numerous updates

system/firewall.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+#
+# Purpose : Turn on the ufw firewall. Incoming connections are blocked except
+#           for the services CoreDesktop runs, and ufw-docker stops ports
+#           published by Docker containers from getting around the firewall.
+
+set -e
+
+source "$HOME/.local/share/coredesktop/utils.sh"
+
+install_packages ufw ufw-docker
+
+sudo ufw default deny incoming
+sudo ufw default allow outgoing
+
+sudo ufw allow 22/tcp comment 'SSH'
+sudo ufw allow 5353/udp comment 'mDNS'
+sudo ufw allow 53317 comment 'LocalSend'
+sudo ufw allow in on tailscale0 comment 'Tailscale'
+
+sudo ufw --force enable
+sudo systemctl enable ufw.service
+
+# ufw-docker only installs its rules while ufw is active, and they take effect
+# once ufw restarts
+if ! sudo grep -q 'BEGIN UFW AND DOCKER' /etc/ufw/after.rules; then
+  sudo ufw-docker install
+  sudo systemctl restart ufw.service
+fi
+
+sudo ufw status verbose