pi-ansible/roles/os_config/tasks/firewall.yml

# vim: ft=yaml.ansible
---
- name: Allow necessary ports in UFW
  community.general.ufw:
    rule: allow
    port: "{{ item.port }}"
    proto: "{{ item.proto | default('tcp') }}"
  loop:
    - port: '22'     # SSH
    - port: '53'     # Pi-hole (not port-forwarded)
      proto: tcp
    - port: '53'     # Pi-hole (not port-forwarded)
      proto: udp
    - port: '80'     # HTTP
    - port: '81'     # Pi-hole (not port-forwarded)
    - port: '443'    # HTTPS
    - port: '4001'   # IPFS Kubo P2P
      proto: tcp
    - port: '4001'   # IPFS Kubo P2P
      proto: udp
    - port: '5001'   # IPFS Kubo RPC API (not port-forwarded)
    - port: '18080'  # monerod P2P
    - port: '18089'  # monerod RPC
    - port: '51820'  # Wireguard
      proto: udp

- name: Enable UFW
  community.general.ufw:
    policy: deny
    state: enabled