@WillFG you should be good only exposing 443 for now. Note that we’ll soon require 3128 as well for device SSH.
The Python SDK currently cannot target an open-balena instance – it still assumes the full balenaCloud API.
Regarding the env vars issue you’re seeing, can you please make sure you completely remove previous CLI versions before updating – NPM might not pick up new versions of dependencies.