What to open in a firewall

Spottr needs one way in and one way out: people and download clients reach its port, and Spottr reaches your news server. Everything else below applies only if you switched that feature on. The list comes from the code: these are the only places Spottr opens a connection to.

In

From	To	Port	Why
People, through the proxy in front of Spottr	the proxy	443/tcp	The pages.
That proxy	the Spottr container	8080/tcp	The only port Spottr listens on. Plain HTTP; TLS ends at the proxy.
Prowlarr, Sonarr, Radarr	the Spottr container	8080/tcp	The Newznab API (`/api`) and the NZB links, with the API key. Directly, not through a signing-in proxy.
SABnzbd or another download client	the Spottr container	8080/tcp	Fetching an NZB from a link Prowlarr handed out (with the API key). Not needed for Send to SABnzbd, which uploads the file.
The container's health check, monitoring	the Spottr container	8080/tcp	`/healthz`, `/readyz`.

There is no separate admin port and nothing that connects in from Usenet.

Out

To	Port	Why	Needed when
Your news server (`NNTP_HOST`)	563/tcp with TLS, 119/tcp without	Everything: the group's overview, spot headers and descriptions, NZBs and covers, all read from Usenet. At most `NNTP_MAX_CONNS` connections.	Always.
SABnzbd (`SAB_HOST`:`SAB_PORT`)	8080/tcp by default	Sending an NZB, its categories, the queue.	`SAB_HOST` is set.
The blacklist or whitelist host	443/tcp	Fetching the spotter list every 12 hours (`spotlist.store` for the list Spotweb uses).	`BLACKLIST_URL` or `WHITELIST_URL` is set.

Nothing else: no update check, no telemetry, and covers come from Usenet, not from the web. An image link in a spot's description that points at a website is not fetched by Spottr.