allow only manager to connect to ssh port for idh node

salt/firewall/assigned_hostgroups.map.yaml

@@ -659,7 +659,6 @@ role:
         hostgroups:
           anywhere:
             portgroups:
-              - {{ portgroups.ssh }}
             {% set idh_services = salt['pillar.get']('idh:services', []) %}
             {% for service in idh_services %}
               - {{ portgroups['idh_'~service] }}
@@ -669,4 +668,7 @@ role:
               - {{ portgroups.all }}
           localhost:
             portgroups:
-              - {{ portgroups.all }}
+              - {{ portgroups.all }}
+          manager:
+            portgroups:
+              - {{ portgroups.ssh }}

salt/firewall/portgroups.yaml

@@ -1,6 +1,10 @@
 {% if grains.role == 'so-idh' %}
   {% from 'idh/opencanary_config.map.jinja' import OPENCANARYCONFIG %}
+  {% from 'idh/openssh/map.jinja' import openssh_map %}
   {% set idh_services = salt['pillar.get']('idh:services', []) %}
+  {% set ssh_port = openssh_map.config.port %}
+{% else %}
+  {% set ssh_port = 22 %}
 {% endif %}
 
 firewall:
@@ -88,7 +92,7 @@ firewall:
           - 443
       ssh:
         tcp:
-          - 22
+          - {{ ssh_port }}
       strelka_frontend:
         tcp:
           - 57314