[Chalvin96]

Changes

Enforce a default-deny VPS input policy with nftables, using the repository's existing firewall stack.

• Allow configured SSH, HTTP/HTTPS and WireGuard ports, plus loopback, established/related traffic, ICMP and DHCP.
• Block unsolicited forwarding from the public interface, including accidentally published container ports; preserve tunnel forwarding and established replies.
• Install the firewall before WireGuard and load only owned tables during updates.
• Preserve dynamic bans and NAT state; keep SSH abuse protection with fail2ban rather than adding another rate limiter.
• Rebase onto current master and remove the UFW implementation that conflicted with the blocklist role.

Validation

Ansible lint, site syntax checks, formatting and secret scans pass locally.
Native tests run in disposable network namespaces and cover IPv4/IPv6, a custom
SSH port, allowed and denied TCP/UDP services, DHCP, loopback, forwarding/return
traffic, published-port denial, existing bans/NAT and repeated rule loading.
The same firewall tests run in CI.

The revised policy has not been applied to the live VPS. Deployment should retain
a recovery path and verify a fresh SSH connection, public web traffic and the
WireGuard tunnel before cancelling rollback.