Ports
The four ports of a node, which protocol they speak and who should reach each one.
| Port | Option | Protocol | Who reaches it |
|---|---|---|---|
| 27017 | --port | MongoDB wire protocol with TLS | Your applications, mongosh and the tools |
| 27100 | --peer-listen | Mutual TLS 1.3 between nodes | Only the other nodes |
| 27200 | --admin-listen | HTTPS: teseladb admin, /metrics and /healthz | Operations, metrics and load balancers |
| 27080 | --http-port | HTTPS: REST API at /v1 and MCP at /mcp | Applications and agents that use HTTP |
What each one asks for
- 27017: TLS always, and a user except with
--insecure. - 27100: a node certificate signed by the cluster CA.
- 27200:
/healthzwith no credentials;/metricswith a certificate of a user withclusterMonitor; the administration commands withclusterAdmin. - 27080: client certificate, OIDC token or API key.
--http-port 0turns it off.
By default all four listen on 127.0.0.1; change the addresses when deploying on several machines.