refactor: cleanup ufw rules

- use nginx ful rules
- limit ssh by default
- force enable ufw
- drop access to 2375 and 2376 (this allows passwordless docker access...)

contrib/images/digitalocean/files/etc/update-motd.d/99-one-click

@@ -8,8 +8,7 @@ cat <<EOF
 
 Welcome to DigitalOcean's 1-Click Dokku Droplet.
 To keep this Droplet secure, the UFW firewall is enabled. 
-All ports are BLOCKED except 22 (SSH), 80 (HTTP), 443 (HTTPS),
-2375 (Docker) and 2376 (Docker).
+All ports are BLOCKED except 22 (SSH), 80 (HTTP), 443 (HTTPS).
 
 In a web browser, you can view:
  * The Dokku One-Click Quickstart guide: http://do.co/dokku1804#start

contrib/images/digitalocean/in_parts/014-ufw-rules

@@ -5,8 +5,7 @@ echo '--> Enable and configure UFW'
 sed -e 's|DEFAULT_FORWARD_POLICY=.*|DEFAULT_FORWARD_POLICY="ACCEPT"|g' \
   -i /etc/default/ufw
 
-ufw allow ssh
-ufw allow http
-ufw allow https
-ufw allow 2375/tcp
-ufw allow 2376/tcp
+ufw limit ssh
+ufw allow 'Nginx Full'
+
+ufw --force enable