Dokumentation

Firewall- und Netzwerkeinrichtung

Für Ottoch sind zwei Verbindungen wichtig: eingehender Traffic zur App selbst und ausgehender Traffic von Ottoch zu deiner Datenbank. Das musst du öffnen — und, was wichtiger ist, das musst du absichern.

01

Eingehend — Ottoch selbst erreichen

Ottoch ships with Caddy, which listens on ports 80 and 443. Open both on whatever server or VM you deploy on — Caddy uses 80 for the initial Let's Encrypt HTTP challenge and 443 for HTTPS traffic afterward.

✓ If you're only accessing Ottoch over a private network or VPN, you can restrict inbound 80/443 to that network's IP range instead of the whole internet.
✓ No other inbound ports are needed — Redis and Postgres (if you're running the bundled containers) talk to Ottoch over the internal Docker network, never exposed externally by default.
02

Ausgehend — Ottoch erreicht deine Datenbank

This is the direction that actually matters for database security. Ottoch connects out to your database server, from whatever machine runs the Docker container — your database is never exposed to Ottoch's infrastructure, because there isn't any: everything runs on your own server.

The practical firewall rule you want on your database server: allow inbound connections on the database port only from the IP address of the machine running Ottoch — not 0.0.0.0/0. If your database is already only reachable from inside a private network or VPC that the Ottoch server is also on, you likely don't need to change anything.

Referenz

Standard-Datenbankports

Unabhängig davon, welchen Port deine Datenbank tatsächlich verwendet — dies sind nur die Standardwerte, die Ottoch beim Hinzufügen einer Verbindung vorausfüllt.

Datenbank Standardport
PostgreSQL5432
MySQL / MariaDB3306
SQL Server1433
Redshift5439
ClickHouse8123 (HTTP) / 8443 (HTTPS)
Databricks443 (HTTPS SQL warehouse endpoint)
03

Die freizugebende IP finden

If your database is on a cloud provider (RDS, Cloud SQL, managed Postgres, etc.) and you want to restrict its firewall to just your Ottoch server, you need that server's outbound public IP. From the machine running Ottoch: 

curl ifconfig.me

Add that IP to your database provider's firewall/security-group allow-list. If your server is behind a NAT gateway or load balancer, use that gateway's outbound IP instead — check your cloud provider's networking docs for how to find it.

Immer noch nicht weiter?

Schreib uns eine E-Mail oder öffne das Kontaktformular — wir helfen gerne.

Kontaktiere uns ← Zurück zur Dokumentation