diff --git a/terraform/firewall.tf b/terraform/firewall.tf
index 8f87f8b..58c1718 100644
--- a/terraform/firewall.tf
+++ b/terraform/firewall.tf
@@ -13,8 +13,18 @@ locals {
   ]
 
   services_public = [
-    { protocol = "tcp", port = "25565-25566" }, # Minecraft (Paper, Fossils)
+    { protocol = "tcp", port = "25565" },       # Minecraft (Paper)
     { protocol = "udp", port = "19132" },       # Minecraft Bedrock (Geyser)
+    { protocol = "tcp", port = "443" },         # Xray VLESS Reality
+    { protocol = "tcp", port = "5222-5223" },   # XMPP clients (STARTTLS, TLS)
+    { protocol = "tcp", port = "5269" },        # XMPP servers
+    { protocol = "tcp", port = "5443" },        # XMPP WebSocket, host-meta
+    { protocol = "tcp", port = "7777" },        # XMPP file transfer proxy
+    { protocol = "tcp", port = "8448" },        # Matrix federation (ejabberd)
+    { protocol = "tcp", port = "3478" },        # STUN/TURN
+    { protocol = "udp", port = "3478" },        # STUN/TURN
+    { protocol = "udp", port = "49160-49199" }, # TURN relay
+    { protocol = "udp", port = "50000-50099" }, # Telegram gateway calls
   ]
 }
 
diff --git a/terraform/servers.tf b/terraform/servers.tf
index 286d320..f908ac7 100644
--- a/terraform/servers.tf
+++ b/terraform/servers.tf
@@ -10,7 +10,9 @@ resource "hcloud_server" "ops" {
     hcloud_ssh_key.deploy.id
   ]
 
-  backups            = true
+  # Off: restic backs up both hosts to object storage (ansible role
+  # restic_backup) for less than the 20% of the server price this costs
+  backups            = false
   delete_protection  = true
   rebuild_protection = true
 
@@ -56,7 +58,9 @@ resource "hcloud_server" "services" {
     hcloud_ssh_key.deploy.id
   ]
 
-  backups            = true
+  # Off: restic backs up both hosts to object storage (ansible role
+  # restic_backup) for less than the 20% of the server price this costs
+  backups            = false
   delete_protection  = true
   rebuild_protection = true