#!/usr/bin/env bash
# glchat: правила цепочки DOCKER-USER (AGENT.md 10.4).
# Docker публикует порты в обход UFW, поэтому внутренние порты приложения
# (127.0.0.1:8080, 127.0.0.1:7880) должны быть недоступны снаружи явно.
set -euo pipefail

APP_PORT="${APP_PORT:-8080}"
LIVEKIT_WS_PORT="${LIVEKIT_WS_PORT:-7880}"

if ! command -v iptables >/dev/null 2>&1; then
    echo "glchat-docker-user: iptables не найден" >&2
    exit 0
fi

if ! iptables -nL DOCKER-USER >/dev/null 2>&1; then
    echo "glchat-docker-user: цепочка DOCKER-USER недоступна (Docker не запущен?)" >&2
    exit 0
fi

# Идемпотентность: снимаем только свои правила.
while iptables -C DOCKER-USER -m comment --comment "glchat-managed" -j RETURN >/dev/null 2>&1; do
    iptables -D DOCKER-USER -m comment --comment "glchat-managed" -j RETURN >/dev/null 2>&1 || break
done
while iptables -C DOCKER-USER -p tcp -m multiport --dports "${APP_PORT},${LIVEKIT_WS_PORT}" -m comment --comment "glchat-block-internal" -j DROP >/dev/null 2>&1; do
    iptables -D DOCKER-USER -p tcp -m multiport --dports "${APP_PORT},${LIVEKIT_WS_PORT}" -m comment --comment "glchat-block-internal" -j DROP >/dev/null 2>&1 || break
done

docker_subnets="$(docker network inspect bridge --format '{{range .IPAM.Config}}{{.Subnet}} {{end}}' 2>/dev/null || true)"
[ -n "$docker_subnets" ] || docker_subnets="172.16.0.0/12"

# Сначала блокируем внутренние порты для всех, затем разрешаем docker-подсети и localhost.
iptables -I DOCKER-USER 1 -p tcp -m multiport --dports "${APP_PORT},${LIVEKIT_WS_PORT}" \
    -m comment --comment "glchat-block-internal" -j DROP
for subnet in $docker_subnets; do
    iptables -I DOCKER-USER 1 -s "$subnet" -p tcp -m multiport --dports "${APP_PORT},${LIVEKIT_WS_PORT}" \
        -m comment --comment "glchat-managed" -j RETURN
done
iptables -I DOCKER-USER 1 -s 127.0.0.0/8 -p tcp -m multiport --dports "${APP_PORT},${LIVEKIT_WS_PORT}" \
    -m comment --comment "glchat-managed" -j RETURN
iptables -I DOCKER-USER 1 -i lo -p tcp -m multiport --dports "${APP_PORT},${LIVEKIT_WS_PORT}" \
    -m comment --comment "glchat-managed" -j RETURN

echo "glchat-docker-user: правила применены (заблокированы ${APP_PORT}, ${LIVEKIT_WS_PORT} снаружи)"