feat: open a port in ufw by hand from the panel settings

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/ufw.go

@@ -87,26 +87,46 @@ func (u *ufwManager) LastError() string {
 }
 
 // allow opens port/proto in ufw and records it, bound to the given forward
-// rule id (0 = shared/manual). The caller has checked available().
-func (u *ufwManager) allow(port int, proto string, ruleID int64) {
+// rule id (0 = shared, ufwManual = added in Settings). It reports whether the
+// panel now tracks the rule. The caller has checked available().
+func (u *ufwManager) allow(port int, proto string, ruleID int64) bool {
 	if u.db.HasUfwRule(port, proto) {
-		return
+		return true
 	}
 	spec := fmt.Sprintf("%d/%s", port, proto)
 	out, err := ufwRun("allow", spec)
 	if err != nil {
 		log.Printf("ufw allow %s: %v: %s", spec, err, out)
 		u.setErr(fmt.Sprintf("ufw allow %s: %v: %s", spec, err, out))
-		return
+		return false
 	}
 	u.setErr("")
 	if strings.Contains(out, "Skipping") {
 		// The rule was there before the panel asked for it, so it is not ours
 		// to track (and later delete).
-		return
+		return false
 	}
 	_ = u.db.AddUfwRule(port, proto, ruleID)
 	log.Printf("ufw: allowed %s", spec)
+	return true
+}
+
+// allowManual opens a port the admin asked for in Settings. A port the panel
+// already opened for a forward or the tunnel becomes the admin's, so it stays
+// when they no longer need it. It returns the error key for the settings page
+// ("" on success).
+func (u *ufwManager) allowManual(port int, proto string) string {
+	if !u.available() {
+		return "ufw_off"
+	}
+	if !u.allow(port, proto, ufwManual) {
+		if u.LastError() != "" {
+			return "ufw_failed"
+		}
+		return "ufw_exists"
+	}
+	_ = u.db.SetUfwRuleManual(port, proto)
+	return ""
 }
 
 // revokeRule deletes one tracked ufw rule from ufw and the tracking table.