feat(firewall): add deny-by-default host firewall (harden-firewall.sh)

Add a reusable iptables baseline that hardens hosts with ICMP + SSH
defaults and lets deployments register the ports they need. INPUT is
deny-by-default (loopback, established, ICMP, SSH on the configured port,
plus registered ports); OUTPUT stays open and FORWARD is left untouched so
Docker container networking is unaffected.
Persistence is native -- no boot hook. Rules are saved and restored by the
distro's own package (iptables/ip6tables on Alpine, iptables-persistent on
Debian, iptables-services on Alma) via the new oslib helpers
install_iptables / fw_save_cmd / fw_enable_restore. The saved ruleset
carries the INPUT->sshguard jump, so brute-force protection survives reboot
without the old sshguard-iptables hook.
A self-contained /usr/local/sbin/firewall-apply rebuilds INPUT from
declarative drop-ins under /etc/firewall/ports.d and runs the native save,
so deployments add a port without needing the repo present:
  printf '80/tcp\n443/tcp\n' > /etc/firewall/ports.d/mystack.rule
  /usr/local/sbin/firewall-apply
- SSH port read live from sshd_config (custom bastion ports just work);
  FW_SSH_SOURCE restricts the source CIDR; FW_ALLOW_PING gates echo
- harden-ssh.sh / harden-jumphost.sh install it when ENABLE_FIREWALL=1
  (default) and skip the sshguard-only hook; ENABLE_FIREWALL=0 keeps it
- cloud-init base.yml / jumphost.yml forward the toggle
- the four stack deploy.sh open_web_ports() register 80/443 via the
  firewall (ufw/firewalld kept as fallback); Docker-published ports bypass
  INPUT, so this is belt-and-braces and self-documenting
- README + cloud-init/README document the mechanism, Docker caveat, and the
  `disable` recovery path

cloud-init/README.md

@@ -7,8 +7,8 @@ before invoking the scripts.
 
 | Template | What it does |
 |----------|--------------|
-| [`base.yml`](base.yml) | Hostname (per the schema) + shared MOTD + seed root keys from `globals/` + SSH hardening (`harden-ssh.sh`). |
-| [`jumphost.yml`](jumphost.yml) | Same base, but bastion hardening (`harden-jumphost.sh`) with an `ssh-admins`/`ssh-jumpers` split and a ProxyJump whitelist. |
+| [`base.yml`](base.yml) | Hostname (per the schema) + shared MOTD + seed root keys from `globals/` + SSH hardening (`harden-ssh.sh`) + deny-by-default host firewall (`harden-firewall.sh`, `ENABLE_FIREWALL=1`). |
+| [`jumphost.yml`](jumphost.yml) | Same base, but bastion hardening (`harden-jumphost.sh`) with an `ssh-admins`/`ssh-jumpers` split and a ProxyJump whitelist; same host firewall. |
 
 These are for the **host itself**. To stand up a Docker stack on a host,
 use the per-deployment `cloud-init.yml` under `deployments/<name>/` instead
@@ -20,7 +20,7 @@ use the per-deployment `cloud-init.yml` under `deployments/<name>/` instead
    and the other values at the top of the `runcmd` block.
 2. Paste it as the instance's **user-data** when creating the VM.
 3. On first boot the host names itself, installs the MOTD, seeds admin keys
-   from `globals/`, and hardens SSH.
+   from `globals/`, hardens SSH, and brings up the deny-by-default firewall.
 
 Hostnames follow [`../globals/Network Domain Name Schema.md`](../globals/Network%20Domain%20Name%20Schema.md);
 our VMs skip the region code and use `srvno.de` as the base.

cloud-init/base.yml

@@ -30,6 +30,8 @@ runcmd:
     SSH_PORT=22
     ALLOWED_IP=                      # optional: whitelist your client IP in sshguard
     AUTO_UPDATE=1                    # schedule daily unattended updates (0 to skip)
+    ENABLE_FIREWALL=1                # deny-by-default host firewall (0 to skip)
+    OPEN_PORTS=""                    # extra inbound ports, e.g. "80/tcp 443/tcp"
     # ==================
 
     # Prerequisites (OS-agnostic).
@@ -50,5 +52,7 @@ runcmd:
       && resolve_ssh_keys >> /root/.ssh/authorized_keys || true
     sort -u /root/.ssh/authorized_keys -o /root/.ssh/authorized_keys 2>/dev/null || true
 
-    # SSH hardening (key-only, PQ KEX, sshguard).
-    SSH_PORT="$SSH_PORT" ALLOWED_IP="$ALLOWED_IP" FORCE=1 bash scripts/harden-ssh.sh
+    # SSH hardening (key-only, PQ KEX, sshguard) + deny-by-default host firewall.
+    SSH_PORT="$SSH_PORT" ALLOWED_IP="$ALLOWED_IP" \
+    ENABLE_FIREWALL="$ENABLE_FIREWALL" OPEN_PORTS="$OPEN_PORTS" \
+    FORCE=1 bash scripts/harden-ssh.sh

cloud-init/jumphost.yml

@@ -25,6 +25,7 @@ runcmd:
     DATACENTER="Globally Everywhere"
     SSH_PORT=22
     ALLOWED_IP=                      # optional: whitelist your client IP
+    ENABLE_FIREWALL=1                # deny-by-default host firewall (0 to skip)
     JUMP_TARGETS="10.0.0.5:22 10.0.0.6:22"   # hosts jumpers may ProxyJump to
     # Optional login notifications (pam_exec -> ntfy). Leave NTFY_URL empty to
     # skip. NTFY_REGION defaults to the region segment of this host's FQDN.
@@ -55,5 +56,6 @@ runcmd:
     # Bastion hardening (admins shell + jumpers ProxyJump whitelist + optional
     # login notifications).
     SSH_PORT="$SSH_PORT" ALLOWED_IP="$ALLOWED_IP" JUMP_TARGETS="$JUMP_TARGETS" \
+    ENABLE_FIREWALL="$ENABLE_FIREWALL" \
     NTFY_URL="$NTFY_URL" NTFY_TOKEN="$NTFY_TOKEN" NTFY_EMAIL="$NTFY_EMAIL" NTFY_REGION="$NTFY_REGION" \
     FORCE=1 bash scripts/harden-jumphost.sh