Caprover is nice and convenient but security wise, only a single password field is required on the admin console. (See demo here: https://captain.server.demo.caprover.com/#/login)
Given this it would be nice to at least make the web admin console only accessible via an IP whitelist, but last time I used it I did not find an easy way to do that.
I haven’t used it but it appears to serve everything over the same port. You could block it with a reverse proxy but not with a firewall or layer 4 proxy.
