Add UFW firewall rules with port 22 for gitea SSH tunnel

Added firewall configuration to both setup scripts. New ports:
- 22/tcp (xray tunnel: gitea SSH)
- 10022/tcp (xray bridge: Reality VLESS for gitea SSH)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server-setup/cloud-init/cloud-init.yml

@@ -166,4 +166,15 @@ runcmd:
   - chown -R eberkheev:eberkheev /home/eberkheev/3x-ui
   - chown -R eberkheev:eberkheev /home/eberkheev/cert
   - chown eberkheev:eberkheev /home/eberkheev/update.sh
+  - ufw default deny incoming
+  - ufw default allow outgoing
+  - ufw allow 22/tcp
+  - ufw allow 80/tcp
+  - ufw allow 443/tcp
+  - ufw allow 10001/tcp
+  - ufw allow 10003/tcp
+  - ufw allow 10022/tcp
+  - ufw allow 10080/tcp
+  - ufw allow 10443/tcp
+  - ufw --force enable
   - docker pull ghcr.io/mhsanaei/3x-ui:latest

server-setup/manual-setup/setup.sh

@@ -268,7 +268,21 @@ UPDATEEOF
 
 chown "$NEW_USER:$NEW_USER" "$USER_HOME/update.sh"
 
-echo "=== [8/8] Запуск 3x-ui ==="
+echo "=== [8/9] Настройка файрвола ==="
+ufw default deny incoming
+ufw default allow outgoing
+ufw allow 22/tcp        # tunnel: gitea SSH
+ufw allow 80/tcp        # tunnel: HTTP
+ufw allow 443/tcp       # tunnel: HTTPS
+ufw allow 10001/tcp     # SSH
+ufw allow 10003/tcp     # vmess VPN
+ufw allow 10022/tcp     # bridge: gitea SSH (Reality VLESS)
+ufw allow 10080/tcp     # bridge: HTTP (Reality VLESS)
+ufw allow 10443/tcp     # bridge: HTTPS (Reality VLESS)
+ufw --force enable
+echo "UFW настроен"
+
+echo "=== [9/9] Запуск 3x-ui ==="
 cd "$XUI_DIR"
 docker pull ghcr.io/mhsanaei/3x-ui:latest
 docker run -d \
@@ -290,6 +304,7 @@ echo ""
 echo "  SSH:      порт $SSH_PORT, пользователь $NEW_USER"
 echo "  3x-ui:   запущен в Docker (network_mode: host)"
 echo "  Панель:  https://<IP>:10002 (или порт из x-ui.db)"
+echo "  UFW:     22, 80, 443, 10001, 10003, 10022, 10080, 10443"
 echo ""
 echo "  Для обновления: bash ~/update.sh"
 echo "  Для проверки:   docker ps"