#!/usr/bin/env bash
# Firewall: only 22/80/443 need to be public (all 6 inbounds + 3x-ui are 127.0.0.1-only,
# reverse-proxied through nginx on 443). NOTE: on AWS the Security Group is the outer gate
# and must also allow inbound 22/80/443 — ufw alone is not enough.
. "$(dirname "$0")/_lib.sh"

run 'for p in 22 80 443; do ufw allow "$p"/tcp >/dev/null 2>&1; done
     yes | ufw enable >/dev/null 2>&1 || true
     ufw status verbose | grep -E "22|80|443|Status"'