Add an rm confirmation guard article and a ufw guide

content/en/2.general/5.linux/1.cli-basics.md

@@ -153,8 +153,8 @@ Three silent commands, and `ls` showing the result: the copy sits next to the or
 
 Deletes. There is no recycle bin, no undo, no confirmation dialog. `-r` deletes a folder and its contents, `-f` forces without asking.
 
-::warning
-`rm -rf` is the command that wipes homelabs. It doesn't check, doesn't warn, and doesn't stop. Read the path twice before pressing :kbd{value="Enter"}, especially when the line starts with `sudo` and contains a `/` or a `*`.
+::warning{to="/nonsense/bash/rm-confirmation"}
+`rm -rf` is the command that wipes homelabs. It doesn't check, doesn't warn, and doesn't stop. Read the path twice before pressing :kbd{value="Enter"}, especially when the line starts with `sudo` and contains a `/` or a `*`. You can also prevent this by wrapping `sudo` in a small Bash function that asks **"are you sure?"** before it lets an `rm` through, covered in **rm confirmation guard**.
 ::
 
 ### cat and nano, read and edit

content/en/2.general/5.linux/3.handy-tools.md

@@ -198,3 +198,63 @@ Being outside `apt` also means it won't be updated by `apt full-upgrade`. Repeat
 
 #### Done !
 ::
+
+## ufw, a firewall you can actually read
+
+Debian's firewall (`iptables`/`nftables` under the hood) is powerful and unreadable directly. `ufw`, *uncomplicated firewall*, is a thin layer on top that turns it into short, plain-English rules, block everything by default and open only what you actually expose.
+
+::steps{level="4"}
+#### Install it
+
+```bash [Terminal]
+sudo apt install ufw
+```
+
+#### Set the default policy
+
+```bash [Terminal]
+sudo ufw default deny incoming
+sudo ufw default allow outgoing
+```
+
+Nothing gets in unless a rule says so, everything the server itself initiates still goes out normally.
+
+#### Allow what you actually need
+
+```bash [Terminal]
+sudo ufw allow OpenSSH
+sudo ufw allow 443/tcp
+```
+
+`OpenSSH` is a built-in profile that matches the SSH port, no need to remember which one. Add one `allow` per port you expose, [SWAG](/serveex/core/swag) on `443` for instance.
+
+::warning
+Allow SSH **before** enabling the firewall, in the next step. Enable it first and the very connection you're typing in gets cut, with no screen left plugged in to fix it.
+::
+
+#### Enable it
+
+```bash [Terminal]
+sudo ufw enable
+```
+
+#### Check the rules
+
+```bash [Terminal]
+sudo ufw status verbose
+```
+
+```console [Output]
+Status: active
+Logging: on (low)
+Default: deny (incoming), allow (outgoing), disabled (routed)
+
+To                         Action      From
+--                         ------      ----
+22/tcp (OpenSSH)           ALLOW IN    Anywhere
+443/tcp                    ALLOW IN    Anywhere
+```
+
+#### Done !
+::
+