since i am completely new to web hosting and setting up web servers, please excuse my dumb questions ;)
Yesterday i uploaded my web application on digitalocean. The application is a very simple website with user login (build with Python) to display resulting data from periodical tasks (executing a long running task one time per day and very short running tasks every minute).
Everything is build with docker. The whole stack comprises the webserver (NGINX), database server (mariadb) and message broker (rabbitmq, needed for the periodic tasks).
After i fired up the application everything ran stable for about 2 hours, until it crashed for the first time (little issue with the database connection). To discover what specifically caused the crash i logged into the logs of the mariadb container and i saw the following (beside the real cause of the crash):
[Warning] Access denied for user 'chucky'@'184.108.40.206' (using password: YES)
The thing is, i am the only user and i didn't set up a user named 'chucky'. So for me it looks like somebody found out the IP address of my digitalocean droplet and tried to logged into the website. Do i interprete this correctly? If so, i am totally wondering how somebody could find out the IP address of a new, fresh droplet so quickly?
Beside that i was wondering how somebody would "hack" the droplet if nothing is installed. So only the raw, empty droplet - nothing installed. Is that even possible or must there always be a webserver (or database server), serving as some kind of "gateway", to get access to the server's file system?
Thank you guys in advance and I am very curious to hear your answers.