diff --git a/site-cookbooks/kosmos-hubot/recipes/default.rb b/site-cookbooks/kosmos-hubot/recipes/default.rb
index afc986f..1562c91 100644
--- a/site-cookbooks/kosmos-hubot/recipes/default.rb
+++ b/site-cookbooks/kosmos-hubot/recipes/default.rb
@@ -9,6 +9,21 @@ include_recipe 'kosmos-base::firewall'
 include_recipe 'kosmos-hubot::_user'
 include_recipe 'kosmos-hubot::_nodejs'
 
+# Expose each bot's HTTP port (webhooks, health) to the proxy network. Declared
+# at recipe top level so the ufw provider collects them when it rebuilds the
+# firewall rules file.
+node['kosmos-hubot']['bots'].each do |app_name, config|
+  firewall = config['firewall'] || {}
+  next if firewall.empty?
+
+  firewall_rule "hubot_#{app_name}" do
+    port     firewall['port']
+    source   firewall['source']
+    protocol firewall.fetch('protocol', :tcp)
+    command  :allow
+  end
+end
+
 # A local Redis provides the brain store for the bots. It is only reachable from
 # the node itself, and the bots connect without auth.
 node.override['kosmos_redis']['requirepass'] = false
@@ -27,7 +42,6 @@ node['kosmos-hubot']['bots'].each do |app_name, config|
     robot_name       bot['robot_name']
     http_port        bot['http_port']
     redis            bot['redis'] || false
-    firewall         bot['firewall'] || {}
     external_scripts bot['external_scripts'] || []
     env              bot['env'] || {}
     secret_env       bot['secret_env'] || {}
diff --git a/site-cookbooks/kosmos-hubot/resources/bot.rb b/site-cookbooks/kosmos-hubot/resources/bot.rb
index b1318db..ca665b3 100644
--- a/site-cookbooks/kosmos-hubot/resources/bot.rb
+++ b/site-cookbooks/kosmos-hubot/resources/bot.rb
@@ -19,7 +19,6 @@ property :external_scripts, Array, default: []
 property :env, Hash, default: {}
 property :secret_env, Hash, default: {}
 property :redis, [true, false], default: false
-property :firewall, Hash, default: {}
 property :extra_files, Array, default: []
 
 default_action :create
@@ -44,6 +43,12 @@ action :create do
     service_env[env_key] = secrets[bag_key]
   end
 
+  directory app_path do
+    owner app_user
+    group app_group
+    mode  '0755'
+  end
+
   git app_path do
     user       app_user
     group      app_group
@@ -53,6 +58,7 @@ action :create do
   end
 
   execute "npm install (#{app_name})" do
+    command 'npm install'
     cwd app_path
     user app_user
     group app_group
@@ -119,13 +125,4 @@ action :create do
     triggers_reload true
     action [:create, :enable, :start]
   end
-
-  if new_resource.firewall && !new_resource.firewall.empty?
-    firewall_rule app_name do
-      port     new_resource.firewall['port']
-      source   new_resource.firewall['source']
-      protocol new_resource.firewall.fetch('protocol', :tcp)
-      command  :allow
-    end
-  end
 end