployments are available with Alpacon Enterprise
- See [Data security](/learn/security/data-security/) for processing-location and deployment details

## Troubleshooting

### Connection issues

| Symptom | Cause | Solution |
|---------|-------|----------|
| Agent offline | Firewall blocking | Allow outbound HTTPS/WSS |
| Intermittent disconnections | Proxy timeout | Adjust proxy keepalive settings |
| Slow response | Region distance | The region is fixed at creation; write to [support@alpacax.com](mailto:support@alpacax.com) |

### Log checking

```bash
# Agent logs
sudo systemctl status alpamon
sudo journalctl -u alpamon -n 50
```

## Migration checklist

Checklist for transitioning from SSH to Alpacon:

- [ ] Install Alpacon agent on all servers
- [ ] Invite users to Alpacon workspace
- [ ] Configure groups and permissions
- [ ] Configure MFA policy
- [ ] Update firewall rules
- [ ] Block SSH port 22 (except emergency)
- [ ] Configure audit logging
- [ ] Establish backup and recovery procedures
- [ ] Conduct team training

## Related documentation

- [How Alpacon works](/learn/how-it-works/)
- [Zero trust](/learn/key-concepts/zero-trust/)
- [Security configuration](/learn/best-practices/security/)
- [Monitoring strategy](/learn/best-practices/monitoring/)

Source: https://docs.alpacax.com/use/servers/configure-network/