Scan yourself to see what is really exposed

ss -lntp shows the host's view. Security groups, upstream firewalls and NAT change what is actually reachable.

Scan from outside:

nmap -Pn -p- --min-rate 2000 <your public ip>

-Pn skips host discovery, which many hosts block anyway; -p- covers all ports. Compare the result with ss locally — extra ports usually mean a security group left open or a Docker publish you forgot.

Scanning your own host is fine; scanning others is not. Keep the rate modest, since some providers treat port scans as attacks.

Do it after adding services. It is common to believe only 443 is open while 8080 listens on 0.0.0.0.