diff --git a/firewall.conf b/firewall.conf
index d52d69f..ce6ab8c 100644
--- a/firewall.conf
+++ b/firewall.conf
@@ -8,6 +8,8 @@ FIREWALL_SERVICES=(
   ssh            # remote login
   dhcpv6-client  # IPv6 address from the router
   mdns           # Avahi: <hostname>.local
+  http           # web, port 80/tcp
+  https          # web, port 443/tcp
   cockpit        # Cockpit web console, port 9090
 )
 
diff --git a/skills/sibling-project-format.md b/skills/sibling-project-format.md
index 1fd4256..2005fdf 100644
--- a/skills/sibling-project-format.md
+++ b/skills/sibling-project-format.md
@@ -117,9 +117,9 @@ siblings, so anything `install.sh` set up elsewhere stays.
 ### Firewall
 
 MiniServer runs firewalld, which blocks incoming connections except for the
-services it allows (SSH, mDNS, Cockpit and a few ports). If the project serves
-anything other machines connect to, list its ports in `firewall.conf` at the
-top of the repo:
+services it allows (SSH, mDNS, HTTP, HTTPS, Cockpit and a few ports). If the
+project serves anything other machines connect to, list its ports in
+`firewall.conf` at the top of the repo:
 
 ```bash
 # Ports other machines need to reach. Format: <port>/<protocol> or