chore: Refresh of repo

infra/modules/prod/main.tf

@@ -1,18 +1,15 @@
-# prod: Traefik, Websites, Bitwarden, RustDesk, status page
-
-# Port sources: services/prod/*docker-compose.yml (published ports) and services/todo.md
-# (the documented UFW allow-list).
+# Port sources: services/prod/*docker-compose.yml (published ports)
 resource "hcloud_firewall" "this" {
   name = "prod-firewall"
 
-  rule { # server ssh - wired to the vpn server's public IP only, see infra/main.tf
+  rule { # server ssh - wired to the vpn server's public IP only
     direction  = "in"
     protocol   = "tcp"
     port       = "22"
     source_ips = var.allowed_ssh_source_ips
   }
 
-  rule { # Traefik http/https (Websites, Bitwarden, status page)
+  rule { # Traefik http/https
     direction  = "in"
     protocol   = "tcp"
     port       = "80"
@@ -61,7 +58,7 @@ resource "hcloud_firewall" "this" {
     source_ips = ["0.0.0.0/0", "::/0"]
   }
 
-  rule { # traffic from dev over the private network
+  rule { # traffic from over the private network
     direction  = "in"
     protocol   = "tcp"
     port       = "1-65535"
@@ -83,7 +80,7 @@ resource "hcloud_server" "this" {
   location     = var.location
   ssh_keys     = var.ssh_key_ids
   firewall_ids = [hcloud_firewall.this.id]
-  labels       = { role = "prod" } # picked up by ansible/inventory/hcloud.yml
+  labels       = { role = "prod" }
 
   network {
     network_id = var.network_id