From 9dc6d8e1305c9028bf7d199b082896ffe88b0497 Mon Sep 17 00:00:00 2001
From: Jose Diaz-Gonzalez <email@josediazgonzalez.com>
Date: Thu, 16 Feb 2023 14:47:52 -0500
Subject: [PATCH] refactor: cleanup ufw rules

- use nginx ful rules
- limit ssh by default
- force enable ufw
- drop access to 2375 and 2376 (this allows passwordless docker access...)
---
 .../digitalocean/files/etc/update-motd.d/99-one-click    | 3 +--
 contrib/images/digitalocean/in_parts/014-ufw-rules       | 9 ++++-----
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/contrib/images/digitalocean/files/etc/update-motd.d/99-one-click b/contrib/images/digitalocean/files/etc/update-motd.d/99-one-click
index 865183476..394b4e9ee 100755
--- a/contrib/images/digitalocean/files/etc/update-motd.d/99-one-click
+++ b/contrib/images/digitalocean/files/etc/update-motd.d/99-one-click
@@ -8,8 +8,7 @@ cat <<EOF
 
 Welcome to DigitalOcean's 1-Click Dokku Droplet.
 To keep this Droplet secure, the UFW firewall is enabled. 
-All ports are BLOCKED except 22 (SSH), 80 (HTTP), 443 (HTTPS),
-2375 (Docker) and 2376 (Docker).
+All ports are BLOCKED except 22 (SSH), 80 (HTTP), 443 (HTTPS).
 
 In a web browser, you can view:
  * The Dokku One-Click Quickstart guide: http://do.co/dokku1804#start
diff --git a/contrib/images/digitalocean/in_parts/014-ufw-rules b/contrib/images/digitalocean/in_parts/014-ufw-rules
index 5665ea827..0488f0d1e 100755
--- a/contrib/images/digitalocean/in_parts/014-ufw-rules
+++ b/contrib/images/digitalocean/in_parts/014-ufw-rules
@@ -5,8 +5,7 @@ echo '--> Enable and configure UFW'
 sed -e 's|DEFAULT_FORWARD_POLICY=.*|DEFAULT_FORWARD_POLICY="ACCEPT"|g' \
   -i /etc/default/ufw
 
-ufw allow ssh
-ufw allow http
-ufw allow https
-ufw allow 2375/tcp
-ufw allow 2376/tcp
+ufw limit ssh
+ufw allow 'Nginx Full'
+
+ufw --force enable