Documenten

Firewall- en netwerkinstellingen

Twee verbindingen zijn belangrijk voor Ottoch: inkomend verkeer naar de app zelf, en uitgaand verkeer van Ottoch naar je database. Dit is wat je moet openen, en — belangrijker — wat je moet afsluiten.

01

Inkomend — Ottoch zelf bereiken

Ottoch ships with Caddy, which listens on ports 80 and 443. Open both on whatever server or VM you deploy on — Caddy uses 80 for the initial Let's Encrypt HTTP challenge and 443 for HTTPS traffic afterward.

✓ If you're only accessing Ottoch over a private network or VPN, you can restrict inbound 80/443 to that network's IP range instead of the whole internet.
✓ No other inbound ports are needed — Redis and Postgres (if you're running the bundled containers) talk to Ottoch over the internal Docker network, never exposed externally by default.
02

Uitgaand — Ottoch bereikt je database

This is the direction that actually matters for database security. Ottoch connects out to your database server, from whatever machine runs the Docker container — your database is never exposed to Ottoch's infrastructure, because there isn't any: everything runs on your own server.

The practical firewall rule you want on your database server: allow inbound connections on the database port only from the IP address of the machine running Ottoch — not 0.0.0.0/0. If your database is already only reachable from inside a private network or VPC that the Ottoch server is also on, you likely don't need to change anything.

Referentie

Standaard databasepoorten

Welke poort je database ook daadwerkelijk gebruikt — dit zijn slechts de standaardwaarden die Ottoch invult wanneer je een verbinding toevoegt.

Database Standaardpoort
PostgreSQL5432
MySQL / MariaDB3306
SQL Server1433
Redshift5439
ClickHouse8123 (HTTP) / 8443 (HTTPS)
Databricks443 (HTTPS SQL warehouse endpoint)
03

Het IP-adres vinden om toe te staan

If your database is on a cloud provider (RDS, Cloud SQL, managed Postgres, etc.) and you want to restrict its firewall to just your Ottoch server, you need that server's outbound public IP. From the machine running Ottoch: 

curl ifconfig.me

Add that IP to your database provider's firewall/security-group allow-list. If your server is behind a NAT gateway or load balancer, use that gateway's outbound IP instead — check your cloud provider's networking docs for how to find it.

Nog steeds vastgelopen?

Mail ons of open het contactformulier — we helpen je graag.

Neem contact op ← Terug naar documenten