# ports-whitelist.conf — operator override for *intentionally* open public ports
#
# Monitoring is outside-in only (TCP connect from the internet). Anything odd that
# is still open and not listed here stays suspicious — many weird ports ⇒ look closer.
# This file does not invent internal topology; it only silences known-good public opens.
#
# Format:  host_or_pattern   port[,port…]   [# note]
# Patterns: exact FQDN | *.example.com | * (any host)
# Baseline already allows 80/443 on all hosts, and mail ports on mail-catalog hosts.
# Override path: TALER_PORTS_WHITELIST=/path/to/file
#
# Whitelisted ports must NOT raise orange/red on the stack card.

# --- hacktivism public edge (observed / intentional WAN services) ---
# 22 ssh · 8080 Tor OR · 9200 Forgejo git-SSH (public; not treated as Elasticsearch here)
*.hacktivism.ch                    22,8080,9200
hacktivism.ch                      22,8080,9200

# Common intentional SSH on public edges:
*.taler.net                        22
*.taler-ops.ch                     22
*.lefrancpaysan.ch                 22
*.taler-systems.com                22
*.gnunet.org                       22
*.anastasis.lu                     22
*.infomaniak.ch                    22
anastasis.lu                       22,25,143,465,587,993
taler-systems.com                  22
gnunet.org                         22

# Shared mail/edge ports often co-hosted on public FQDNs (soft noise otherwise):
*.taler.net                        25,143,465,587,993,8080
*.test.taler.net                   25,143,465,587,993,8080
firefly.gnunet.org                 22,25,143,465,587,993,9418
pixel.taler-systems.com            22,25,143,465,587,993
mail.anastasis.lu                  22,25,143,465,587,993

# Firefly git daemon (admin-log firefly/14-git-daemon.txt · ListenStream=9418)
git.taler.net                      22,9418
git.gnunet.org                     22,9418

# VeciGate WAN edge (vecigate-admin-log · public A 212.51.151.254)
# 80/443 baseline; 8080 Tor OR; 9200 Forgejo git-SSH; 2323x host SSH DNAT;
# 1789/1790 Nym; tortuna companion 23230 + 52323 (nat README)
212.51.151.254                     22,8080,9200,1789,1790,23230,23235,23236,23237,23238,52323

# Optional — add more as you confirm intentional opens:
# lefrancpaysan.ch                 21