I'm going to a deploy a web app (angular static frontend and node backend in docker) to digital ocean droplet. Deployment is done from Github Action by essentially loging via SSH to the droplet and pulling code from Github, spining up docker and moving static assets to Nginx.

Now I intend to leave only port 443 open for outside traffic, but it seems to me that there's no other way to leave also some port for SSH so further deployments can also be made.

I don't like the idea of leaving this SSH port open. Ideal would be to leave the port open but only for Github action IP - but that's whole range of them so it does not seem viable.

Question is: Am I missing something or I need to have this port open ?

Sorry for maybe a dumb question but I'm web dev and not a security guy.

1 Answer 1


You could use SSLH and keep only port 443 externally open. Internally, you make sslh send the request to your webserver if a TLS connection is received, and to openssh if it's a ssh connection.

If you are using public key authentication on SSH, it's not a big security problem. Your droplet will receive lots and lots of connection requests, but they won't get past the key. If you think on using password authentication, don't. Use public key authentication.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .