Firewall¶

Overview¶

Firewall rules are managed at two layers: UFW on the server (via Ansible) and Hetzner's network firewall (manual).

By default, all inbound traffic is denied. In lockdown mode, SSH is accessible only through Cloudflare Zero Trust — no direct public SSH port is exposed.

UFW (Ansible-managed)¶

All UFW rules are managed through Ansible via the firewall_ufw role. Do not make manual changes directly on a server — they will be overwritten the next time Ansible runs.

Always apply firewall changes through the Ansible configuration to ensure consistency and persistence across environments.

IP allowlists (office, Plecto, Supermetrics, etc.) are defined in group_vars/all/allowlist.yml and used by the role to grant source-restricted access to specific ports such as MySQL.

Hetzner firewall (manual)¶

The Hetzner cloud firewall is not yet managed via Ansible. Whenever significant changes are made to a server — new services, ports, or infrastructure changes — review and update the Hetzner firewall rules manually to ensure the correct access rules are in place.