export interface HetznerFirewallRuleInput {
    allowSsh?: boolean;
    sitePorts: number[];
    /** Operator-owned public TCP ports from compute.firewall.allowedPorts. */
    allowedPorts?: number[];
}
export type HetznerInboundFirewallRule = {
    direction: 'in';
    protocol: 'tcp';
    port: string;
    source_ips: string[];
    description?: string;
};
export declare function buildHetznerFirewallRules(config: HetznerFirewallRuleInput): HetznerInboundFirewallRule[];
