LGTM Enterprise 1.27

Network connections

For a live site deployment, the system is scaled by being installed on a server cluster containing control pool and work pool machines and, optionally, a separate web pool. When the web pool contains more than one machine, you can use an external load balancer, or round-robin DNS, to share the load between the web pool machines.

In the following diagram, the arrow directions indicate connection requests from one system component to the component to which the arrow points. Where an arrow points from A to B, A must be able to see B, and B must accept requests from A on the specified port.

Port availability

The diagram above shows the ports on which parts of the system listen for connections. These parts of the system can be hosted on different machines, as required. Depending on your cluster topology, you must make sure that the appropriate ports are reachable on the machines in the cluster, based on the LGTM services that are running on each machine. The following basic cluster topologies detail which TCP ports must be reachable. For other topologies, see the diagram above.

Single machine

Running the whole system on a single machine is not appropriate for a live system, but for a demo system the following port must be reachable:

Port Must be reachable by

443

Users' browsers and repository host systems

Separate control pool and work pool

Where all elements of the control pool are hosted on a single "controller" machine, with the work pool hosted on one or more separate machines, the following ports must be reachable on the controller machine:

Port Must be reachable by

443

Users' browsers and repository host systems

8443

The worker host machine(s)—for connections to the job dealer service

9000

The worker host machine(s)—for connections to the file store service

Separate control, web, and work pools

Where the web pool is hosted separately from the "controller" machine (which hosts all other elements of the control pool), and the work pool is also hosted on one or more separate machines, the following port must be reachable on the machine that hosts the web proxy:

Port Must be reachable by

443

Users' browsers and repository host systems

Optionally the load balancer (if you are running multiple instances of the web proxy and web app)

And these ports must be reachable on the controller machine:

Port Must be reachable by

8443

The worker host machine(s)—for connections to the job dealer service

9000

The worker host machine(s) and the web pool machine(s)—for connections to the file store service

5671

The web pool machine(s)—for connections to the message queue service

5432

The web pool machine(s)—for connections to the database service

8983

The web pool machine(s)—for connections to the search service

Communication security

All LGTM components use secure channels, protected by SSL certificates, to communicate with each other. LGTM also uses secure connections to fetch source code from your repositories, provided that you configure the repository host and LGTM to use secure connections. For more information, see Securing LGTM Enterprise.

Worker processes

The architecture of the workers in LGTM's work pool is similar to that of continuous integration tools like Jenkins and Atlassian Bamboo. That is:

  • No barriers are enforced between builds running on the same machine, either concurrently or consecutively.
  • A single operating system user name is used for multiple build and analysis tasks.
  • Data is cached between tasks on LGTM workers to improve performance. This is principally the data extraction tools, but may also include the credentials required to access one or more repositories.
  • The LGTM configuration for a repository, which controls the build and analysis process, is stored in the repository.

If you're concerned about securing one or more codebases from potential attacks by your own developers, deploy a separate instance of LGTM for these projects. Set this instance up to run its worker daemons on machines that serve exclusively as worker hosts for this LGTM.

Related topicsRelated topics