Skip to main content

​
DigitalOcean (Static-IP Egress)

Egress routing can give a route a fixed public address your upstream can allowlist. KnoxCall provisions the droplet, reserved IP and firewall for that on a DigitalOcean account — this card holds the token it does it with. Scope: Global defaults only. On KnoxCall Cloud this is KnoxCall’s account. A self-hosted deployment that wants static-IP egress uses its own DigitalOcean account here.

​
1. In DigitalOcean

  1. API → Tokens → Generate New Token.
  2. Custom Scopes — enough is: droplet create/read/delete · reserved_ip create/read/update · firewall create/read/update · project read/update. A legacy Read + Write token also works but grants the whole account.
  3. Pick an expiry and diary it: an expired token fails at provisioning time, not at save time.
  4. Copy the token (dop_v1_…) — shown once.
  5. Optional but recommended: tag the droplet that runs KnoxCall (e.g. knoxcall-control-plane). The egress firewall admits port 8443 only from droplets carrying that tag — the tag is the allowlist, so do not reuse it for anything else.

​
2. Enter it in KnoxCall

Settings → Integrations → Global defaults → DigitalOcean → Configure: Save credentials.

​
3. Verify

Provision one egress server from Egress, confirm it comes up with a reserved IP, route a test request through it, then delete it. A bad token fails on the firewall listing call first.

​
Things that bite

  • Prefer the tag. A stale IP list is the failure mode that looks like a healthy egress server refusing every connection.
  • Environment fallback. With no stored token a self-hosted host falls back to DO_API_TOKEN, so a deleted row does not necessarily disable provisioning.
  • Costs are yours: each egress server is a droplet plus a reserved IP on your account.