New: the TCP ports a project publishes are automatically opened in the host firewall
v0.21.0-beta
- New: the TCP ports a project publishes are automatically opened in the host firewall. Publishing a port on a VPS with UFW active was not enough: the packet was blocked before reaching Docker, and the service stayed unreachable without manual intervention on the server. The agent now opens the matching rules just before starting the containers, both on deployment and on a project resync. This is what makes a raw TCP service possible, for example an FTPS server fed directly by a camera.
- The rules are reconciled, not just added: the agent remembers what it opened for a project and closes a port you stop publishing. A rule added by hand on the server is never touched.
- Opening is idempotent and cautious: if UFW is not installed, or installed but inactive, the agent touches nothing and never enables the firewall itself (enabling it could cut the administrator's SSH session). A failure to open is logged, without ever failing an otherwise correct deployment.