Skip to content
Nearzero
Star us

Add another VPS. Send traffic straight to it.

Keep Nearzero on one host. Connect a Linux server over SSH. Public traffic hits Traefik on that box. Keep Docker and management ports private.

01

Prepare the workload host

Use a dedicated Linux server with a stable public IPv4 address. Create a dedicated SSH account for Nearzero, restrict inbound SSH, and treat Docker access as root-equivalent.

Stable address

Managed A records target the server selected for each service. Avoid an address that changes without coordinated DNS updates.

Dedicated SSH identity

Use Nearzero’s generated public key and protect or rotate the corresponding private key.

Provider firewall

Host rules cannot override a cloud security group, router, or NAT. Configure both layers deliberately.

Unoccupied web ports

Traefik needs TCP 80 and 443. Remove conflicting listeners before setup.

02

Connect it in Nearzero

  1. 01
    Create or select an SSH key

    Open Settings → Servers → SSH keys and place the displayed public key in the remote account’s authorized_keys.

  2. 02
    Add the server

    Provide its stable public IP or hostname, SSH port, dedicated user, and the correct key.

  3. 03
    Verify the first host key

    Compare the recorded OpenSSH SHA-256 fingerprint with a trusted provider console or another independent channel.

  4. 04
    Run setup intentionally

    Nearzero installs and validates Docker, Swarm, Traefik, build tools, paths, and monitoring only after you request setup.

  5. 05
    Deploy a non-production service first

    Confirm logs, routing, certificate issuance, and the effective firewall before assigning production.

03

Open only what Traefik needs

TrafficScopeWhy
80/TCPPublicTraefik redirects and Let’s Encrypt HTTP-01 validation.
443/TCPPublicHTTPS application traffic.
443/UDPOptional publicHTTP/3 only; not required for certificate validation.
22/TCP or custom SSHControl plane and admin rangesSetup and maintenance.
2375–2376/TCPNever publicDocker API/proxy access is host-privileged.
8080/TCPNever publicTraefik dashboard must remain private.
4500/TCPNever publicMonitoring is an internal service.
2377/TCP, 7946/TCP+UDP, 4789/UDPTrusted Swarm peers onlyCluster control, gossip, and overlay networking.

Single-node servers do not need public Swarm ports. Never expose the peer network at the public perimeter.

04

Traefik and Docker stay private

  • Never publish the socket proxy, its network, or the Traefik dashboard.
  • Do not attach application workloads to nearzero-traefik-control.
  • Put only mutually trusted deployers on one Docker host.
  • Treat arbitrary privileged Compose deployments as full host-administrator access.
  • Rotate the SSH key and investigate the host after any unexplained fingerprint change.
05

Check from outside the server

Use the same public path your users will take. Re-run after setup, firewall changes, and every reboot.

external verification 
# Run from a trusted network after server setup
curl --fail --show-error --head https://app.example.com

# Confirm that management-only ports are not public
nc -vz <server-ip> 8080
nc -vz <server-ip> 2375
nc -vz <server-ip> 2376

Questions this page answers

Can Nearzero deploy to another VPS?

Yes. Keep the control plane on one host, add other Linux servers over SSH, and choose where each app or database runs. Public traffic can go straight to that server.

Which ports should be public on a remote Nearzero server?

Usually 80 and 443 for Traefik. Keep SSH, Docker, Swarm, and Nearzero management ports off the public internet.