pull down to refresh

For reference, what ports would need to be open on the node to the internet in order to operate tunnelsats?

TCP 443, I suppose.
TCP 80 as well?
any more?

None.
Since your node will initiate the tunnel client-sides to our servers, all LN related ports will go through the tunnel. So neither 443 (https) nor 80 (web) are required.