feat(infra): allow ICMP from Uptime Kuma monitoring server (91.99.57.252) on app and db firewalls

terraform/hetzner/prod/firewall.tf

@@ -161,6 +161,13 @@ resource "hcloud_firewall" "app" {
     description = "Grafana — private, via SWAG on 443 (IP restricted)"
   }
 
+  rule {
+    direction   = "in"
+    protocol    = "icmp"
+    source_ips  = var.monitoring_cidrs
+    description = "ICMP ping from Uptime Kuma monitoring server"
+  }
+
   labels = {
     environment = local.environment
     role        = "app"
@@ -274,6 +281,13 @@ resource "hcloud_firewall" "db" {
     description = "Patroni REST API within DB subnet"
   }
 
+  rule {
+    direction   = "in"
+    protocol    = "icmp"
+    source_ips  = var.monitoring_cidrs
+    description = "ICMP ping from Uptime Kuma monitoring server"
+  }
+
   labels = {
     environment = local.environment
     role        = "db"

terraform/hetzner/prod/variables.tf

@@ -38,3 +38,9 @@ variable "admin_allowed_cidrs" {
   type        = list(string)
   description = "CIDR list for admin SSH access"
 }
+
+variable "monitoring_cidrs" {
+  type        = list(string)
+  default     = ["91.99.57.252/32"]
+  description = "CIDR list for the Uptime Kuma monitoring server (ICMP ping allowed)"
+}

terraform/hetzner/test/firewall.tf

@@ -169,6 +169,13 @@ resource "hcloud_firewall" "app" {
     description = "Grafana — private, via SWAG on 443"
   }
 
+  rule {
+    direction   = "in"
+    protocol    = "icmp"
+    source_ips  = var.monitoring_cidrs
+    description = "ICMP ping from Uptime Kuma monitoring server"
+  }
+
   labels = {
     environment = local.environment
     role        = "app"
@@ -242,6 +249,13 @@ resource "hcloud_firewall" "db" {
     description = "Docker Swarm VXLAN overlay from app subnet"
   }
 
+  rule {
+    direction   = "in"
+    protocol    = "icmp"
+    source_ips  = var.monitoring_cidrs
+    description = "ICMP ping from Uptime Kuma monitoring server"
+  }
+
   labels = {
     environment = local.environment
     role        = "db"

terraform/hetzner/test/variables.tf

@@ -38,3 +38,9 @@ variable "admin_allowed_cidrs" {
   type        = list(string)
   description = "CIDR list for admin SSH and management port access"
 }
+
+variable "monitoring_cidrs" {
+  type        = list(string)
+  default     = ["91.99.57.252/32"]
+  description = "CIDR list for the Uptime Kuma monitoring server (ICMP ping allowed)"
+}