Gate reef web ports on exposure grants

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

ansible/roles/base/tasks/main.yml

@@ -68,6 +68,41 @@
     name: OpenSSH
   when: ufw_manage | bool
 
+- name: Reject web ports in the generic UFW exception list
+  tags: [base, firewall, ufw]
+  ansible.builtin.assert:
+    that:
+      - (ufw_extra_allowed | selectattr('port', 'defined') | map(attribute='port') | map('string') | intersect(['80', '443'])) | length == 0
+    fail_msg: >-
+      Ports 80/443 must use public_web_ports plus an ADR-0008 reef declaration;
+      they cannot be smuggled through ufw_extra_allowed.
+  when: ufw_manage | bool
+
+- name: Validate public web ports against the reef declaration
+  tags: [base, firewall, ufw]
+  become: false
+  delegate_to: localhost
+  ansible.builtin.command:
+    argv:
+      - python3
+      - "{{ role_path }}/../../../scripts/validate-reef-exposure.py"
+      - --reef-declaration
+      - "{{ reef_declaration_path }}"
+      - --ports
+      - "{{ public_web_ports | join(',') }}"
+  changed_when: false
+  when: ufw_manage | bool and (public_web_ports | length > 0)
+
+- name: Allow grant-backed public web ports
+  tags: [base, firewall, ufw]
+  ansible.builtin.ufw:
+    rule: allow
+    port: "{{ item | string }}"
+    proto: tcp
+    comment: "adr-0008-reef-public-web"
+  loop: "{{ public_web_ports }}"
+  when: ufw_manage | bool
+
 - name: Allow declared extra UFW ports
   tags: [base, firewall, ufw]
   ansible.builtin.ufw: