Network Guidelines
This document lists the firewall, proxy, and TLS settings your IT team should review before Ouva goes live. All traffic is outbound only over TLS 1.2 or higher. No inbound ports are required.
Required Outbound Connectivity
Section titled “Required Outbound Connectivity”| Service / Function | Domains to Allow | Port | Protocol |
|---|---|---|---|
| Ouva Web App (hosted on Netlify) | app.ouva.co (CNAME -> Netlify CDN) | 443 | HTTPS |
| Supabase Auth & Database API | *.supabase.co | 443 | HTTPS & WebSocket |
| MediaPipe model assets (camera scenes only) | storage.googleapis.com | 443 | HTTPS |
| MediaPipe runtime assets (camera scenes only) | cdn.jsdelivr.net | 443 | HTTPS |
| Stripe billing and customer profile | js.stripe.com, api.stripe.com | 443 | HTTPS |
| ElevenLabs text-to-speech (if enabled) | api.elevenlabs.io | 443 | HTTPS |
Optional - Kiosk Support and Operations
Section titled “Optional - Kiosk Support and Operations”| Service | Domains | Port | Protocol |
|---|---|---|---|
| Remote support tools (if used by your facility) | Vendor-specific (for example anydesk.com) | 443 | HTTPS |
TLS & Proxy Notes
Section titled “TLS & Proxy Notes”- Endpoints insist on TLS 1.2+; SSL-inspection appliances must supply certificates trusted by browsers/kiosks.
- Supabase real-time channels use WebSockets on port 443; proxies must honor the
Upgradeheader. - There is no inbound connectivity requirement.
Bandwidth
Section titled “Bandwidth”- Initial scene loads can require tens of MB depending on the selected experience and assets.
- Browser caching reduces repeat transfer for frequently used scenes.
- Video-wall kiosks that cycle scenes frequently should be provisioned for sustained outbound HTTPS traffic.
Time Synchronization
Section titled “Time Synchronization”Supabase session handling depends on accurate device time. Keep kiosk and user devices synchronized with NTP (internal source or pool.ntp.org).
Software Updates
Section titled “Software Updates”- Recommended browser: current Google Chrome (standard mode or kiosk mode).
- Keep browser and OS updates current for security and graphics performance.
- Keep outbound HTTPS available during maintenance windows so kiosks can pick up frontend updates.
Once these items are in place, both browser users and always-on kiosk deployments can operate without additional inbound network changes.
For a complete telemetry and egress breakdown (types, data elements, triggers, and controls), see Telemetry & Data Egress.