diff --git a/docs/screenshots/alert-ui.png b/docs/screenshots/alert-ui.png
new file mode 100644
index 0000000..1cfcbd9
Binary files /dev/null and b/docs/screenshots/alert-ui.png differ
diff --git a/docs/screenshots/alerts.png b/docs/screenshots/alerts.png
new file mode 100644
index 0000000..be65309
Binary files /dev/null and b/docs/screenshots/alerts.png differ
diff --git a/docs/screenshots/dashboard-webapp.png b/docs/screenshots/dashboard-webapp.png
new file mode 100644
index 0000000..aca75da
Binary files /dev/null and b/docs/screenshots/dashboard-webapp.png differ
diff --git a/docs/screenshots/firewall-rule.png b/docs/screenshots/firewall-rule.png
new file mode 100644
index 0000000..8dd8367
Binary files /dev/null and b/docs/screenshots/firewall-rule.png differ
diff --git a/docs/screenshots/full-green-pipline.png b/docs/screenshots/full-green-pipline.png
new file mode 100644
index 0000000..d06e59c
Binary files /dev/null and b/docs/screenshots/full-green-pipline.png differ
diff --git a/docs/screenshots/iptabels-afterrule.png b/docs/screenshots/iptabels-afterrule.png
new file mode 100644
index 0000000..294f664
Binary files /dev/null and b/docs/screenshots/iptabels-afterrule.png differ
diff --git a/docs/screenshots/laptop-before-iptabels.png b/docs/screenshots/laptop-before-iptabels.png
new file mode 100644
index 0000000..6f807ab
Binary files /dev/null and b/docs/screenshots/laptop-before-iptabels.png differ
diff --git a/docs/screenshots/monitoring-cli.png b/docs/screenshots/monitoring-cli.png
new file mode 100644
index 0000000..36198b3
Binary files /dev/null and b/docs/screenshots/monitoring-cli.png differ
diff --git a/docs/screenshots/promethues-datasource.png b/docs/screenshots/promethues-datasource.png
new file mode 100644
index 0000000..a07eb82
Binary files /dev/null and b/docs/screenshots/promethues-datasource.png differ
diff --git a/docs/screenshots/restart-proof.png b/docs/screenshots/restart-proof.png
new file mode 100644
index 0000000..791132f
Binary files /dev/null and b/docs/screenshots/restart-proof.png differ
diff --git a/docs/screenshots/scraps.png b/docs/screenshots/scraps.png
new file mode 100644
index 0000000..a7ff628
Binary files /dev/null and b/docs/screenshots/scraps.png differ
diff --git a/docs/screenshots/test-pipline.png b/docs/screenshots/test-pipline.png
new file mode 100644
index 0000000..2ee9621
Binary files /dev/null and b/docs/screenshots/test-pipline.png differ
diff --git a/docs/screenshots/web-app-down.png b/docs/screenshots/web-app-down.png
new file mode 100644
index 0000000..30cec15
Binary files /dev/null and b/docs/screenshots/web-app-down.png differ
diff --git a/docs/screenshots/web-app.png b/docs/screenshots/web-app.png
new file mode 100644
index 0000000..1966524
Binary files /dev/null and b/docs/screenshots/web-app.png differ
diff --git a/iptables/firewall.sh b/iptables/firewall.sh
new file mode 100755
index 0000000..024384d
--- /dev/null
+++ b/iptables/firewall.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Restrict external access to this host and to Docker-published ports.
+# Usage: sudo ./firewall.sh up | down | status
+set -euo pipefail
+
+[ "$EUID" -eq 0 ] || { echo "Run with sudo"; exit 1; }
+
+EXT_IF="${EXT_IF:-$(ip route show default | awk '/default/ {print $5; exit}')}"
+[ -n "$EXT_IF" ] || { echo "No default route found, set EXT_IF=<interface>"; exit 1; }
+LAN="${LAN:-$(ip -o -4 addr show dev "$EXT_IF" | awk '{print $4; exit}')}"
+APP_PORT=8000
+CHAIN=DEVOPS-FW
+
+down() {
+  while iptables -D INPUT -j "$CHAIN" 2>/dev/null; do :; done
+  iptables -F "$CHAIN" 2>/dev/null || true
+  iptables -X "$CHAIN" 2>/dev/null || true
+  iptables -F DOCKER-USER 2>/dev/null || true
+  iptables -A DOCKER-USER -j RETURN 2>/dev/null || true
+}
+
+up() {
+  down
+  echo "External interface: $EXT_IF | LAN: $LAN"
+
+  # Host traffic (INPUT): only packets arriving on the external interface are filtered
+  iptables -N "$CHAIN"
+  iptables -A "$CHAIN" ! -i "$EXT_IF" -j RETURN
+  iptables -A "$CHAIN" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+  iptables -A "$CHAIN" -p icmp -j ACCEPT
+  iptables -A "$CHAIN" -p udp --sport 67 --dport 68 -j ACCEPT
+  iptables -A "$CHAIN" -p tcp --dport 22 -s "$LAN" -j ACCEPT
+  iptables -A "$CHAIN" -j DROP
+  iptables -I INPUT 1 -j "$CHAIN"
+
+  # Container ports (DOCKER-USER): after DNAT only the original destination port tells us what was requested
+  iptables -F DOCKER-USER
+  iptables -A DOCKER-USER -i "$EXT_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
+  iptables -A DOCKER-USER -i "$EXT_IF" -s "$LAN" -p tcp -m conntrack --ctorigdstport "$APP_PORT" --ctdir ORIGINAL -j RETURN
+  iptables -A DOCKER-USER -i "$EXT_IF" -j DROP
+  iptables -A DOCKER-USER -j RETURN
+}
+
+status() {
+  echo "== INPUT (top) =="; iptables -L INPUT -n -v --line-numbers | head -5
+  echo "== $CHAIN =="; iptables -L "$CHAIN" -n -v --line-numbers 2>/dev/null || echo "not active"
+  echo "== DOCKER-USER =="; iptables -L DOCKER-USER -n -v --line-numbers
+}
+
+case "${1:-}" in
+  up) up; status ;;
+  down) down; status ;;
+  status) status ;;
+  *) echo "Usage: sudo $0 up|down|status"; exit 1 ;;
+esac