/**
 * Host firewall (UFW) provisioning, mirroring Forge's per-server firewall.
 *
 * Defaults to deny-incoming / allow-outgoing, with SSH (OpenSSH), HTTP (80),
 * and HTTPS (443) always open so deploys and web traffic keep working, plus
 * any extra ports the config lists (e.g. a Reverb/websocket port). On Hetzner
 * this is layered on top of the cloud firewall; on a bare box it's the primary
 * line of defence.
 */
import type { ComputeFirewallConfig } from '@ts-cloud/core';
/** Ports always allowed so SSH deploys + web traffic are never locked out. */
export declare const UFW_BASE_PORTS: readonly number[];
/**
 * Build the UFW provisioning commands. Idempotent: `ufw allow` is a no-op when
 * a rule already exists, and `--force enable` is safe to re-run.
 */
export declare function buildUfwScript(firewall?: ComputeFirewallConfig): string[];
