Networking

Topology (Production)

Internet clients
    │
    ▼
Nginx :80 / :443  (PUBLIC)
    │
    ▼
ERP application  (LOOPBACK / private — not a public endpoint)
    │
    ▼
PostgreSQL       (DOCKER-INTERNAL — never public)

Port classification

Port	Purpose	Exposure
22	SSH	Public (management)
80	HTTP / certificate challenges	Public
443	HTTPS	Public (primary ERP entry)
Application HTTP	ERP HTTP	Private / loopback only
5432	PostgreSQL	Docker-internal only
10000	Webmin (if pre-existing)	Not opened by Soviez

Explicit rules

Do not expose the ERP application port as a public Production endpoint.
Do not expose PostgreSQL publicly.

Cloudflare

If you terminate TLS at Cloudflare, follow CLOUDFLARE.md so origin and proxy modes stay consistent.

Related

• DOMAIN_AND_TLS.md
• FIREWALL.md
• WEBSOCKET_AND_LONGPOLLING.md