CellarCellar
Architecture

Ports & sockets

Default listeners, authentication, and purpose

ListenerDefaultAuthPurpose
Unix socket/var/run/cellar/cellar.sockLocal FS permissionsInit, Join, JoinToken, Status, api-key …, node …, local sandbox ops
Remote gRPC:17946Bootstrap insecure TLS + token digest; else mTLS or API key (SandboxAPI)CA issue/renew, raft membership, public sandbox client API
Gateway HTTP:8080API key (Authorization: Bearer / X-Api-Key); terminate TLS at ALB/proxyPublic JSON API for apps (cellar-gateway)
Raft TCP127.0.0.1:17947Manager networkConsensus / CA key replication

Roles

Manager and worker roles in a Cellar cluster

Cluster CA (HA)

How the Raft-replicated RootCA works across managers