Document firewall prerequisites for deployments

[jakduch]

Why are you introducing these changes? (Problem description, related links)

Foremanctl deploys the server and proxy services but does not open host firewall ports. Without an explicit prerequisite, server deployments can remain unreachable and proxy registration can fail when the server cannot reach TCP port 8443.

Fixes #821

What are the changes introduced in this pull request?

• document the required firewalld rules for server and proxy hosts
• cover deployment and restore workflows
• document the required server-to-proxy and proxy-to-server network paths
• link to the complete feature-specific Foreman port requirements and the local network architecture

How to test this pull request

Steps to reproduce:

• render or review docs/developer/deployment.md
• verify that the server rules expose HTTP/HTTPS and the proxy rules additionally expose TCP ports 8000 and 8443
• verify both external documentation links and the relative Network Architecture link

The documented ports were cross-checked against the foremanctl network architecture, proxy defaults, enabled proxy flavor features, and current Foreman documentation.

This contribution was prepared with AI assistance and manually reviewed.

Checklist

• Tests added/updated (not applicable: documentation-only change)
• Documentation updated (if applicable)

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: a7afab55-2fa0-4c1f-b3bc-0ad41a534772

📥 Commits

Reviewing files that changed from the base of the PR and between 78eb5f0 and 99f0c0d.

📒 Files selected for processing (1)

• docs/developer/deployment.md

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: ad500c36-a683-4397-ae4c-bb55b9e9b589

📥 Commits

Reviewing files that changed from the base of the PR and between acdb0f7 and 78eb5f0.

📒 Files selected for processing (1)

• docs/developer/deployment.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The deployment guide adds host firewall prerequisites for deployment and restoration of Foreman Server and Smart Proxy hosts. It lists required ports, network access, rule verification, and optional-feature port references.

Changes

Deployment firewall prerequisites

Layer / File(s)	Summary
Document host firewall requirements docs/developer/deployment.md	The guide lists HTTP/HTTPS ports for server hosts and HTTP/HTTPS plus TCP ports 8000 and 8443 for proxy hosts. It also describes required server-to-proxy and proxy-to-server access, rule verification, optional-feature ports, and internal container services that do not need public firewall rules.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other · Severity of issue fixed: Medium

Suggested reviewers: archanaserver

Merge Risk: ⚪ Minimal · up to 78eb5

The firewall prerequisites are mergeable after normal checks. Operators should apply the documented network restrictions appropriate to their deployment.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main documentation change: documenting firewall prerequisites for deployments.
Description check	✅ Passed	The description is directly related to the changeset. It explains the firewall prerequisite problem, documents the server and proxy rules, covers deployment and restore workflows, and describes valida…
Linked Issues check	✅ Passed	The change adds the requested "Opening Required Ports" prerequisite section in docs/developer/deployment.md [#821]. It covers foremanctl deploy, deploy-proxy, and restore. It documents `firewa…
Out of Scope Changes check	✅ Passed	The reported changes are limited to firewall prerequisite documentation in docs/developer/deployment.md. The network-path notes, access restrictions, rule verification, and optional-feature guidance…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jakduch]

The devel-tests job failed before running the changed code: setup-environment could not download community.crypto from Ansible Galaxy because the connection was reset by the remote endpoint. This is unrelated to this documentation-only diff. I will rerun the failed job after the workflow finishes.

[jakduch]

The Tests Proxy Deployment (default, fips, centos/stream9) failure is unrelated to this documentation-only change. The backup reaches Wait for PostgreSQL to fully stop after stopping foreman.target, then becomes unreachable with Timeout (12s) waiting for privilege escalation prompt; the remaining failures are a cascade from services being left stopped.

The identical failure is present on current master in job 107747223169. I filed #862 and opened #863 with the fix.

[jakduch]

The devel-tests failure is an unrelated Galaxy connection reset. The proxy failure starts with the backup polling privilege-escalation timeout fixed by #863; the shared development-memory issue is fixed by #865, whose complete CI matrix is green.

[jakduch]

The devel job failed while Ansible Galaxy reset the connection, not on this documentation change. I rebased onto current master to include the latest deployment fixes and start a clean run.