diff --git a/roles/server/caddy.nix b/roles/server/caddy.nix
index 71029b9..b7b049e 100644
--- a/roles/server/caddy.nix
+++ b/roles/server/caddy.nix
@@ -58,4 +58,5 @@ in {
     services.caddy.serviceConfig.RestartSec = lib.mkForce "120s";
   };
   programs.rust-motd.settings.service_status.Caddy = "caddy";
+  networking.firewall.allowedTCPPorts = [443 80];
 }