Network Requirements: FATHOMFALL
Last updated: 2026-10-15
For IT and network administrators. Allow the entries below, and FATHOMFALL works behind corporate proxies, firewalls, secure web gateways and Remote Browser Isolation. The app uses only standard HTTPS (443) and standard WebSocket-over-TLS (wss, 443). It uses no custom ports and no non-standard protocols. When a proxy blocks live sockets, the app falls back to plain HTTPS.
In the tables below, your deployment host means the host name that serves FATHOMFALL to your players. FATHOMFALL is single-origin for the browser: the app, the API, the realtime socket and the fallback all use that one host, so a browser needs only one domain.
Allowlist for browsers (domains)
| Purpose | Domain | Path(s) | Protocol / Port |
|---|---|---|---|
| App + static assets (self-hosted) | your deployment host | /, /assets/*, JS/CSS/fonts/icons | HTTPS 443 |
| Realtime game socket | your deployment host | /ws | WSS 443 |
| Realtime fallback (when WS is blocked) | your deployment host | /ws/ticket (stream authorisation, POST) · /ws/sse (server to client, SSE) · /ws/send (client to server, POST) | HTTPS 443 |
| Sign-in (optional, phone code) | your deployment host | /auth/* | HTTPS 443 |
| Health check | your deployment host | /health | HTTPS 443 |
One origin, one allow. Realtime runs over the same-origin
/wspath, not a separatews.subdomain. Allow your deployment host over 443, and the browser can reach the whole product.
Server-side egress (not needed by browsers)
The FATHOMFALL server makes outbound calls of its own. Your players' browsers do not make these calls, so a browser allowlist does not need them. They matter only if you run the server behind an egress firewall.
| Purpose | Destination | Protocol / Port |
|---|---|---|
| Phone sign-in provider (Stytch) | api.stytch.com (live project) or test.stytch.com (test project) | HTTPS 443 |
| Trace export (OpenTelemetry, OTLP/HTTP) | the collector endpoint that the operator may set in OTEL_EXPORTER_OTLP_ENDPOINT (unset: no trace traffic) | HTTPS (the port in that URL) |
| Database | the managed Postgres host in DATABASE_URL | Postgres (the port in that URL) |
How the realtime transport degrades (no action needed)
FATHOMFALL first opens a WebSocket at /ws on your deployment host. If a proxy strips or buffers the WebSocket upgrade, the client falls back automatically to Server-Sent Events (GET /ws/sse) for server-to-client frames and plain POST /ws/send for client-to-server frames. Both use ordinary HTTPS on 443. The game stays fully playable on the fallback, and players see a small "limited connection" indicator. A heartbeat ping/pong keeps the connection open through proxy idle timeouts. The client reconnects with exponential backoff and resyncs to the server state. No special proxy configuration is necessary. Port 443 to the host must be reachable.
Nothing sensitive appears in a URL
We assume that your gateway logs full URLs. Before the client opens the SSE stream, it POSTs its session credential to /ws/ticket and receives a single-use ticket that expires in ten seconds. Only that ticket appears in the GET /ws/sse?k=... query string. A ticket in your access log is already spent, and nobody can use it to reach an account. The session credential travels only in a request header (x-ff-token) or a request body.
Self-hosted assets: no third-party CDN allowlisting
The app origin serves all fonts, scripts, styles and icons. The browser has no dependency on a third-party domain. If you block external CDNs, analytics or tag managers, the product still works.
TLS / inspection
- Standard public CA certificate; supports TLS 1.2 and 1.3 with common ciphers.
- No certificate pinning. TLS-inspecting proxies work.
- All traffic uses 443. HSTS is fine. HPKP is not used.
Browser Isolation (RBI) compatibility
Core gameplay works as a plain web app. It does not require clipboard, file upload or download, camera or microphone, popups, push, service worker or PWA install. These are optional additions. If an isolated or locked-down browser removes them, the game still works.
Egress IPs (if you allowlist by IP)
<list the deployment's stable IP ranges / CIDRs here, or link to a published, versioned list>. Browsers connect only to your deployment host, so IP-based allowlisting follows the published addresses of that host.
FATHOMFALL sends no email. There is no sender domain to allow.
Single sign-on
FATHOMFALL does not offer SAML or OIDC enterprise single sign-on. Play is anonymous by default. Optional sign-in uses a one-time code sent to a phone number.
Contact
For allowlisting help or network questions, use the contact in the Privacy Policy (/legal/privacy-policy on your deployment host).
Self-hosting note: the realtime endpoints are in src/server/index.ts (/ws upgrade, /ws/ticket, /ws/sse, /ws/send, /health), and the client reaches them through src/client/net.ts. The server renders this file per request at /network-requirements, so this file is the only copy. Update it when the transport paths change.