#!/usr/bin/env bash
# Host-side bootstrap for the RackNerd VPN hub (Ubuntu).
# Run as root from the repo: sudo host/setup.sh
# Idempotent: safe to re-run; never overwrites an existing wg0.conf.
set -euo pipefail
cd "$(dirname "$0")"

[ "$(id -u)" -eq 0 ] || { echo "Run as root."; exit 1; }

PUBIF=$(ip -4 route show default | awk '{print $5; exit}')
echo "==> Public interface: ${PUBIF}"

echo "==> Installing wireguard + iptables-persistent"
apt-get update -qq
DEBIAN_FRONTEND=noninteractive apt-get install -y wireguard iptables-persistent

echo "==> sysctl (ip_forward)"
install -m 0644 99-vpnhub-sysctl.conf /etc/sysctl.d/99-vpnhub.conf
sysctl --system >/dev/null

echo "==> Firewall (WARNING: INPUT policy DROP — port 22 stays open)"
sed "s/\${PUBIF}/${PUBIF}/g" rules.v4.template > /etc/iptables/rules.v4
netfilter-persistent reload
# reload flushed Docker's chains; put them back if Docker is running
if systemctl is-active --quiet docker; then
  systemctl restart docker
fi

echo "==> WireGuard"
if [ ! -f /etc/wireguard/wg0.conf ]; then
  umask 077
  PRIV=$(wg genkey)
  sed "s|<RACKNERD_WG_PRIVATE_KEY>|${PRIV}|" wg0.conf.example > /etc/wireguard/wg0.conf
  echo
  echo "    RackNerd WG public key (add as a peer at BOTH sites):"
  echo "    $(echo "${PRIV}" | wg pubkey)"
  echo
  echo "    >>> Now edit /etc/wireguard/wg0.conf and paste in the"
  echo "    >>> Trochalakis and Oswald public keys, then:"
  echo "    >>>   systemctl enable --now wg-quick@wg0"
else
  echo "    /etc/wireguard/wg0.conf exists — leaving it alone."
  systemctl enable --now wg-quick@wg0
fi

echo "==> Done. Next: cp .env.example .env, fill it in, docker compose up -d --build"