1) Confirm what is listening (baseline)

On the VM, confirm only the expected public ports exist (typically 80, 443, and 22).

ss -ltnp

You should not see internal Stoat ports (14702–14706, 27017, 9000, 5672, etc.) bound to 0.0.0.0.
In your compose file, only Caddy publishes ports, which is correct.

2) Use UFW (Recommended on Ubuntu 24.04)

Your VM has ufw installed. This is the simplest and most maintainable approach.

2.1 Set safe defaults

sudo ufw default deny incoming
sudo ufw default allow outgoing

2.2 Allow HTTPS (required)

sudo ufw allow 443/tcp

2.3 Allow HTTP (optional — only for redirect)

If you configured Caddy to redirect HTTP → HTTPS, you may choose to allow port 80.
If you do not need redirects, skip this and keep 80 closed.

sudo ufw allow 80/tcp

2.4 Lock down SSH (recommended)

Best practice is to allow SSH only from your trusted admin IP. Replace YOUR.IP.ADDRESS below with your real public IP.
(If you are behind changing IPs, use a VPN or a small allow-list of trusted IPs.)

sudo ufw allow from YOUR.IP.ADDRESS to any port 22 proto tcp

If you already enabled a broad SSH allow rule previously (e.g., “OpenSSH”), you can remove it after your IP rule exists:

sudo ufw status numbered
sudo ufw delete <RULE_NUMBER>

2.5 Enable UFW

sudo ufw enable

2.6 Verify active rules

sudo ufw status verbose

3) IPv6 Exposure (Decide intentionally)

Your VM is currently listening on IPv6 ([::]:80 and [::]:443).
If you do not actively use IPv6, disabling it for UFW reduces surface area.

sudo nano /etc/default/ufw
# Set:
# IPV6=no
sudo ufw disable
sudo ufw enable

If you need IPv6, keep it enabled and ensure UFW rules apply to v6 as well (UFW can manage both when IPV6=yes).

4) Docker Reality Check (Make sure only Caddy is exposed)

Docker manipulates iptables/nft rules automatically. Your compose file only publishes ports for the caddy service,
which is correct. Confirm no other service is reachable externally.

docker ps --format "table {{.Names}}\t{{.Ports}}"
ss -ltnp

5) External Verification (Scan from outside)

From a machine not on the VM (your workstation or another host), verify only intended ports are open:

nmap -Pn -p 22,80,443 revolt.yaws.com

• 443/tcp should be open
• 80/tcp open only if you chose redirect
• 22/tcp should be filtered or open only from your admin IP