Minimal? Depending on how minimal we're talking, this'd work (I'm including SSH as being needed in this though):
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p udp --dport 80 -j ACCEPT
iptables -A INPUT -j REJECT --reject-with icmp-host-unreachable
If you want to add other ports or services to be internet facing, those ports can be opened with
iptables -I INPUT [numberOfRules] -p [protocol] --dport [port or port:range] -j ACCEPT, where
[numberOfRules] is the number of the rule which has the REJECT target,
[protocol] is the protocol (TCP, UDP, etc.), and
[port or port:range] is either a single port or a range of ports defined with
start:end. Using comma separation also seems to work there.
A more in-depth explanation of what each of these rules does, and what I intentionally left out of the rules selections I did exists at my blog, if you wish to understand this a little bit better.