09 Oct 2026 · infrastructure · 2 min

Serving a static site with no open ports

Publishing a website usually means opening ports 80 and 443 on the server, pointing DNS at its address and issuing a certificate. On this server no port is open to the internet, and the site still works.

How the traffic arrives

Access goes through an outbound tunnel. A process inside the machine opens a connection to the provider and keeps it alive. When someone visits the domain, the request travels back down that established connection and reaches the server from the inside.

Because no service listens on the public address, a port scan finds nothing, and the machine’s firewall denies by default.

Routing by name

Behind the tunnel, the reverse proxy picks the destination from the request’s Host header, not from the IP address. The same proxy serves every service, and each new name is one more rule in the same configuration.

Host(`josetilabs.com`)      -> folder with this site's files
Host(`painel.interno...`)   -> deployment panel
Host(`app.interno...`)      -> application

Static pages

Pages that do not change per visit need no framework, no database and no build step. They are files in a folder on the server, and a small container serves that folder. Publishing becomes writing a file.

This blog follows that model: HTML, CSS and fonts served from the folder, with no build and no third-party dependency in the browser. Texts are written in a separate area that writes the files into the same folder and answers only inside the private network.

What it costs

One extra process running, and a dependency on the provider that terminates the connection at the edge. Neither of them requires a paid plan.

In exchange, there is no exposed inbound port, certificate renewal happens outside the machine, and a new service goes live with one routing rule, without touching the firewall.