diff --git a/hub/setup-opds.sh b/hub/setup-opds.sh
index 69932f8..00c4c9f 100755
--- a/hub/setup-opds.sh
+++ b/hub/setup-opds.sh
@@ -231,6 +231,14 @@ fi
 
 info "Caddyfile written to ${CADDY_DIR}/Caddyfile"
 
+header "Firewall Check"
+warn "Caddy requires ports 80 and 443 to be open on this server."
+warn "If using a cloud firewall (e.g. Linode), ensure inbound TCP rules allow:"
+warn "  Port 80  — required for Let's Encrypt HTTP challenge and HTTP→HTTPS redirect"
+warn "  Port 443 — required for HTTPS"
+echo ""
+read -rp "Press ENTER to continue once ports are open..."
+
 header "Starting Caddy"
 docker rm -f caddy-opds 2>/dev/null || true