recipe_debian_firewall.ts

Debian/Ubuntu firewall — the neutral web-host allow set wired to ufw. The neutral rule set lives in recipe_firewall.ts; the Alpine sibling is recipe_alpine_firewall.ts.

ufw persists its own rules across reboot (ufw --force enable), so — unlike the Alpine/nftables sibling — this needs no companion persistence service.

Pure function evaluated in zap's sandboxed config eval (fgro eval).

view source

Declarations
#

debian_web_firewall
#

recipe_debian_firewall.ts view source

(options?: WebFirewallOptions | undefined): Pick<FirewallResource, "allow" | "backend"> import {debian_web_firewall} from '@fuzdev/zap/recipe_debian_firewall.js';

Build the ufw firewall payload for a web host (SSH + HTTP + HTTPS).

Spread into a zap.firewall({id, ...debian_web_firewall()}). Leaves default_incoming / default_outgoing at the schema defaults (deny in, allow out).

options?

type WebFirewallOptions
optional

returns

Pick<FirewallResource, "backend" | "allow">

the backend + allow for a ufw firewall resource.

Depends on
#