Added user rules (see 'ufw status' for running firewall):
ufw allow 22/tcp comment 'SSH'
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'
ufw allow in on tailscale0 comment 'Tailscale full access'
ufw allow in on br-27e589efb285 from 172.27.0.3 to 172.17.0.1 port 8653 proto tcp comment 'Carlo to Hermes API bridge'
ufw allow in on br-27e589efb285 from 172.27.0.3 to 172.17.0.1 port 9130 proto tcp comment 'Carlo to Hermes dashboard bridge'