Configuración de firewall y red

Entrante — llegar a Ottoch

Ottoch ships with Caddy, which listens on ports 80 and 443. Open both on whatever server or VM you deploy on — Caddy uses 80 for the initial Let's Encrypt HTTP challenge and 443 for HTTPS traffic afterward.

Saliente — Ottoch llega a tu base de datos

This is the direction that actually matters for database security. Ottoch connects out to your database server, from whatever machine runs the Docker container — your database is never exposed to Ottoch's infrastructure, because there isn't any: everything runs on your own server.

The practical firewall rule you want on your database server: allow inbound connections on the database port only from the IP address of the machine running Ottoch — not 0.0.0.0/0. If your database is already only reachable from inside a private network or VPC that the Ottoch server is also on, you likely don't need to change anything.

Encontrar la IP para la lista blanca

If your database is on a cloud provider (RDS, Cloud SQL, managed Postgres, etc.) and you want to restrict its firewall to just your Ottoch server, you need that server's outbound public IP. From the machine running Ottoch:

curl ifconfig.me

Add that IP to your database provider's firewall/security-group allow-list. If your server is behind a NAT gateway or load balancer, use that gateway's outbound IP instead — check your cloud provider's networking docs for how to find it.