nordisk/monetize

crates/mock-upcloud/tests/fixtures/one-box-firewall-5777f7e.tf

resource "upcloud_firewall_rules" "admin" {
  server_id = upcloud_server.admin.id

  firewall_rule {
    action                 = "accept"
    comment                = "HTTPS — the console, the estates' calls to monetize, the Stripe webhooks"
    direction              = "in"
    family                 = "IPv4"
    protocol               = "tcp"
    destination_port_start = "443"
    destination_port_end   = "443"
    source_address_start   = "0.0.0.0"
    source_address_end     = "255.255.255.255"
  }

  firewall_rule {
    action                 = "accept"
    comment                = "HTTP — the ACME HTTP-01 challenge that issues and renews the certificate, and the redirect to 443"
    direction              = "in"
    family                 = "IPv4"
    protocol               = "tcp"
    destination_port_start = "80"
    destination_port_end   = "80"
    source_address_start   = "0.0.0.0"
    source_address_end     = "255.255.255.255"
  }

  firewall_rule {
    action                 = "accept"
    comment                = "The installer's WireGuard link (nordisk-pairing installer_link) — the operator only"
    direction              = "in"
    family                 = "IPv4"
    protocol               = "udp"
    destination_port_start = "51821"
    destination_port_end   = "51821"
    source_address_start   = var.admin_ipv4_start
    source_address_end     = var.admin_ipv4_end
  }

  firewall_rule {
    action                 = "accept"
    comment                = "The operator's door (mutual TLS under the box's installer CA): the solo feed after the install"
    direction              = "in"
    family                 = "IPv4"
    protocol               = "tcp"
    destination_port_start = "8475"
    destination_port_end   = "8475"
    source_address_start   = var.admin_ipv4_start
    source_address_end     = var.admin_ipv4_end
  }

  # The answers to what it asks (UpCloud's firewall does not track a flow —
  # MEASURED on test2 2026-09-28): DNS from :53, and HTTPS from :443 to the box's
  # ephemeral ports (xtask firewall.rs, FW-1) (the
  # cloud provider's API, Stripe, Let's Encrypt).
  firewall_rule {
    action               = "accept"
    comment              = "DNS answers"
    direction            = "in"
    family               = "IPv4"
    protocol             = "udp"
    source_port_start    = "53"
    source_port_end      = "53"
    source_address_start = "0.0.0.0"
    source_address_end   = "255.255.255.255"
  }

  firewall_rule {
    action               = "accept"
    comment              = "HTTPS answers: the cloud provider's API, Stripe, Let's Encrypt, R2 (the off-box copy) — to the box's ephemeral ports only"
    direction            = "in"
    family               = "IPv4"
    protocol             = "tcp"
    source_port_start    = "443"
    source_port_end      = "443"
    # FW-1 (audit 2026-10-12): an answer arrives on the port the box's own connection
    # left from (Linux ip_local_port_range 32768-60999); no listener (:443, :8474, :8475)
    # sits there, so a packet "from :443" of any address reaches none of them.
    destination_port_start = "32768"
    destination_port_end   = "60999"
    source_address_start = "0.0.0.0"
    source_address_end   = "255.255.255.255"
  }

  # The WireGuard answers of the boxes this box LAYS (the site/estate order, live
  # 2026-10-14: test2.gunnar.rs sat 30 min at "no WireGuard handshake yet"): the shop's
  # installer dials each new box's installer link :51821 from an ephemeral UDP port, and
  # UpCloud does not track the flow, so the box's handshake answer (from :51821) needs its
  # own rule — held to the ephemeral range like the HTTPS answers (FW-1).
  firewall_rule {
    action                 = "accept"
    comment                = "WireGuard answers: the installer's link to the boxes it lays (from :51821), to the ephemeral ports only"
    direction              = "in"
    family                 = "IPv4"
    protocol               = "udp"
    source_port_start      = "51821"
    source_port_end        = "51821"
    destination_port_start = "32768"
    destination_port_end   = "60999"
    source_address_start   = "0.0.0.0"
    source_address_end     = "255.255.255.255"
  }

  firewall_rule {
    action    = "drop"
    comment   = "Everything else"
    direction = "in"
    family    = "IPv4"
  }
}