Deployment Components

FinClaw Microservices

Process	Service	Port (Internal)	Notes
api-gateway	API Gateway	HTTP/26100	The single external port - TLS termination, JWT validation, rate limiting, CSP; the unified entry for frontend, SDK, and admin console.
identity-service	Identity Service	HTTP/26101	Authentication, JWT issuance, session management, and multi-tenant identity.
orchestrator	Flow Orchestrator	HTTP/26102	Interprets YAML flow definitions; threads intent classification, context assembly, LLM calls, and delivery.
ag-ui-server	AG-UI Gateway	HTTP/26103	AG-UI / SSE streaming gateway for chat clients.
persona-service	Persona Service	HTTP/26104	Onboarding personas, role templates, persona upload management.
skill-service	Skill Service	HTTP/26105	Skill catalog, installation, review, and platform-skill management.
claw-fleet-manager	Claw Runtime Manager	HTTP/26107 + dynamic 26463-26549	Lifecycle management of claw runtime instances; the dynamic port range is occupied by per_tenant_instance via docker run -p; claw-fleet-manager itself does not map the range in compose. Default-stack member (identity-service and ai-infra-rs depend on its routing endpoint); the profile label is kept only for explicitly starting the single service.
a2a-gateway	A2A Gateway	HTTP/26108	A2A protocol entry, for external Agent interconnection scenarios.
auth-fabric-proxy	Authentication Proxy	HTTP/26109	Profile gated (auth-fabric profile); front authentication proxy.
conversation-store	Conversation Store	HTTP/26200	WORM append-only conversation store on TimescaleDB + NATS.
delivery	Delivery Service	HTTP/26201	Delivery coordinator across inbox / SSE / push.
inbox-service	Inbox Service	HTTP/26202	Reliable inbox storage.
push-service	Push Service	HTTP/26203	Push notifications via APNs / vendor channels.
document-service	Document Service	HTTP/26205	Document API backed by workspace volumes.
ai-infra-rs	AI Runtime	HTTP/26450 + 26451	Main AI backend (Rust) for inference, tool invocation, memory, and scheduling hooks; 26451 is the Restate endpoint for Restate Server handler callbacks.
searxng	Metasearch engine	HTTP/26118	SearXNG metasearch for ai-infra-rs web search (AI_INFRA_RS_WEB_SEARCH_SEARXNG_URL / _LANGUAGE); healthcheck path is /healthz.
feishu-connector	Feishu Connector	HTTP/26460	Feishu / Lark channel connector.
dingtalk-connector	DingTalk Connector	HTTP/26462	DingTalk Stream Mode channel connector.
doc-toolkit	Document Toolkit Worker	HTTP/26461	Resident document processing (fetch / extract / validate / export).
wecom-connector	WeCom Connector	HTTP/26550	WeCom channel connector.
auth-fabric	Authentication Service	HTTP/26115	Profile gated (auth-fabric profile); provides enterprise authentication capabilities.

Infrastructure Services

Process	Service	Port (Internal)	Notes
postgres	Relational DB	TCP/26110	PostgreSQL, hosts platform schemas (identity / inbox / persona / skill / document, etc.).
timescaledb	Time-Series DB	TCP/26111	TimescaleDB, hosts conversation-store session history.
nats	Message Bus	TCP/26112, 26113	NATS JetStream, cross-service events and reliable delivery; 26113 is the monitoring UI/API.
redis	Cache & Coordination	TCP/26114	Cache, coordination state, rate-limit counters.
tei	Text Embeddings	HTTP/26117	Text Embeddings Inference, vector generation.
restate	Workflow Engine	HTTP/26180, 26181	Durable timers and cron for ai-infra-rs; 26181 is the admin API.

K8s port difference: restate has different defaults in Docker Compose and Kubernetes - compose uses 26180 (ingress) / 26181 (admin), K8s defaults to 26180 (ingress) / 26182 (admin).

Operations Infrastructure

Name	Category	Port	Description
CentOS 8+ / RHEL 8+ / Ubuntu 22.04+	Operating System	-	Base OS, X86_64; domestic Linux distributions need to be evaluated against the matching RHEL/Ubuntu baseline.
Docker Engine 24+	Container Engine	-	All services run as Docker containers in single-machine mode.
Docker Compose v2	Container Orchestration	-	Single-machine mode uses docker-compose.yml + fleet.sh for unified orchestration.
Prometheus / Grafana	Monitoring	Internal / multiple	Optional, dashboards and alerting.
Vector + Kafka + ES + Kibana / Loki + Grafana	Logging	Internal / multiple	Optional, cluster-scale log aggregation.

Request Paths

• Inbound conversation: api-gateway -> ag-ui-server -> orchestrator -> ai-infra-rs -> delivery -> (inbox-service / push-service / AG-UI stream)

See Architecture Overview for the overall architecture and deployment modes.

Port Planning Notes

• claw-fleet-manager dynamically occupies the 26463-26549 port range; firewall and K8s NodePort planning must reserve it. The range is consumed by per_tenant_instance via docker run -p <port>:<port> and is not explicitly mapped in compose.
• restate ports differ between Docker Compose and K8s defaults (compose 26180/26181, K8s 26180/26182).
• ai-infra-rs listens on both 26450 (main service) and 26451 (Restate endpoint); both must be opened in the firewall and K8s Service.
• dingtalk-connector (26462) uses Stream Mode and must maintain a long connection to the DingTalk open platform; wecom-connector (26550) and feishu-connector (26460) must be opened per each channel's callback requirements.