Security settings
AWS security groups control what can reach the instance. Open the ports you need before (or right after) a fresh server deployment.
Always required for a public web stack
These let browsers and Certbot reach nginx (HTTP redirect + HTTPS):
| Type | Protocol | Port range | Source | Notes |
|---|---|---|---|---|
| IPv4 HTTP | TCP | 80 | 0.0.0.0/0 (or your CDN/LB only) |
HTTP → HTTPS redirect; Certbot --standalone |
| IPv4 HTTPS | TCP | 443 | 0.0.0.0/0 (or your CDN/LB only) |
TLS for Customer / Staff |
Without 80 and 443, the hostnames in nginx will not be reachable from the internet.
Testing / development server
If you are standing up a testing or development server and need broad access for ops/debugging, the following inbound rules are typically opened as well:
| Type | Protocol | Port range | Source | Notes |
|---|---|---|---|---|
| IPv6 All ICMP - IPv6 | ICMP | All | ::/0 |
Ping / ICMP over IPv6 |
| IPv4 All ICMP - IPv4 | ICMP | All | 0.0.0.0/0 |
Ping / ICMP over IPv4 |
| IPv4 SSH | TCP | 22 | 0.0.0.0/0 |
SSH (prefer locking to your IP when possible) |
| IPv4 MYSQL/Aurora | TCP | 3306 | 0.0.0.0/0 |
MySQL exposed on the host (Compose maps 3306:3306) |
Opening these to the world (0.0.0.0/0 / ::/0) allows external access to the server for those protocols — useful for a shared test box, unsafe as a long-term production posture.
Warning
Do not leave SSH (22) or MySQL (3306) open to0.0.0.0/0on production. Prefer your office/VPN IP for SSH, and keep MySQL reachable only on the Docker network (do not publish3306publicly on prod). See Environments → Production.
Production posture (summary)
| Service | Recommended |
|---|---|
| HTTP / HTTPS | 80 + 443 publicly (or via load balancer) |
| SSH | Restricted source IPs; authorized users only |
| MySQL | Not published to the internet; containers talk to db internally |