Firewall

[byrnedo]

Wireguard setup will probably affect this but need something like:

Block everywhere except 80/443/<< ssh port >>.
Allow other hosts in cluster on all ports.