Open HTTP and HTTPS

Nginx installs UFW application profiles. Inspect the names and the ports behind the combined profile before using it:

sudo ufw app list
sudo ufw app info "Nginx Full"

Nginx Full should allow TCP ports 80 and 443. Port 80 is needed for ordinary HTTP and common certificate validation flows. Port 443 carries HTTPS.

Add the rule and inspect the complete public surface:

sudo ufw allow "Nginx Full"
sudo ufw status numbered

Keep the OpenSSH rule. The intended inbound list is now SSH, HTTP, and HTTPS. The application port we will use later must remain private on 127.0.0.1.

Test HTTP from your own computer, not from the Droplet:

curl -I http://203.0.113.10

An HTTP response proves that the process, host firewall, provider firewall, and public route all agree. A local curl test could not prove those outer layers.

If the request times out while local HTTP works, compare sudo ufw status, the DigitalOcean Cloud Firewall, and the Droplet address. A provider firewall can block traffic before UFW sees it. If the connection is refused, check sudo ss -lntp and Nginx service state.

To roll back an accidental UFW rule, find its number with sudo ufw status numbered and delete that number. Never delete the SSH rule until a deliberate replacement access path has been tested.

Your action is to verify the three intended services in UFW and obtain an HTTP response from outside the server. HTTPS will not work yet; we first need a domain and certificate.