From be1a40ab7410649680fef06fb1cf54e3a1f1cfa7 Mon Sep 17 00:00:00 2001
From: Jonni Liljamo <jonni@liljamo.com>
Date: Thu, 27 Nov 2025 18:34:26 +0200
Subject: [PATCH] feat(sqmeta): firewall

---
 sqmeta/IMGBUILD | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sqmeta/IMGBUILD b/sqmeta/IMGBUILD
index fa3d98a..394bad5 100644
--- a/sqmeta/IMGBUILD
+++ b/sqmeta/IMGBUILD
@@ -20,12 +20,14 @@ packages="
 
   openssh
   qemu-guest-agent
+  ufw
 "
 
 services="
   networking:boot
   sshd
   qemu-guest-agent
+  ufw
 "
 
 passwords="
@@ -77,4 +79,8 @@ provision() {
     echo "Not setting up bootloader"
     ;;
   esac
+
+  ufw default deny incoming
+  ufw limit SSH
+  ufw enable
 }
-- 
2.44.1