Legendary Arena Lab

UFW Firewall

foundations

Migration in progress. api.legendary-arena.com and PostgreSQL are moving from Render to a self-hosted DigitalOcean Ubuntu host behind Cloudflare. Render remains rollback-ready until decommission phase.

UFW Firewall

Apply a default-deny inbound posture while preserving remote management and API ingress.

Summary

This page owns infra/scripts/06-ufw.ps1, which applies:

  • default deny incoming
  • default allow outgoing
  • inbound allow for SSH
  • inbound allow for 80/tcp and 443/tcp

Later, cloudflare-tls tightens 443 ingress to Cloudflare IP ranges.

Execute

	sudo pwsh -File infra/scripts/06-ufw.ps1

Optional SSH port override:

	sudo SSH_PORT=22 pwsh -File infra/scripts/06-ufw.ps1

Verification

sudo ufw status verbose

Expected:

  • Status: active
  • Default: deny (incoming), allow (outgoing)
  • Rules include SSH, 80/tcp, and 443/tcp

Safety notes

  • Keep an active SSH session open while applying firewall rules.
  • Confirm a new SSH login before closing existing sessions.
  • Do not remove SSH allow rules until out-of-band access exists.

References

  • Plan section 4.1 (ufw-firewall.md stub)
  • Plan section 5.1 (Access hardening sequence)