Die Dokumentation ist derzeit nur auf Englisch verfügbar.
Requirements
Prepare the items on this page before you start the rollout — having them ready makes the installation a smooth, uninterrupted run.
What you need before you begin
- A valid license key (you receive it with your CanMe subscription).
Evaluating CanMe without a subscription? Talk to us — we'll set you up with a demo license so you can walk this entire guide with your own environment.
- Access to the console of each appliance (screen and keyboard, or your virtualization platform's console) and its console credentials.
- A DNS zone you can edit at your DNS provider — your platform's names will live under it (for example
customer.example.comunderexample.com). - A public IPv4 address for each Core.
Core
The Core hosts your management console and the coordination services of your network.
Hardware (minimum):
| Resource | Minimum |
|---|---|
| CPU | 4 cores (hyper-threaded CPUs are not supported) |
| Memory | 16 GB |
| Disk | 80 GB |
Inbound ports (from the internet to the Core):
| Port | Purpose |
|---|---|
| 53 TCP + UDP | DNS for your platform's zone — each Core answers name lookups for it |
| 80 TCP | Certificate provisioning and HTTP redirect |
| 443 TCP | Cansole, login, API, and secure network access |
| 8440 TCP | Secure network control channel |
| 9000 TCP | Secure network links between nodes |
| 8443 TCP | Rollout page — only during initial setup; it disables itself afterwards |
Outbound access (from the Core):
| Destination | Port | Purpose |
|---|---|---|
| 1.1.1.1 / 8.8.8.8 | 53 | Name resolution |
| support.canme.network | 443 | Remote support (only when you activate it) |
| license.canme.network | 443 | License verification |
| updates.canme.network | 443 | System updates |
| acme-v02.api.letsencrypt.org | 443 | Automatic certificates (Let's Encrypt) |
Mesh
A Mesh needs a public address that is reachable by the Core, by all other Meshes and Gates, and by your users' Cannector clients.
Hardware: at least 2 CPU cores (4 recommended), 8 GB memory, 60 GB disk.
Inbound ports: 443 TCP and 9000 TCP from the internet, plus 8443 TCP for the rollout page (initial setup only).
Outbound access: 443 and 9000 to the Core and other Meshes, 8440 to the Core, plus the same DNS, update, and support destinations as the Core.
The Mesh's name (FQDN) must be resolvable and reachable by every other node and by the Mesh itself. If you name the Mesh inside your platform's own DNS zone, CanMe manages the DNS record for you — you only provide the Mesh's public IP during creation (see Adding Meshes and Gates).
Gate
A Gate sits inside a location and only makes outbound connections — you don't need to open any inbound ports from the internet, except 8443 TCP for the rollout page during initial setup.
Hardware: same as a Mesh — at least 2 CPU cores (4 recommended), 8 GB memory, 60 GB disk.
Outbound access: the same set as a Mesh.
Local reachability: the Gate must be able to reach every device it makes available. For example, if a computer at 192.168.100.5 should be reachable through the Gate, the Gate itself must be able to connect to that address — devices in other subnets need a route via the location's network.
DNS prerequisites
Your platform serves its own DNS zone. During the first Core's installation, the rollout page shows you exactly which records to create at your DNS provider — you don't have to figure them out yourself. To be ready:
- Make sure you can create NS and A records in the parent zone at your DNS provider.
- Each Core's public IP must accept inbound traffic on UDP and TCP port 53 — if port 53 is blocked, name resolution for your platform will fail.
- The platform's name (your "Core Address", e.g.
customer.example.com) must not have an existing A record in the parent zone — remove one if present; the platform serves this name itself.
Certificates for all public names are requested and renewed automatically via Let's Encrypt — there is nothing to install or renew manually.