fix(firewall): allow feederhub :18080 from Docker bridges (fixes cat.atelier.house 504)
Summary
`cat.atelier.house` returns 504 Gateway Timeout from Traefik on nuc-mini.
Root cause: UFW's default-deny INPUT policy is silently dropping packets from Traefik (inside a Docker bridge) → feederhub on the host's LAN IP `192.168.1.6:18080`. Port 19999 (Netdata) has an explicit UFW allow and works through the same path; 18080 (feederhub) had none.
This is the actual cause — my earlier MR!46 / feederhub MR!20 chased the wrong differentiator (Go's IPv6 dual-stack binding). UFW drops the SYN before any listener gets a chance regardless of bind family. Both of those MRs are closed.
Scope
`src: 172.16.0.0/12` covers every Docker bridge subnet on the host (172.17-31.x.x). Feederhub is only consumed by Traefik via the proxy bridge, so there's no reason to expose 18080 to the LAN. Defense-in-depth.
Implementation
- `defaults/main.yml`: added the rule to `firewall_ports_infrastructure` with an optional new `src` field
- `tasks/main.yml`: thread `src` through to community.general.ufw's `src` parameter via `default(omit)` so existing entries without `src` keep their open-to-Anywhere behavior
Test plan
-
`ansible-playbook deploy/all.yml` (or whichever play reapplies the firewall role) → `sudo ufw status numbered | grep 18080` shows the new rule -
`ssh nuc 'docker exec traefik wget -qO- http://192.168.1.6:18080/health'\` returns the health JSON -
`curl https://cat.atelier.house/health\` returns 200
We'll also apply directly on nuc with `sudo ufw allow from 172.16.0.0/12 to any port 18080 proto tcp comment 'feederhub API'` so the user-visible 504 clears immediately, then this MR keeps it durable across future deploys.