ts-cloud reconciles the host firewall (UFW) from cloud config on every deploy. SSH (22), HTTP (80), and HTTPS (443) are always open and cannot be changed here.
These ports keep SSH, HTTP, and HTTPS reachable. They are read-only and managed by the framework.
{{ opOutput() }}Ports are declarative: this page edits infrastructure.compute.firewall in cloud config and applies ufw allow / ufw delete allow live on the box. The full config is reconciled again on the next cloud deploy.