Network Requirements (Firewall & Proxy)

This page is for IT administrators rolling out the DeutschlandGPT desktop app in an environment with a firewall or proxy. If your proxy blocks outbound traffic by default and only lets approved destinations through, the app cannot connect until the domains below are allowed.

Required

The app will not work without these two entries. All connections use HTTPS on port 443.

Optional

These destinations are only needed for specific features. If they stay blocked, normal chat keeps working, only the individual feature is unavailable.

Outgoing connections from DeutschlandGPT

The sections above describe the direction from you to us. In the other direction, some features have DeutschlandGPT actively call systems inside your network — for example the HTTP request step in workflows, self-hosted integrations (WebDAV, BookStack), MCP servers you operate yourself, fetching your identity provider's SAML metadata, and token requests against your own OAuth servers.

If your firewall only accepts incoming connections from known senders, allow this address:

Every request from our production environment leaves our data centre through this single address, regardless of which feature triggered it and regardless of the domain your organization uses to reach DeutschlandGPT — the sender is the same even with a custom domain (white label).

This is a static IP address permanently allocated to us. It does not change through updates, deployments or scaling of our application. Should a change ever become necessary for infrastructure reasons, we will announce it in advance.

Custom domain (white label)

If you run DeutschlandGPT under your own domain, point a DNS A record at this address:

We issue the TLS certificate automatically once DNS resolves; you do not need to supply one.

Setting the proxy via environment variable

As of the current version, the desktop app detects the Windows system proxy automatically, including proxies distributed via a PAC file, WPAD auto-detection or group policy. If your browser works on the same machine, the app should now connect as well, without any manual setup.

The desktop app does not route its requests through the embedded browser view but through its own HTTP client. This client reads the system proxy configured in Windows, evaluates a configured PAC file and follows WPAD auto-detection, so it behaves essentially like your browser.

If, in a special case, the connection still fails even though the browser works on the same machine, you can force the proxy manually through the environment variables HTTPS_PROXY, HTTP_PROXY and NO_PROXY. These take precedence over auto-detection.

To do so, set the following variables on the affected machines (system- or user-wide) and adjust host and port to your proxy:

HTTPS_PROXY=http://proxy.your-domain.local:8080
HTTP_PROXY=http://proxy.your-domain.local:8080
NO_PROXY=localhost,127.0.0.1

If your proxy requires authentication, include it in the URL: http://user:password@proxy.your-domain.local:8080. After setting the variables, the app must be restarted.

Configuration notes

• For outbound traffic, allow by domain, not by IP address. For the direction from you to us, allow the hostnames listed under Required. Behind *.deutschlandgpt.de sits a load balancer whose IP addresses can change; hostname-based rules stay stable. For the opposite direction — connections we open to you — there is a fixed address, see Outgoing connections from DeutschlandGPT.
• HTTPS on port 443 only. No other ports are needed. The app does not open plain HTTP (non-TLS) connections.
• TLS interception (SSL inspection): The app does not use hard certificate pinning and generally works behind an intercepting proxy. This requires your proxy's root certificate to be present in the Windows certificate store.

Verifying the connection

If the app starts but you still see no sign-in page or a connection error, check in this order: