diff --git a/scripts/deploy.py b/scripts/deploy.py
index a8b9475..2ed58fe 100644
--- a/scripts/deploy.py
+++ b/scripts/deploy.py
@@ -49,6 +49,31 @@ def check_port(port: int) -> None:
     print(f"Port {port} is available", flush=True)
 
 
+def report_ingress(port: int) -> None:
+    print(f"Host: {socket.gethostname()}", flush=True)
+    if shutil.which("hostname"):
+        run("hostname", "-I")
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
+    for field in ("eipv4", "public-ipv4"):
+        try:
+            with opener.open(f"http://100.100.100.200/latest/meta-data/{field}", timeout=3) as response:
+                address = response.read(100).decode().strip()
+                if re.fullmatch(r"[0-9.]+", address):
+                    print(f"Instance {field}: {address}", flush=True)
+        except Exception:
+            pass
+    if shutil.which("ufw"):
+        state = run("ufw", "status", capture=True)
+        print("UFW status:", state, flush=True)
+    else:
+        print("UFW is not installed", flush=True)
+    if shutil.which("iptables"):
+        rules = run("iptables", "-S", "INPUT", capture=True)
+        print("Host INPUT policy:", rules, flush=True)
+    print(f"Aliyun CLI available: {shutil.which('aliyun') is not None}", flush=True)
+    print(f"Expected public TCP port: {port}", flush=True)
+
+
 def main() -> None:
     if os.geteuid() != 0:
         raise RuntimeError("Deployment requires root on ces-control")
@@ -98,6 +123,7 @@ def main() -> None:
         pending.symlink_to(release)
         pending.replace(current)
         compose(release, "ps")
+        report_ingress(port)
         print(f"Deployed release={sha} image={actual} port={port}", flush=True)