adminCloud Network Boundary Checklist for Public and Private Services
A cloud system should clearly separate public services from private services. Public services receive internet traffic. Private services should only be reachable by the server, internal network, reverse proxy or trusted administrators.
Core principle
Public exposure is a design decision. Every open port, public dashboard, database endpoint or webhook increases attack surface and operational risk.
Checklist
- List every service running on the server.
- Mark each service as public, private or admin-only.
- Expose websites through HTTP and HTTPS only.
- Keep databases private.
- Keep internal Docker ports private.
- Put dashboards behind Nginx, authentication or VPN when possible.
- Review provider firewall and server firewall together.
- Check listening ports.
- Remove unnecessary public exposure.
- Document the network boundary.
Reusable lesson
This applies to WordPress, MySQL, Redis, Docker apps, n8n, AI dashboards, webhook receivers, monitoring panels and custom APIs.
When to Use This Checklist
Use this checklist when designing safe public and private service exposure for VPS, Docker, WordPress or AI automation infrastructure.
Required Tools
Cloud firewall, UFW, SSH access, Nginx, Docker, service list, port list, domain map
Before You Start
Before exposing a port, decide whether the service must be reached from the public internet or only internally.
Structured Checklist Steps
- List services.
- Classify exposure level.
- Expose websites safely.
- Keep database private.
- Keep Docker ports private.
- Protect dashboards.
- Review firewalls.
- Check listening ports.
- Remove exposure.
- Document boundary.
Verification Steps
- Only intended services are public.
- Database is not exposed publicly.
- Internal app ports are protected.
- Firewall rules match design.
- Network boundary is documented.
Rollback Plan
If a firewall or exposure change breaks access, restore the previous rule and test local service access before changing public rules again.
Common Mistakes
- Exposing databases publicly.
- Publishing Docker app ports unnecessarily.
- No distinction between admin-only and public services.
- Relying only on app passwords.
- No port documentation.
Related Commands
sudo ss -tulpn
sudo ufw status numbered
docker ps
curl -I http://127.0.0.1:3000
curl -I https://app.example.com