TLS & network hardening
Reduce the network attack surface of a Notploy installation.
Purpose — Notploy necessarily exposes services to the internet. This page explains how to keep that exposure intentional and minimal.
TLS
- Automatic certificates — Let's Encrypt via Traefik for public domains. See Certificates.
- Custom certificates — bring your own certificate as a resource for domains that need it.
- Panel TLS — put the dashboard itself behind a domain with TLS before exposing it.
Redirect HTTP to HTTPS so credentials and tokens never travel in clear text. Notploy's generated Application routes include an HTTPS redirect middleware by default.
Inventory what is exposed
For each public service, know:
- the hostname and the container port it routes to,
- whether it should be public at all,
- whether it needs authentication (consider Application Authentication in Enterprise).
Use the Requests view to see what Traefik is actually serving.
Ports
| Port | Exposure |
|---|---|
| 80 / 443 | Public — required for routing and certificate issuance. |
| 3000 | The panel. Restrict or disable once a TLS domain is working. |
| 4500 | Metrics. Restrict to the control plane. |
| 22 | SSH. Restrict to known addresses where possible. |
Hardening checklist
- Panel behind HTTPS on a real domain; direct
ip:3000disabled. - Firewall allows only ports
80,443and restricted SSH. - 2FA on administrator accounts.
- Monitoring port not publicly reachable.
- Unused services and servers removed.
- Docker socket treated as privileged; panel access limited to trusted operators.
See Production hardening for the full walkthrough.