#!/usr/bin/env bash
set -euo pipefail

# Базовая настройка UFW под схему own-git.
# ВНИМАНИЕ: проверьте, что доступ к серверу по SSH есть до включения firewall.

ALLOW_SSH_PORT="${ALLOW_SSH_PORT:-22}"
ALLOW_GITEA_SSH_PORT="${ALLOW_GITEA_SSH_PORT:-2222}"
ALLOW_HTTP="${ALLOW_HTTP:-true}"
ALLOW_HTTPS="${ALLOW_HTTPS:-true}"
ALLOW_SMTP="${ALLOW_SMTP:-true}"
ALLOW_RDP="${ALLOW_RDP:-true}"
RDP_PORT="${RDP_PORT:-3389}"

if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
  echo "[ERR] Run as root (sudo)."
  exit 1
fi

if ! command -v ufw >/dev/null 2>&1; then
  echo "[INFO] Installing ufw..."
  apt-get update
  apt-get install -y ufw
fi

echo "[INFO] Reset UFW rules"
ufw --force reset

echo "[INFO] Set default policy"
ufw default deny incoming
ufw default allow outgoing

echo "[INFO] Allow SSH management port: ${ALLOW_SSH_PORT}/tcp"
ufw allow "${ALLOW_SSH_PORT}/tcp"

echo "[INFO] Allow Gitea SSH via HAProxy: ${ALLOW_GITEA_SSH_PORT}/tcp"
ufw allow "${ALLOW_GITEA_SSH_PORT}/tcp"

if [[ "$ALLOW_HTTP" == "true" ]]; then
  ufw allow 80/tcp
fi

if [[ "$ALLOW_HTTPS" == "true" ]]; then
  ufw allow 443/tcp
fi

if [[ "$ALLOW_SMTP" == "true" ]]; then
  ufw allow 25/tcp
fi

if [[ "$ALLOW_RDP" == "true" ]]; then
  ufw allow "${RDP_PORT}/tcp"
fi

echo "[INFO] Enable UFW"
ufw --force enable

echo "[OK] UFW configured"
ufw status verbose