ufw | minimalist framework for rapid server side applications | HTTP library

Created a separate application load balancer for the backend instance and then created a cloudfront distribution for this instance. The DNS name of the cloudfront can then be used to access the backend from the frontend.

Correct docker container command is :

As stated in the front page of the repository of the role you are trying to install:

Ansible weareinteractive.ufw role

^{Source: https://github.com/weareinteractive/ansible-ufw#ansible-weareinteractiveufw-role}

It is a role and not a collection.

Although the two syntaxes might lookalike, they actually don't totally have the same syntax.
For a role, first, you don't install them via

there is a issue between Docker and UFW. UFW does not control the ports opened by Docker and unfortuantely this state of affairs does not show up on ufw status as well. there are many proposed solutions on this which you can google up but the one that i found most useful for me is:

https://jorisvergeer.nl/2019/11/03/let-docker-and-ufw-work-nicely/

however, since you are on DigitalOcean, a simpler way might be to create a DigitalOcean Firewall which only allows the authorised IP to access Droplet B at the port allowed. after you setup the firewall, place Droplet B inside and that should control the traffic to Droplet B well.

Based on your mongod.conf file, MongoDB will run on port 27042. When you run the command mongo without parameter --port, it will connect to the default port 27017 then you have the error.

I think this command mongo --port 27042 will work.

A Localhost bound IP won't expose to the external network, try to bind it with URL --urls="https://0.0.0.0:443". 0.0.0.0 which stands for all IP Addresses. You can access it internally and externally.

Also, you could check if any firewall blocked via Virtual machine---Connection troubleshoot---test inbound or outbound connection from Azure portal.

While I cannot filter by IP it seems as if one must first accept the connection in order to authenticate the client. I only want devices that possess an allowed key ..

Since you want to authenticate a client based on actual data (the key or proof of possession of the key) then you must first have a connection able to transfer the data from the client. With TCP this means that you have to accept the connection.

... whether this leaves me open to any vulnerabilities.

This is the usual way to go but it leaves you open to denial of service attacks. Creating a new connection takes resources, so by opening lots of connections an attacker can exhaust server resources. If all resources are exhausted this way even valid users can no longer access the server. See for example the SYN flood attack.

Depending on the setup of the client additional protections can be added. But these are outside of the python application and mostly out of scope of this question. But to get some ideas see the section about countermeasures in the Wikipedia article.

Yesterday I tried to install Ejabberd first through souce code

Just curiosity: what problems did you find, that prefered to use the Ubuntu package?

Did you install from source code? If so, did you later uninstall it? Maybe uninstallation left some files there (there was some bug related to that in make uninstall)... it will help if you can take a look at the installation paths and remove the remaining ejabberd files and directories, specially the file ejabberdctl.

and then with Ubuntu specific packages

Well, it could be that both installations get mixed... or maybe the Ubuntu package has some problem unrelated to your previous installation. Keep all investigation lines open :)

{"init terminating in [do_boot",{undef,[{ejabberd_ctl,start,[],

This error message says that erlang cannot find the file ejabberd_ctl.beam, or that the file doesn't define the function start.

Just a wild idea: maybe you are running the "ejabberdctl" script from source installation (pointing to the old ejabberd beam files), but now you have the ejabberd beam files installed in a different location (by the Ubuntu package).

From your Ingress definition, I see you set-up as ingress class nginx