first commit

roles/firewall/config.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Declarative firewall configuration with common + profile-specific rules
+source "$PROJECT_DIR/lib.sh"
+enable_strict_mode
+
+cat <<'EOM'
+
+=> Firewall configuration
+
+EOM
+
+ufw_initialize
+
+COMMON_RULES_FILE="$ROLE_DIR/firewall/rules.common.list"
+PROFILE_RULES_FILE="$ROLE_DIR/firewall/rules.${profile:-}.list"
+
+apply_ufw_rules_file "$COMMON_RULES_FILE"
+apply_ufw_rules_file "$PROFILE_RULES_FILE"
+
+ufw reload
+log_ok "Firewall rules applied"

roles/firewall/rules.common.list

@@ -0,0 +1 @@
+# Common firewall rules

roles/firewall/rules.desktop.list

@@ -0,0 +1 @@
+# Desktop-specific firewall rules

roles/firewall/rules.devel.list

@@ -0,0 +1,2 @@
+# Development-specific firewall rules
+# 3000/tcp

roles/firewall/rules.server.list

@@ -0,0 +1,8 @@
+# Server-specific firewall rules
+ssh
+http
+https
+imap
+imaps
+smtp
+submissions