diff --git a/terraform/firewall.tf b/terraform/firewall.tf
index 58c1718..df48246 100644
--- a/terraform/firewall.tf
+++ b/terraform/firewall.tf
@@ -16,6 +16,7 @@ locals {
     { protocol = "tcp", port = "25565" },       # Minecraft (Paper)
     { protocol = "udp", port = "19132" },       # Minecraft Bedrock (Geyser)
     { protocol = "tcp", port = "443" },         # Xray VLESS Reality
+    { protocol = "tcp", port = "80" },          # ACME HTTP challenges, forwarded to Traefik on ops
     { protocol = "tcp", port = "5222-5223" },   # XMPP clients (STARTTLS, TLS)
     { protocol = "tcp", port = "5269" },        # XMPP servers
     { protocol = "tcp", port = "5443" },        # XMPP WebSocket, host-meta