states/fwrules/templates/chains.nft.j2

chain concourse_worker {
    define ports = {
        22,    # ssh
        7777,  # concourse-atc
        7778,  # concourse-baggageclaim
    }
    ip saddr { 107.155.67.65/29 } tcp dport $ports accept
    ip6 saddr { 2604:880:396::/48 } tcp dport $ports accept
}

chain docker_usc2_ingress {
    # factorio game
    udp dport 34197 accept
    # factorio rcon
    ip saddr $management4 tcp dport 27017 accept
    ip6 saddr $management6 tcp dport 27017 accept
    # icecast direct
    ip saddr $management4 tcp dport 9090 accept
    ip6 saddr $management6 tcp dport 9090 accept
    # unifi
    define unifi_ports_tcp = {
        8443,  # unifi-https
        8880,  # unifi-portal-http
        8843,  # unifi-portal-https
        6789,  # unifi-speed
    }
    define unifi_ports_udp = {
        3478,  # unifi-stun
    }
    # unifi http
    tcp dport 8080 accept
    ip saddr $management4 tcp dport $unifi_ports_tcp accept
    ip saddr $management4 udp dport $unifi_ports_udp accept
    ip6 saddr $management6 tcp dport $unifi_ports_tcp accept
    ip6 saddr $management6 udp dport $unifi_ports_udp accept
}

chain elasticsearch_cluster {
    ip saddr 10.1.0.0/24 tcp dport { 9200, 9300 } accept
    # external node ingress
    ip saddr $minions4 tcp dport 9200 accept
    ip6 saddr $minions6 tcp dport 9200 accept
    # elasticsearch exporter
    ip saddr $scrapers4 tcp dport 9114 accept
    ip6 saddr $scrapers6 tcp dport 9114 accept
}

chain http_public {
    tcp dport { 80, 443 } accept
}

chain matrix_public {
    define ports_tcp = {
        8448,  # matrix-server
        3478,  # coturn-plain
        5349,  # coturn-tls
    }
    define ports_udp = {
        3478,         # coturn-plain
        5349,         # coturn-tls
        49152-65535,  # coturn-relay
    }
    tcp dport $ports_tcp accept
    udp dport $ports_udp accept
}

chain node_exporter_private {
    ip saddr $scrapers4 tcp dport 9100 accept
    ip6 saddr $scrapers6 tcp dport 9100 accept
}

chain salt_private {
    define ports_tcp = {
        443,   # grainsrv
        4505,  # salt-publish
        4506,  # salt-return
        8000,  # salt-api
    }
    ip saddr $minions4 tcp dport $ports_tcp accept
    ip6 saddr $minions6 tcp dport $ports_tcp accept
}

chain critical_services {
    define ports_tcp = {
        22,  # ssh
    }

    ip saddr $minions4 tcp dport $ports_tcp accept
    ip6 saddr $minions6 tcp dport $ports_tcp accept
}

chain usc2_privnet {
    ip saddr 10.200.0.0/24 accept
}

chain int_privnet {
    ip saddr 10.100.0.0/23 accept
}

chain vault_private {
    define ports_tcp = {
        8200,  # vault
    }

    ip saddr $minions4 tcp dport $ports_tcp accept
    ip6 saddr $minions6 tcp dport $ports_tcp accept
}