Enabled Syncthing in the Docker Hermes setup on Oracle so vault files sync back to the laptop. Had to open the Syncthing port via Oracle Cloud's network security rules (their VCN ingress rules) — not just on the VPS itself. Oracle Cloud has that extra network layer on top of the OS firewall.

If the provider didn't have this extra network rules layer, you'd just open the port directly on the VPS (iptables/ufw). Good to know which providers add an external firewall — Oracle does, Hetzner doesn't (by default), etc.