- Every published port, marked open to everyone or limited by an allowlist; databases open to everyone stand out
- Asked live on every server: what really listens, service containers, dockxo's own ports, and programs dockxo does not know about
- Every domain's certificate with issuer, expiry and state; late renewals and expiring certificates first
- Let's Encrypt's own reason for each refused domain, e.g. NXDOMAIN or a wrong A record
- Check from outside: the certificate visitors get, whether browsers trust it, where DNS points, Cloudflare errors such as 526
- One certificate per domain, so a broken domain never holds back the others
What the internet can reach
Security in the menu shows the number of ports open to everyone, and the page lists them. First what services publish, each marked open to everyone or limited by an allowlist; a database or cache open to the whole internet stands out. Then, asked live on every server, what it really listens on: service containers, dockxo’s own ports (Traefik, SSH, the agent), and anything dockxo does not know about, such as a container started by hand, one left behind by a deleted service, or a program installed on the server, with its name. It also catches an allowlist set in the panel but missing on the server.
Every certificate, in one place
Settings → SSL lists every domain with the certificate its server holds: issuer, expiry date, days left, and a state. Valid, renewal late (Let’s Encrypt renews 30 days ahead, so under 25 means renewal is failing), expiring, expired, not issued yet, or could not be issued, with Let’s Encrypt’s own reason for that domain. Problems come first.
Each domain gets its own certificate, so one domain whose DNS is wrong never blocks the rest, and a service with hundreds of domains stays under Let’s Encrypt’s limits.
What visitors actually get
Check from outside connects to every domain the way a browser does and shows the certificate served and whether it is trusted: expired, self-signed, issued for another name, or a name that does not resolve. It shows where each domain’s DNS points: the server, Cloudflare’s proxy, another of your servers, or somewhere else entirely, which is how an expired domain parked by its registrar shows up. Behind Cloudflare it also reads the page status, so Cloudflare’s own errors (521, 522, 525, 526) appear even though its certificate is valid.