Networking & firewall
How to reach your instance, publish a site, attach a domain, and open a TCP port.
Your addresses
Your instance is reached through the public IP and SSH port shown in Networking. Several instances can share the same IP; the port and hostname keep your traffic separate.
Examples below use 203.0.113.10, a reserved documentation address. Use the IP and port shown in your dashboard.
| Access | Address | What to use it for |
|---|---|---|
| SSH | ssh -p 22000 root@203.0.113.10 | Terminal access. The port stays the same across restarts and rebuilds. |
| Website | https://my-site.nairacloud.xyz | The default site's NairaCloud address. If it is not resolving yet, use the sslip alias on the site card. |
| Custom domain | https://your-domain.com | Your own hostname, after you point DNS at the IP and attach it to a site. |
| Raw TCP | tcp://203.0.113.10:23001 | Databases, game servers, MQTT, and other non-HTTP services. |
Use the exact website URL or an attached domain. The bare IP and unknown hostnames return 404.
Sites
A site connects a public hostname to a port inside your instance. Every instance starts with one site:web on port 80.
- Add a site for each HTTP app, for example api on port 3000.
- You can have up to 10 sites per instance.
- Use lowercase letters, digits, and dashes for the label.
- If your app listens on another port, change the site's origin port in the Networking tab.
- A hostname can belong to only one site.
Custom domains
Point an A record at your instance's public IP, then attach the domain to the site you want it to serve. HTTPS is issued automatically once DNS resolves.
Practical -- try it now
Attach your domain
- Copy the public IP from Networking.
- At your registrar, add an A record for your domain pointing to that IP.
- In Custom domain, add the domain and choose the site it should serve.
Keep the record DNS-only. If your provider offers a proxy, such as Cloudflare's orange cloud, turn it off. DNS changes can take a few minutes to an hour.
Raw TCP ports
Use Publish a TCP port when your service does not speak HTTP. Choose the port your app listens on inside the instance; the platform gives you a public port.
- Up to 10 published ports per instance, including SSH.
- TCP only. The platform does not add TLS to raw TCP, so secure the service yourself.
- Published ports are open to the internet. Never expose a database without authentication.
- Use Sites for ports 80 and 443 instead of publishing them directly.
Firewall & outbound traffic
- Outbound port 25 is blocked. Use an email provider such as SendGrid, Postmark, or SES.
- Your instance is isolated from other customers' instances.
- Custom inbound firewall rules are not available yet.
To preview an app locally without exposing it, forward the port over SSH:
Need the full walkthrough? Read Custom domains or Raw TCP ports.