feat(firewall): add deny-by-default host firewall (harden-firewall.sh)

Add a reusable iptables baseline that hardens hosts with ICMP + SSH
defaults and lets deployments register the ports they need. INPUT is
deny-by-default (loopback, established, ICMP, SSH on the configured port,
plus registered ports); OUTPUT stays open and FORWARD is left untouched so
Docker container networking is unaffected.
Persistence is native -- no boot hook. Rules are saved and restored by the
distro's own package (iptables/ip6tables on Alpine, iptables-persistent on
Debian, iptables-services on Alma) via the new oslib helpers
install_iptables / fw_save_cmd / fw_enable_restore. The saved ruleset
carries the INPUT->sshguard jump, so brute-force protection survives reboot
without the old sshguard-iptables hook.
A self-contained /usr/local/sbin/firewall-apply rebuilds INPUT from
declarative drop-ins under /etc/firewall/ports.d and runs the native save,
so deployments add a port without needing the repo present:
  printf '80/tcp\n443/tcp\n' > /etc/firewall/ports.d/mystack.rule
  /usr/local/sbin/firewall-apply
- SSH port read live from sshd_config (custom bastion ports just work);
  FW_SSH_SOURCE restricts the source CIDR; FW_ALLOW_PING gates echo
- harden-ssh.sh / harden-jumphost.sh install it when ENABLE_FIREWALL=1
  (default) and skip the sshguard-only hook; ENABLE_FIREWALL=0 keeps it
- cloud-init base.yml / jumphost.yml forward the toggle
- the four stack deploy.sh open_web_ports() register 80/443 via the
  firewall (ufw/firewalld kept as fallback); Docker-published ports bypass
  INPUT, so this is belt-and-braces and self-documenting
- README + cloud-init/README document the mechanism, Docker caveat, and the
  `disable` recovery path

deployments/beszel/deploy.sh

@@ -83,7 +83,18 @@ install_docker() {
 }
 
 open_web_ports() {
-    if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
+    # Register 80/443 for this stack. Prefer the host firewall (harden-firewall.sh)
+    # when present: drop in a rule file and re-apply. Else fall back to ufw/
+    # firewalld if active (no-op when neither is).
+    #
+    # NOTE: Caddy publishes 80/443 via Docker, which reaches the host through the
+    # nat/FORWARD chains and BYPASSES the INPUT firewall -- so this is harmless
+    # belt-and-braces for any host-bound bind and self-documents the stack ports.
+    if [[ -d /etc/firewall/ports.d && -x /usr/local/sbin/firewall-apply ]]; then
+        log "Registering 80,443/tcp with host firewall..."
+        printf '80/tcp\n443/tcp\n' > /etc/firewall/ports.d/beszel.rule
+        /usr/local/sbin/firewall-apply
+    elif command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
         log "ufw active -- allowing 80,443/tcp..."
         ufw allow 80/tcp >/dev/null; ufw allow 443/tcp >/dev/null
     elif command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then

deployments/headscale/deploy.sh

@@ -101,7 +101,18 @@ install_docker() {
 }
 
 open_web_ports() {
-    if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
+    # Register 80/443 for this stack. Prefer the host firewall (harden-firewall.sh)
+    # when present: drop in a rule file and re-apply. Else fall back to ufw/
+    # firewalld if active (no-op when neither is).
+    #
+    # NOTE: Caddy publishes 80/443 via Docker, which reaches the host through the
+    # nat/FORWARD chains and BYPASSES the INPUT firewall -- so this is harmless
+    # belt-and-braces for any host-bound bind and self-documents the stack ports.
+    if [[ -d /etc/firewall/ports.d && -x /usr/local/sbin/firewall-apply ]]; then
+        log "Registering 80,443/tcp with host firewall..."
+        printf '80/tcp\n443/tcp\n' > /etc/firewall/ports.d/headscale.rule
+        /usr/local/sbin/firewall-apply
+    elif command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
         log "ufw active -- allowing 80,443/tcp..."
         ufw allow 80/tcp >/dev/null; ufw allow 443/tcp >/dev/null
     elif command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then

deployments/pocket-id/deploy.sh

@@ -92,8 +92,18 @@ install_docker() {
 }
 
 open_web_ports() {
-    # Open 80/443 on whichever host firewall is active (no-op otherwise).
-    if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
+    # Register 80/443 for this stack. Prefer the host firewall (harden-firewall.sh)
+    # when present: drop in a rule file and re-apply. Else fall back to ufw/
+    # firewalld if active (no-op when neither is).
+    #
+    # NOTE: Caddy publishes 80/443 via Docker, which reaches the host through the
+    # nat/FORWARD chains and BYPASSES the INPUT firewall -- so this is harmless
+    # belt-and-braces for any host-bound bind and self-documents the stack ports.
+    if [[ -d /etc/firewall/ports.d && -x /usr/local/sbin/firewall-apply ]]; then
+        log "Registering 80,443/tcp with host firewall..."
+        printf '80/tcp\n443/tcp\n' > /etc/firewall/ports.d/pocket-id.rule
+        /usr/local/sbin/firewall-apply
+    elif command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
         log "ufw active -- allowing 80,443/tcp..."
         ufw allow 80/tcp >/dev/null; ufw allow 443/tcp >/dev/null
     elif command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then

deployments/webfinger/deploy.sh

@@ -89,7 +89,18 @@ install_docker() {
 }
 
 open_web_ports() {
-    if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
+    # Register 80/443 for this stack. Prefer the host firewall (harden-firewall.sh)
+    # when present: drop in a rule file and re-apply. Else fall back to ufw/
+    # firewalld if active (no-op when neither is).
+    #
+    # NOTE: Caddy publishes 80/443 via Docker, which reaches the host through the
+    # nat/FORWARD chains and BYPASSES the INPUT firewall -- so this is harmless
+    # belt-and-braces for any host-bound bind and self-documents the stack ports.
+    if [[ -d /etc/firewall/ports.d && -x /usr/local/sbin/firewall-apply ]]; then
+        log "Registering 80,443/tcp with host firewall..."
+        printf '80/tcp\n443/tcp\n' > /etc/firewall/ports.d/webfinger.rule
+        /usr/local/sbin/firewall-apply
+    elif command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
         log "ufw active -- allowing 80,443/tcp..."
         ufw allow 80/tcp >/dev/null; ufw allow 443/tcp >/dev/null
     elif command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then