From 4f23dd2dd6b8f6ab8b3b3b551b95689e5f88b7af Mon Sep 17 00:00:00 2001
From: Jose Diaz-Gonzalez <email@josediazgonzalez.com>
Date: Sun, 12 May 2019 06:09:05 -0400
Subject: [PATCH] docs: Warn users when ufw is enabled

Closes #3455
---
 contrib/dokku-installer.py         | 13 +++++++++++++
 docs/networking/port-management.md |  2 ++
 2 files changed, 15 insertions(+)

diff --git a/contrib/dokku-installer.py b/contrib/dokku-installer.py
index 7b2f6fd97..a9c7da228 100755
--- a/contrib/dokku-installer.py
+++ b/contrib/dokku-installer.py
@@ -37,6 +37,15 @@ if os.path.isfile(key_file):
     except subprocess.CalledProcessError:
         pass
 
+ufw_display = 'block'
+try:
+    command = "sudo ufw status"
+    ufw_output = subprocess.check_output(command, shell=True).strip()
+    if "inactive" in ufw_output:
+        ufw_display = 'none'
+except subprocess.CalledProcessError:
+    ufw_display = 'none'
+
 
 def check_boot():
     if 'onboot' not in sys.argv:
@@ -77,6 +86,7 @@ def check_boot():
 class GetHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
     def do_GET(self):
         content = PAGE.replace('{VERSION}', VERSION)
+        content = content.replace('{UFW_DISPLAY}', ufw_display)
         content = content.replace('{HOSTNAME}', hostname)
         content = content.replace('{AUTHORIZED_KEYS_LOCATION}', key_file)
         content = content.replace('{ADMIN_KEYS}', "\n".join(admin_keys))
@@ -294,6 +304,9 @@ PAGE = """
             <small class="form-text text-muted">When enabled, Nginx will be run on port 80 and proxy requests to apps based on hostname.</small>
             <small class="form-text text-muted">When disabled, a specific port will be setup for each application on first deploy, and requests to that port will be proxied to the relevant app.</small>
           </div>
+          <div class="alert alert-warning small mt-3 d-{UFW_DISPLAY}" role="alert">
+            <strong>Warning:</strong> UFW is active. To allow traffic to specific ports, run <code>sudo ufw allow PORT</code> for the port in question.
+          </div>
           <div class="bd-callout bd-callout-info">
             <h5>What will app URLs look like?</h5>
             <pre><code id="example">http://hostname:port</code></pre>
diff --git a/docs/networking/port-management.md b/docs/networking/port-management.md
index 3bd6db47e..94c07c486 100644
--- a/docs/networking/port-management.md
+++ b/docs/networking/port-management.md
@@ -14,6 +14,8 @@ In Dokku 0.5.0, port proxying was decoupled from the `nginx-vhosts` plugin into
 
 ## Usage
 
+> Warning: Mapping alternative ports may conflict with the active firewall installed on your server or hosting provider. Such software includes - but is not limited to - AWS Security Groups, iptables, and UFW. Please consult the documentation for those softwares as applicable.
+
 ### Proxy port mapping
 
 > New as of 0.6.0