---
ufw_default_incoming: "deny"
ufw_default_outgoing: "allow"
ufw_allowed_ports:
  - { port: "{{ ssh_port | default(22) }}", proto: "tcp", comment: "SSH" }
  - { port: "25", proto: "tcp", comment: "SMTP" }
  - { port: "465", proto: "tcp", comment: "SMTP submissions (implicit TLS)" }
  - { port: "587", proto: "tcp", comment: "SMTP submission (STARTTLS)" }
  - { port: "993", proto: "tcp", comment: "IMAP (implicit TLS)" }
  - { port: "443", proto: "tcp", comment: "HTTPS (web admin + JMAP)" }
  - { port: "80", proto: "tcp", comment: "HTTP (ACME + redirect)" }