Skip to main content

Collector connectivity security

This page describes how a Praxis collector running in your environment connects outbound to the Praxis cloud — for control/configuration and for reporting its own metrics.

The connections a collector makes​

A collector opens two outbound connections to the Praxis cloud, plus its data-plane exports:

#ConnectionProtocolPurpose
1Control & configurationOpAMP over secure WebSocket (wss://)Enrollment, receiving pipeline configuration, status, remote actions
2Collector metricsOTLP over HTTPSThe collector's own health and throughput metrics
3Data plane (your telemetry)Per destinationYour logs/metrics/traces — sent directly to your destinations, not to the cloud

Connections 1 and 2 go to the same cloud host (port 443), over an authenticated edge. Connection 3 is separate: your telemetry goes only to the destinations you attach in your pipelines.

1. Control & configuration channel​

  • Protocol: OpAMP (the OpenTelemetry agent management protocol) carried over a secure WebSocket (wss://).
  • Encryption: TLS 1.2 or higher, negotiating TLS 1.3 where supported. The collector validates the cloud certificate against the host trust store.
  • Direction: strictly outbound. All management actions — configuration updates, pipeline reloads, restarts, diagnostics — are delivered on the connection the collector itself opened. No inbound port is opened on the collector.
  • Authentication: OAuth 2.0 machine-to-machine credentials (client_credentials grant). The collector exchanges a client key/secret for a short-lived, signed (RS256) JWT bearer token and presents it on the connection. Tokens auto-refresh before expiry.
  • Configuration delivery: pipeline configuration is pushed over this same authenticated, encrypted channel, so it cannot be read or altered by a network observer. The collector reports an applied/failed status for every configuration it receives.
  • Upgrades: self-upgrade packages are verified against a published SHA-256 checksum before they are applied.
  • Proxies: standard HTTPS_PROXY / HTTP_PROXY / NO_PROXY variables are honored, so the connection can egress through a corporate forward proxy.

2. Collector metrics channel​

The collector reports its own operational metrics (health, throughput) — this is not your telemetry.

  • Protocol: OTLP over HTTPS (protobuf, gzip), pushed on a periodic interval.
  • Encryption: TLS with a TLS 1.3 minimum.
  • Endpoint: a dedicated path on the same cloud host as the control channel — no extra hostname or firewall rule needed.
  • Authentication: the same OAuth 2.0 bearer token used for the control channel.

3. Data plane — your telemetry​

The telemetry your pipelines collect does not go to the Praxis cloud. It flows from the collector (optionally via a Praxis Gateway tier) directly to the destinations you configure — your SIEM/SecOps, object storage, or other OTLP targets. Each destination's transport security (TLS, and optional mTLS on gateway hops) is governed by that destination's own settings. See TLS and certificates.

Credentials on the collector​

  • A collector is enrolled with an install command (generated in the Praxis UI) that embeds OAuth client credentials.
  • On first start, the collector moves those credentials into an encrypted local store, blanks them from any plaintext file, and deletes the temporary bootstrap file.
  • The store uses AES-256-GCM encryption with a key derived from the host machine identity, so copying the encrypted file to another machine does not yield usable credentials.
  • On Kubernetes, credentials are supplied via standard Secret-backed environment variables.

Network summary for firewall / egress rules​

FromToDirectionProtocol / Port
Praxis collectorPraxis cloud hostOutbound onlywss:// (TLS, port 443) — control & config
Praxis collectorPraxis cloud hostOutbound onlyhttps:// (TLS, port 443) — collector metrics & token requests
Praxis collectorYour destinationsOutboundPer destination (OTLP 4317/4318, HTTPS, vendor)

No inbound connectivity to the collector is required for the control or metrics paths. The only listeners a collector opens are for the sources you explicitly configure (syslog, TCP, UDP, webhook), which you control and firewall per your policy.