main.yml

---
# Enable ufw installation and config
system_security_ufw_enabled: true

# integration with ssh
system_security_ssh_port: 22

# integration with mdad
matrix_coturn_turn_udp_min_port: 49152
matrix_coturn_turn_udp_max_port: 49573

# UFW default rules (for matrix)
system_security_ufw_rules:
  - name: SSH
    rule: allow
    port: "{{ system_security_ssh_port }}"
    proto: tcp
  - name: HTTP
    rule: allow
    port: '80'
    proto: tcp
  - name: HTTPS
    rule: allow
    port: '443'
    proto: tcp
  - name: HTTPS over UDP
    rule: allow
    port: '443'
    proto: udp
  - name: Matrix Federation
    rule: allow
    port: '8448'
    proto: tcp
  - name: Matrix Federation over UDP
    rule: allow
    port: '8448'
    proto: udp
  - name: TURN TCP
    rule: allow
    port: '3478'
    proto: tcp
  - name: TURN TCP (another port)
    rule: allow
    port: '5349'
    proto: tcp
  - name: TURN UDP
    rule: allow
    port: '5349'
    proto: udp
  - name: TURN UDP (port range)
    rule: allow
    port: "{{ matrix_coturn_turn_udp_min_port }}:{{ matrix_coturn_turn_udp_max_port }}"
    proto: udp
  - name: Jitsi harvester fallback
    rule: allow
    port: '4443'
    proto: tcp
  - name: Jitsi Video RTP
    rule: allow
    port: '10000'
    proto: udp

# postmoogle integration
matrix_postmoogle_enabled: false
matrix_postmoogle_smtp_host_bind_port: '25'
matrix_postmoogle_submission_host_bind_port: '587'

# heisenbridge integration
matrix_heisenbridge_enabled: false
matrix_heisenbridge_identd_port: '113'

# firezone integration
firezone_enabled: false
firezone_wireguard_container_port: '51820'

# peertube integration
peertube_enabled: false
peertube_container_rtmp_host_bind_port: '1935'