From ddd10703b06d69ff95483e4001fc7be09161c01d Mon Sep 17 00:00:00 2001 From: Robert Lin Date: Tue, 13 Oct 2026 04:04:00 +0000 Subject: [PATCH 01/10] docs: Document services gateway outbound allowlisting Keep older and custom endpoints and link credits connectivity to canonical network requirements for upcoming 8.1. Amp-Thread-ID: https://ampcode.com/threads/T-26fae6b7-6e69-4053-9d3d-7b5c04f2cebc Co-authored-by: Amp --- docs/admin/enterprise-portal.mdx | 2 ++ docs/admin/pings.mdx | 10 ++++++---- docs/admin/telemetry/index.mdx | 4 +--- docs/self-hosted/private-network.mdx | 30 ++++++++++++++++++++++++++++ 4 files changed, 39 insertions(+), 7 deletions(-) diff --git a/docs/admin/enterprise-portal.mdx b/docs/admin/enterprise-portal.mdx index ef949b0f1..72725836d 100644 --- a/docs/admin/enterprise-portal.mdx +++ b/docs/admin/enterprise-portal.mdx @@ -37,6 +37,8 @@ Subscription admins can view [Sourcegraph Analytics](/analytics) for the subscri Subscription admins can view credit balances and rates for metered services, including [Deep Search](/deep-search) and [Agentic Batch Changes](/agentic-batch-changes), on the **Credits** page. This replaces the former Deep Search usage monitoring page and shows subscription-wide consumption, not an individual user's usage. +Self-hosted instances need outbound connectivity to Enterprise Portal for credit/quota checks and consumption reporting, including when using your own LLM provider. Before using metered services, configure the [required outbound access](/self-hosted/private-network#outbound-access-to-sourcegraph-services), including IP allowlisting if your network restricts egress. The upcoming 8.1 release routes these instance-to-service interactions through the services gateway by default; this does not change how you access the Credits page in your browser. + 1. [Sign in to Enterprise Portal](#accessing-sourcegraph-enterprise-portal) as a subscription admin. 2. Select your subscription. 3. Select **Credits** in the subscription navigation. diff --git a/docs/admin/pings.mdx b/docs/admin/pings.mdx index 867d0d661..38acbcb7b 100644 --- a/docs/admin/pings.mdx +++ b/docs/admin/pings.mdx @@ -1,6 +1,6 @@ # Pings -Sourcegraph periodically sends a ping to `pings.sourcegraph.com` to help our product and customer teams. It sends only the high-level, aggregated data below. It never sends code, repository names, usernames, or any other specific data. To learn more, go to the **Administration > Pings** page on your instance (the URL is `https://sourcegraph.example.com/site-admin/pings`). +Sourcegraph periodically sends a ping to help our product and customer teams. The default destination is `pings.sourcegraph.com` in older releases and `services.sourcegraph.com` in the upcoming 8.1 release. It sends only the high-level, aggregated data below. It never sends code, repository names, usernames, or any other specific data. To learn more, go to the **Administration > Pings** page on your instance (the URL is `https://sourcegraph.example.com/site-admin/pings`). Sourcegraph will also periodically perform a license verification check, to verify the validity of the configured Sourcegraph license. Tampering with these checks, or preventing them from occurring, will cause Sourcegraph to disable many features until a successful check is completed. Certain Enterprise licenses can request to be exempt from these license verification checks. @@ -202,7 +202,7 @@ Sourcegraph aggregates usage and performance metrics for some product features i ## Allowlist IPs / CIDR Ranges for Sourcegraph -Refer to the [Telemetry docs](/admin/telemetry) for the list of ranges to allowlist. +Refer to [outbound access to Sourcegraph services](/self-hosted/private-network#outbound-access-to-sourcegraph-services) for the destinations, ports, and protocols to allow. ## Using an HTTP proxy for ping requests @@ -212,15 +212,17 @@ Be sure to update the environment variable like so : `TELEMETRY_HTTP_PROXY:"http ## Connections to Sourcegraph-managed services -Sourcegraph only connects to Sourcegraph-managed services for three purposes: +Connections to Sourcegraph-managed services include: 1. The pings described above are sent, in order to: - Check for new product updates. - Send [anonymous, non-specific, aggregate metrics](#pings) back to Sourcegraph.com (see the full list above). 1. [Verify](/admin/licensing/) the validity of the configured Sourcegraph license. +1. Export [telemetry events](/admin/telemetry). +1. Check credit/quota availability and report consumption to [Enterprise Portal](/admin/enterprise-portal#credits). 1. Legacy Sourcegraph extensions are fetched from Sourcegraph.com`s extension registry. -There are no other automatic external connections to Sourcegraph.com (or any other site on the internet). +Other enabled features may require additional external destinations; see [private network configuration](/self-hosted/private-network). ## Connections to Sourcegraph.com via Cody app diff --git a/docs/admin/telemetry/index.mdx b/docs/admin/telemetry/index.mdx index 79c78d1cf..3326f8f96 100644 --- a/docs/admin/telemetry/index.mdx +++ b/docs/admin/telemetry/index.mdx @@ -47,9 +47,7 @@ You can reach out to support@sourcegraph.com for additional information about ho ## Allowlist IPs / CIDR ranges for Sourcegraph -- For `pings.sourcegraph.com`, allowlist the IP address: `34.36.231.254` -- For `telemetry-gateway.sourcegraph.com`, allowlist the IP address: `34.107.157.31` -- For `sourcegraph.com`, allowlist the full [Cloudflare IP ranges](https://www.cloudflare.com/ips/) +See [outbound access to Sourcegraph services](/self-hosted/private-network#outbound-access-to-sourcegraph-services) for the single-IP services gateway requirements in the upcoming 8.1 release, and the destinations to retain for older releases or custom endpoints. ## Architecture diff --git a/docs/self-hosted/private-network.mdx b/docs/self-hosted/private-network.mdx index bf77f6df0..e92d41bfc 100644 --- a/docs/self-hosted/private-network.mdx +++ b/docs/self-hosted/private-network.mdx @@ -24,6 +24,36 @@ The following is a list of Sourcegraph services that initiate outbound connectio - **worker**: Sourcegraph Worker background jobs that may require establishing connections to services hosted within an organization's private network +## Outbound access to Sourcegraph services + +### Services gateway (upcoming 8.1 release) + +The upcoming Sourcegraph 8.1 release defaults to `https://services.sourcegraph.com` for Pings, Telemetry Gateway, and Enterprise Portal traffic, including license verification, credit/quota checks, and consumption reporting. The gateway infrastructure is available now, but older releases do not automatically switch to this endpoint. + +Allow outbound connections from your instance to **`34.36.231.254` on TCP port `443`**, with support for **HTTPS and HTTP/2 gRPC** through any firewall or proxy. Both `services.sourcegraph.com` and `pings.sourcegraph.com` resolve to this retained Pings IPv4 address. Keep the hostname in client configuration for TLS; do not replace it with the IP address. This is an outbound destination allowlist, not an inbound firewall rule. + +The services gateway is not Cloudflare-proxied, so this path does **not** require Cloudflare's shared IP ranges. This single IP covers only these service interactions, not code hosts, LLM providers, update/download artifacts, browser access to Enterprise Portal, or every Sourcegraph integration. Keep the destinations required by your other enabled features. + +### Custom endpoints + +In the upcoming 8.1 release, `SERVICES_GATEWAY_URL` sets the shared endpoint and defaults to `https://services.sourcegraph.com`. If you configure it, use an absolute HTTPS origin without credentials, a path, query, or fragment, and set it on each relevant frontend and worker deployment. These subsystem overrides take precedence for their respective traffic: + +- `UPDATE_CHECK_BASE_URL`: Pings/update checks. +- `ENTERPRISE_PORTAL_URL`: Enterprise Portal, including licensing and credit/consumption interactions. +- `TELEMETRY_GATEWAY_EXPORTER_EXPORT_ADDR`: Telemetry Gateway. + +Allow outbound access to any overridden destinations as well; the single-IP rule applies only to traffic using the default gateway. In 8.1, `LICENSE_CHECK_API_URL` is removed; use `ENTERPRISE_PORTAL_URL` for a custom Portal endpoint. An empty telemetry export address selects the gateway rather than disabling export. Production telemetry exemptions remain license-controlled. Authentication and protocols are unchanged, and user and organization metadata export remains opt-in. + +### Older releases and direct endpoints + +Until you upgrade to a release that uses the services gateway, retain the outbound rules for your existing destinations. These also apply when explicitly configured as overrides: + +- `pings.sourcegraph.com`: `34.36.231.254`. +- `telemetry-gateway.sourcegraph.com`: `34.107.157.31`. +- `sourcegraph.com`: the full [Cloudflare IP ranges](https://www.cloudflare.com/ips/), when required by your configured services. + +Keep access to your configured Enterprise Portal endpoint and any other custom endpoints. Do not remove those rules merely because the services gateway is available. + ## HTTP proxy configuration All Sourcegraph services respect the conventional `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables for From da513a36030e5032b8470c824fdeafb390ad2a75 Mon Sep 17 00:00:00 2001 From: Robert Lin Date: Tue, 13 Oct 2026 04:07:52 +0000 Subject: [PATCH 02/10] docs: Keep gateway guidance focused on public network requirements Amp-Thread-ID: https://ampcode.com/threads/T-26fae6b7-6e69-4053-9d3d-7b5c04f2cebc Co-authored-by: Amp --- docs/self-hosted/private-network.mdx | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/docs/self-hosted/private-network.mdx b/docs/self-hosted/private-network.mdx index e92d41bfc..1a1d436bb 100644 --- a/docs/self-hosted/private-network.mdx +++ b/docs/self-hosted/private-network.mdx @@ -30,23 +30,13 @@ The following is a list of Sourcegraph services that initiate outbound connectio The upcoming Sourcegraph 8.1 release defaults to `https://services.sourcegraph.com` for Pings, Telemetry Gateway, and Enterprise Portal traffic, including license verification, credit/quota checks, and consumption reporting. The gateway infrastructure is available now, but older releases do not automatically switch to this endpoint. -Allow outbound connections from your instance to **`34.36.231.254` on TCP port `443`**, with support for **HTTPS and HTTP/2 gRPC** through any firewall or proxy. Both `services.sourcegraph.com` and `pings.sourcegraph.com` resolve to this retained Pings IPv4 address. Keep the hostname in client configuration for TLS; do not replace it with the IP address. This is an outbound destination allowlist, not an inbound firewall rule. +Allow outbound connections from your instance to **`34.36.231.254` on TCP port `443`**, with support for **HTTPS and HTTP/2 gRPC** through any firewall or proxy. If your network also filters by hostname, allow `services.sourcegraph.com`. Both `services.sourcegraph.com` and `pings.sourcegraph.com` resolve to this retained Pings IPv4 address. Keep the hostname for TLS; do not replace it with the IP address. This is an outbound destination allowlist, not an inbound firewall rule. The services gateway is not Cloudflare-proxied, so this path does **not** require Cloudflare's shared IP ranges. This single IP covers only these service interactions, not code hosts, LLM providers, update/download artifacts, browser access to Enterprise Portal, or every Sourcegraph integration. Keep the destinations required by your other enabled features. -### Custom endpoints - -In the upcoming 8.1 release, `SERVICES_GATEWAY_URL` sets the shared endpoint and defaults to `https://services.sourcegraph.com`. If you configure it, use an absolute HTTPS origin without credentials, a path, query, or fragment, and set it on each relevant frontend and worker deployment. These subsystem overrides take precedence for their respective traffic: - -- `UPDATE_CHECK_BASE_URL`: Pings/update checks. -- `ENTERPRISE_PORTAL_URL`: Enterprise Portal, including licensing and credit/consumption interactions. -- `TELEMETRY_GATEWAY_EXPORTER_EXPORT_ADDR`: Telemetry Gateway. - -Allow outbound access to any overridden destinations as well; the single-IP rule applies only to traffic using the default gateway. In 8.1, `LICENSE_CHECK_API_URL` is removed; use `ENTERPRISE_PORTAL_URL` for a custom Portal endpoint. An empty telemetry export address selects the gateway rather than disabling export. Production telemetry exemptions remain license-controlled. Authentication and protocols are unchanged, and user and organization metadata export remains opt-in. - ### Older releases and direct endpoints -Until you upgrade to a release that uses the services gateway, retain the outbound rules for your existing destinations. These also apply when explicitly configured as overrides: +Until you upgrade to a release that uses the services gateway, retain the outbound rules for your existing destinations, including hostname rules where required: - `pings.sourcegraph.com`: `34.36.231.254`. - `telemetry-gateway.sourcegraph.com`: `34.107.157.31`. From b9403ddddae3523b24e4d018a898743bf48311bc Mon Sep 17 00:00:00 2001 From: Robert Lin Date: Tue, 13 Oct 2026 18:22:16 +0000 Subject: [PATCH 03/10] docs: Address services gateway review with timeless guidance Keep publication gated on 8.1, describe current behavior concisely, and record documentation conventions. Amp-Thread-ID: https://ampcode.com/threads/T-26fae6b7-6e69-4053-9d3d-7b5c04f2cebc Co-authored-by: Amp --- AGENTS.md | 14 ++++++++++++++ docs/admin/enterprise-portal.mdx | 2 +- docs/admin/pings.mdx | 10 +++++----- docs/admin/telemetry/index.mdx | 2 +- docs/self-hosted/private-network.mdx | 18 +++--------------- 5 files changed, 24 insertions(+), 22 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 99031fe40..a4db28c0b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,5 +1,19 @@ # Sourcegraph Docs - Agent Instructions +## Documentation style + +- Write long-lived feature and configuration docs in the present tense for the + behavior readers will use when the docs are published. Avoid time-relative + wording such as "upcoming", "new", or "now" that requires later cleanup. +- Keep docs for unreleased behavior in draft PRs until the release is available; + record the release dependency in the PR description, not in customer prose. +- Describe the current behavior concisely. Put release transitions and old/new + comparisons in upgrade notes rather than permanent feature docs. Retain + version-specific guidance only when readers still need it to use or upgrade + supported releases. +- Number ordered Markdown lists sequentially (`1.`, `2.`, `3.`), rather than + writing every item as `1.`. + ## Build Commands - **Type Check**: `npx tsc --noEmit` diff --git a/docs/admin/enterprise-portal.mdx b/docs/admin/enterprise-portal.mdx index 72725836d..479671de7 100644 --- a/docs/admin/enterprise-portal.mdx +++ b/docs/admin/enterprise-portal.mdx @@ -37,7 +37,7 @@ Subscription admins can view [Sourcegraph Analytics](/analytics) for the subscri Subscription admins can view credit balances and rates for metered services, including [Deep Search](/deep-search) and [Agentic Batch Changes](/agentic-batch-changes), on the **Credits** page. This replaces the former Deep Search usage monitoring page and shows subscription-wide consumption, not an individual user's usage. -Self-hosted instances need outbound connectivity to Enterprise Portal for credit/quota checks and consumption reporting, including when using your own LLM provider. Before using metered services, configure the [required outbound access](/self-hosted/private-network#outbound-access-to-sourcegraph-services), including IP allowlisting if your network restricts egress. The upcoming 8.1 release routes these instance-to-service interactions through the services gateway by default; this does not change how you access the Credits page in your browser. +Self-hosted instances need outbound connectivity to Enterprise Portal through the services gateway for credit/quota checks and consumption reporting, including when using your own LLM provider. Before using metered services, configure the [required outbound access](/self-hosted/private-network#outbound-access-to-sourcegraph-services), including IP allowlisting if your network restricts egress. 1. [Sign in to Enterprise Portal](#accessing-sourcegraph-enterprise-portal) as a subscription admin. 2. Select your subscription. diff --git a/docs/admin/pings.mdx b/docs/admin/pings.mdx index 38acbcb7b..1dbdcb9d4 100644 --- a/docs/admin/pings.mdx +++ b/docs/admin/pings.mdx @@ -1,6 +1,6 @@ # Pings -Sourcegraph periodically sends a ping to help our product and customer teams. The default destination is `pings.sourcegraph.com` in older releases and `services.sourcegraph.com` in the upcoming 8.1 release. It sends only the high-level, aggregated data below. It never sends code, repository names, usernames, or any other specific data. To learn more, go to the **Administration > Pings** page on your instance (the URL is `https://sourcegraph.example.com/site-admin/pings`). +Sourcegraph periodically sends a ping to `services.sourcegraph.com` to help our product and customer teams. It sends only the high-level, aggregated data below. It never sends code, repository names, usernames, or any other specific data. To learn more, go to the **Administration > Pings** page on your instance (the URL is `https://sourcegraph.example.com/site-admin/pings`). Sourcegraph will also periodically perform a license verification check, to verify the validity of the configured Sourcegraph license. Tampering with these checks, or preventing them from occurring, will cause Sourcegraph to disable many features until a successful check is completed. Certain Enterprise licenses can request to be exempt from these license verification checks. @@ -217,10 +217,10 @@ Connections to Sourcegraph-managed services include: 1. The pings described above are sent, in order to: - Check for new product updates. - Send [anonymous, non-specific, aggregate metrics](#pings) back to Sourcegraph.com (see the full list above). -1. [Verify](/admin/licensing/) the validity of the configured Sourcegraph license. -1. Export [telemetry events](/admin/telemetry). -1. Check credit/quota availability and report consumption to [Enterprise Portal](/admin/enterprise-portal#credits). -1. Legacy Sourcegraph extensions are fetched from Sourcegraph.com`s extension registry. +2. [Verify](/admin/licensing/) the validity of the configured Sourcegraph license. +3. Export [telemetry events](/admin/telemetry). +4. Check credit/quota availability and report consumption to [Enterprise Portal](/admin/enterprise-portal#credits). +5. Legacy Sourcegraph extensions are fetched from Sourcegraph.com`s extension registry. Other enabled features may require additional external destinations; see [private network configuration](/self-hosted/private-network). diff --git a/docs/admin/telemetry/index.mdx b/docs/admin/telemetry/index.mdx index 3326f8f96..91453fbaa 100644 --- a/docs/admin/telemetry/index.mdx +++ b/docs/admin/telemetry/index.mdx @@ -47,7 +47,7 @@ You can reach out to support@sourcegraph.com for additional information about ho ## Allowlist IPs / CIDR ranges for Sourcegraph -See [outbound access to Sourcegraph services](/self-hosted/private-network#outbound-access-to-sourcegraph-services) for the single-IP services gateway requirements in the upcoming 8.1 release, and the destinations to retain for older releases or custom endpoints. +See [outbound access to Sourcegraph services](/self-hosted/private-network#outbound-access-to-sourcegraph-services) for the services gateway's IP, hostname, and protocol requirements. ## Architecture diff --git a/docs/self-hosted/private-network.mdx b/docs/self-hosted/private-network.mdx index 1a1d436bb..8d9ecc8f6 100644 --- a/docs/self-hosted/private-network.mdx +++ b/docs/self-hosted/private-network.mdx @@ -26,23 +26,11 @@ The following is a list of Sourcegraph services that initiate outbound connectio ## Outbound access to Sourcegraph services -### Services gateway (upcoming 8.1 release) +Sourcegraph uses `https://services.sourcegraph.com` for Pings, Telemetry Gateway, and Enterprise Portal traffic, including license verification, credit/quota checks, and consumption reporting. -The upcoming Sourcegraph 8.1 release defaults to `https://services.sourcegraph.com` for Pings, Telemetry Gateway, and Enterprise Portal traffic, including license verification, credit/quota checks, and consumption reporting. The gateway infrastructure is available now, but older releases do not automatically switch to this endpoint. +Allow **outbound TCP port `443` to `34.36.231.254`**, with **HTTPS and HTTP/2 gRPC** support through your firewall or proxy. For hostname-based filtering, allow `services.sourcegraph.com`. Keep the hostname for TLS; do not replace it with the IP address. No inbound firewall rule is required. -Allow outbound connections from your instance to **`34.36.231.254` on TCP port `443`**, with support for **HTTPS and HTTP/2 gRPC** through any firewall or proxy. If your network also filters by hostname, allow `services.sourcegraph.com`. Both `services.sourcegraph.com` and `pings.sourcegraph.com` resolve to this retained Pings IPv4 address. Keep the hostname for TLS; do not replace it with the IP address. This is an outbound destination allowlist, not an inbound firewall rule. - -The services gateway is not Cloudflare-proxied, so this path does **not** require Cloudflare's shared IP ranges. This single IP covers only these service interactions, not code hosts, LLM providers, update/download artifacts, browser access to Enterprise Portal, or every Sourcegraph integration. Keep the destinations required by your other enabled features. - -### Older releases and direct endpoints - -Until you upgrade to a release that uses the services gateway, retain the outbound rules for your existing destinations, including hostname rules where required: - -- `pings.sourcegraph.com`: `34.36.231.254`. -- `telemetry-gateway.sourcegraph.com`: `34.107.157.31`. -- `sourcegraph.com`: the full [Cloudflare IP ranges](https://www.cloudflare.com/ips/), when required by your configured services. - -Keep access to your configured Enterprise Portal endpoint and any other custom endpoints. Do not remove those rules merely because the services gateway is available. +The gateway is not Cloudflare-proxied and does **not** require Cloudflare's shared IP ranges. This IP covers only these service interactions. Keep separate access rules for code hosts, LLM providers, update/download artifacts, browser access to Enterprise Portal, custom endpoints, and other enabled integrations. ## HTTP proxy configuration From 3e3f12ab7235292f88492fdfd1dc45e66cbe2be7 Mon Sep 17 00:00:00 2001 From: Robert Lin Date: Tue, 13 Oct 2026 18:28:19 +0000 Subject: [PATCH 04/10] docs: Gate publication on merge timing, not draft status Amp-Thread-ID: https://ampcode.com/threads/T-26fae6b7-6e69-4053-9d3d-7b5c04f2cebc Co-authored-by: Amp --- AGENTS.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index a4db28c0b..354f36a6d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -5,8 +5,9 @@ - Write long-lived feature and configuration docs in the present tense for the behavior readers will use when the docs are published. Avoid time-relative wording such as "upcoming", "new", or "now" that requires later cleanup. -- Keep docs for unreleased behavior in draft PRs until the release is available; - record the release dependency in the PR description, not in customer prose. +- PRs for unreleased behavior can be ready for review. Coordinate merge timing + with the relevant release or weekly update, and record that dependency in the + PR description, not in customer prose. - Describe the current behavior concisely. Put release transitions and old/new comparisons in upgrade notes rather than permanent feature docs. Retain version-specific guidance only when readers still need it to use or upgrade From 7c99ac63d8815e32e3b3f346e021ff5bcd330b0b Mon Sep 17 00:00:00 2001 From: Robert Lin Date: Tue, 13 Oct 2026 11:41:55 -0700 Subject: [PATCH 05/10] simplify --- docs/admin/enterprise-portal.mdx | 2 +- docs/self-hosted/private-network.mdx | 6 ++---- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/docs/admin/enterprise-portal.mdx b/docs/admin/enterprise-portal.mdx index 479671de7..30f05dc69 100644 --- a/docs/admin/enterprise-portal.mdx +++ b/docs/admin/enterprise-portal.mdx @@ -37,7 +37,7 @@ Subscription admins can view [Sourcegraph Analytics](/analytics) for the subscri Subscription admins can view credit balances and rates for metered services, including [Deep Search](/deep-search) and [Agentic Batch Changes](/agentic-batch-changes), on the **Credits** page. This replaces the former Deep Search usage monitoring page and shows subscription-wide consumption, not an individual user's usage. -Self-hosted instances need outbound connectivity to Enterprise Portal through the services gateway for credit/quota checks and consumption reporting, including when using your own LLM provider. Before using metered services, configure the [required outbound access](/self-hosted/private-network#outbound-access-to-sourcegraph-services), including IP allowlisting if your network restricts egress. +Self-hosted instances need outbound connectivity to Enterprise Portal through the services gateway for credit/quota checks and consumption reporting. Before using metered services, configure the [required outbound access](/self-hosted/private-network#outbound-access-to-sourcegraph-services), including IP allowlisting if your network restricts egress. 1. [Sign in to Enterprise Portal](#accessing-sourcegraph-enterprise-portal) as a subscription admin. 2. Select your subscription. diff --git a/docs/self-hosted/private-network.mdx b/docs/self-hosted/private-network.mdx index 8d9ecc8f6..23b24b4f0 100644 --- a/docs/self-hosted/private-network.mdx +++ b/docs/self-hosted/private-network.mdx @@ -26,11 +26,9 @@ The following is a list of Sourcegraph services that initiate outbound connectio ## Outbound access to Sourcegraph services -Sourcegraph uses `https://services.sourcegraph.com` for Pings, Telemetry Gateway, and Enterprise Portal traffic, including license verification, credit/quota checks, and consumption reporting. +Sourcegraph makes requests to `https://services.sourcegraph.com` for key product capabilities. -Allow **outbound TCP port `443` to `34.36.231.254`**, with **HTTPS and HTTP/2 gRPC** support through your firewall or proxy. For hostname-based filtering, allow `services.sourcegraph.com`. Keep the hostname for TLS; do not replace it with the IP address. No inbound firewall rule is required. - -The gateway is not Cloudflare-proxied and does **not** require Cloudflare's shared IP ranges. This IP covers only these service interactions. Keep separate access rules for code hosts, LLM providers, update/download artifacts, browser access to Enterprise Portal, custom endpoints, and other enabled integrations. +To ensure a smooth experience, instances must allow **outbound TCP port `443` to `34.36.231.254`**, with **HTTPS and HTTP/2 gRPC** support through your firewall or proxy. For hostname-based filtering, allow `services.sourcegraph.com`. Keep the hostname for TLS; do not replace it with the IP address. No inbound firewall rule is required. ## HTTP proxy configuration From 47f4fe46f59afcae9dd9c1616e00cc19a6f9dc0d Mon Sep 17 00:00:00 2001 From: Robert Lin Date: Tue, 13 Oct 2026 18:46:03 +0000 Subject: [PATCH 06/10] docs: Move managed-service connections overview to architecture Keep the previous Pings section anchor with a link to the new location. Amp-Thread-ID: https://ampcode.com/threads/T-26fae6b7-6e69-4053-9d3d-7b5c04f2cebc Co-authored-by: Amp --- docs/admin/architecture.mdx | 13 +++++++++++++ docs/admin/pings.mdx | 12 +----------- 2 files changed, 14 insertions(+), 11 deletions(-) diff --git a/docs/admin/architecture.mdx b/docs/admin/architecture.mdx index 12863e98d..239a3c35f 100644 --- a/docs/admin/architecture.mdx +++ b/docs/admin/architecture.mdx @@ -276,6 +276,19 @@ Repository permissions are mirrored from code hosts to Sourcegraph by default. T ## Supporting features +### Connections to Sourcegraph-managed services + +Sourcegraph instances connect to the services gateway at `https://services.sourcegraph.com` to: + +1. Send [Pings](/admin/pings) with aggregated usage metrics and check for product updates. +2. [Verify licenses](/admin/licensing/). +3. Export [telemetry events](/admin/telemetry). +4. Check credit/quota availability and report consumption to [Enterprise Portal](/admin/enterprise-portal#credits). + +Model inference uses the [Sourcegraph Model Provider](#model-provider) or your configured LLM provider, separately from the services gateway. Legacy Sourcegraph extensions are fetched from Sourcegraph.com's extension registry. + +For self-hosted firewall and proxy requirements, see [outbound access to Sourcegraph services](/self-hosted/private-network#outbound-access-to-sourcegraph-services). Other enabled features and integrations may require additional external destinations. + ### Model Provider The **Sourcegraph Model Provider** is the default and recommended way to configure AI features like Deep Search and Cody. Through this service, we provide zero-configuration access to state-of-the-art models from various LLM providers, including Anthropic and OpenAI, with enterprise-grade [privacy and security](/model-provider#privacy-and-security). diff --git a/docs/admin/pings.mdx b/docs/admin/pings.mdx index 1dbdcb9d4..5613b3497 100644 --- a/docs/admin/pings.mdx +++ b/docs/admin/pings.mdx @@ -212,17 +212,7 @@ Be sure to update the environment variable like so : `TELEMETRY_HTTP_PROXY:"http ## Connections to Sourcegraph-managed services -Connections to Sourcegraph-managed services include: - -1. The pings described above are sent, in order to: - - Check for new product updates. - - Send [anonymous, non-specific, aggregate metrics](#pings) back to Sourcegraph.com (see the full list above). -2. [Verify](/admin/licensing/) the validity of the configured Sourcegraph license. -3. Export [telemetry events](/admin/telemetry). -4. Check credit/quota availability and report consumption to [Enterprise Portal](/admin/enterprise-portal#credits). -5. Legacy Sourcegraph extensions are fetched from Sourcegraph.com`s extension registry. - -Other enabled features may require additional external destinations; see [private network configuration](/self-hosted/private-network). +See [Connections to Sourcegraph-managed services](/admin/architecture#connections-to-sourcegraph-managed-services) in the architecture overview. ## Connections to Sourcegraph.com via Cody app From d09cc55e13e2de0b1a031b28e9ca3aa4de8a4324 Mon Sep 17 00:00:00 2001 From: Robert Lin Date: Tue, 13 Oct 2026 18:49:26 +0000 Subject: [PATCH 07/10] docs: Remove inference aside and legacy extensions reference Amp-Thread-ID: https://ampcode.com/threads/T-26fae6b7-6e69-4053-9d3d-7b5c04f2cebc Co-authored-by: Amp --- docs/admin/architecture.mdx | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/admin/architecture.mdx b/docs/admin/architecture.mdx index 239a3c35f..730fdbf25 100644 --- a/docs/admin/architecture.mdx +++ b/docs/admin/architecture.mdx @@ -285,8 +285,6 @@ Sourcegraph instances connect to the services gateway at `https://services.sourc 3. Export [telemetry events](/admin/telemetry). 4. Check credit/quota availability and report consumption to [Enterprise Portal](/admin/enterprise-portal#credits). -Model inference uses the [Sourcegraph Model Provider](#model-provider) or your configured LLM provider, separately from the services gateway. Legacy Sourcegraph extensions are fetched from Sourcegraph.com's extension registry. - For self-hosted firewall and proxy requirements, see [outbound access to Sourcegraph services](/self-hosted/private-network#outbound-access-to-sourcegraph-services). Other enabled features and integrations may require additional external destinations. ### Model Provider From 9ee2bf4c07a6458c341f6c546e328429c183e855 Mon Sep 17 00:00:00 2001 From: Robert Lin Date: Tue, 13 Oct 2026 18:51:31 +0000 Subject: [PATCH 08/10] docs: Group pings and telemetry with architecture cross-link Amp-Thread-ID: https://ampcode.com/threads/T-26fae6b7-6e69-4053-9d3d-7b5c04f2cebc Co-authored-by: Amp --- docs/admin/architecture.mdx | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/docs/admin/architecture.mdx b/docs/admin/architecture.mdx index 730fdbf25..1faecc190 100644 --- a/docs/admin/architecture.mdx +++ b/docs/admin/architecture.mdx @@ -280,10 +280,9 @@ Repository permissions are mirrored from code hosts to Sourcegraph by default. T Sourcegraph instances connect to the services gateway at `https://services.sourcegraph.com` to: -1. Send [Pings](/admin/pings) with aggregated usage metrics and check for product updates. +1. Send pings and telemetry events, and check for product updates. See [Analytics and telemetry](#analytics-and-telemetry). 2. [Verify licenses](/admin/licensing/). -3. Export [telemetry events](/admin/telemetry). -4. Check credit/quota availability and report consumption to [Enterprise Portal](/admin/enterprise-portal#credits). +3. Check credit/quota availability and report consumption to [Enterprise Portal](/admin/enterprise-portal#credits). For self-hosted firewall and proxy requirements, see [outbound access to Sourcegraph services](/self-hosted/private-network#outbound-access-to-sourcegraph-services). Other enabled features and integrations may require additional external destinations. From fe4b5ce48c0664dd16dc06b0c936049c6e4b05f0 Mon Sep 17 00:00:00 2001 From: Robert Lin Date: Tue, 13 Oct 2026 18:53:54 +0000 Subject: [PATCH 09/10] docs: Link network guidance to architecture overview Amp-Thread-ID: https://ampcode.com/threads/T-26fae6b7-6e69-4053-9d3d-7b5c04f2cebc Co-authored-by: Amp --- docs/self-hosted/private-network.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/self-hosted/private-network.mdx b/docs/self-hosted/private-network.mdx index 23b24b4f0..b84ec7a3e 100644 --- a/docs/self-hosted/private-network.mdx +++ b/docs/self-hosted/private-network.mdx @@ -9,7 +9,7 @@ keeping your sensitive data and operations shielded from external access. When deploying self-hosted Sourcegraph instances in private networks with specific compliance and policy requirements, additional configuration may be required to ensure all networking features function correctly. The reasons for applying the following configuration options depend on the specific functionality of the Sourcegraph service and the unique network and infrastructure requirements of the organization. -The following is a list of Sourcegraph services that initiate outbound connections to external services. Sourcegraph services not included in this list can be assumed to only connect to services within the Sourcegraph deployment's network segment: +The following is a list of [Sourcegraph services](/admin/architecture) that initiate outbound connections to external services. Sourcegraph services not included in this list can be assumed to only connect to services within the Sourcegraph deployment's network segment: - **executor**: Sourcegraph [Executor](/self-hosted/executors/) batch change or precise indexing jobs may need to connect to services hosted within an organization's private network @@ -26,7 +26,7 @@ The following is a list of Sourcegraph services that initiate outbound connectio ## Outbound access to Sourcegraph services -Sourcegraph makes requests to `https://services.sourcegraph.com` for key product capabilities. +Sourcegraph makes requests to `https://services.sourcegraph.com` for [key product capabilities](/admin/architecture#connections-to-sourcegraph-managed-services). To ensure a smooth experience, instances must allow **outbound TCP port `443` to `34.36.231.254`**, with **HTTPS and HTTP/2 gRPC** support through your firewall or proxy. For hostname-based filtering, allow `services.sourcegraph.com`. Keep the hostname for TLS; do not replace it with the IP address. No inbound firewall rule is required. From 76e893044dce67763acad1a96bce6fad3c05e6f0 Mon Sep 17 00:00:00 2001 From: Robert Lin Date: Wed, 14 Oct 2026 19:56:24 +0000 Subject: [PATCH 10/10] docs: Simplify outbound services introduction Remove the unsupported assumption about unlisted services. Amp-Thread-ID: https://ampcode.com/threads/T-26fae6b7-6e69-4053-9d3d-7b5c04f2cebc Co-authored-by: Amp --- docs/self-hosted/private-network.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/self-hosted/private-network.mdx b/docs/self-hosted/private-network.mdx index b84ec7a3e..f7431f9cc 100644 --- a/docs/self-hosted/private-network.mdx +++ b/docs/self-hosted/private-network.mdx @@ -9,7 +9,7 @@ keeping your sensitive data and operations shielded from external access. When deploying self-hosted Sourcegraph instances in private networks with specific compliance and policy requirements, additional configuration may be required to ensure all networking features function correctly. The reasons for applying the following configuration options depend on the specific functionality of the Sourcegraph service and the unique network and infrastructure requirements of the organization. -The following is a list of [Sourcegraph services](/admin/architecture) that initiate outbound connections to external services. Sourcegraph services not included in this list can be assumed to only connect to services within the Sourcegraph deployment's network segment: +The following [Sourcegraph services](/admin/architecture) initiate outbound connections to external services: - **executor**: Sourcegraph [Executor](/self-hosted/executors/) batch change or precise indexing jobs may need to connect to services hosted within an organization's private network