#!/bin/bash
# Install + enable the host firewall. Run with sudo from the bundle dir.
# Keep your current SSH session open and test a NEW connection before closing it.
set -euo pipefail
cd "$(dirname "$0")"
[[ $EUID -eq 0 ]] || { echo "run with sudo"; exit 1; }

apt-get install -y -q nftables >/dev/null
install -m 0644 nftables.conf /etc/nftables.conf

echo "== syntax check"; nft -c -f /etc/nftables.conf
echo "== apply";        nft -f /etc/nftables.conf
systemctl enable nftables >/dev/null 2>&1 || true   # loads /etc/nftables.conf at boot, before docker

echo "== active ruleset (vanguard table)"
nft list table inet vanguard | sed 's/^/   /'
echo
echo "== listening on public interfaces (should be 22 80 443 1935 2222 3306 8189 8890 22000 only)"
ss -tulpnH | awk '$5 !~ /^(127\.|\[::1\])/ {print "   "$1, $5}' | sort -u
echo
echo "Now open a SECOND terminal and confirm: ssh debian@$(hostname -f 2>/dev/null || hostname)"
echo "To restrict SSH to your IPs, edit the ssh_allow set in /etc/nftables.conf and re-run: sudo nft -f /etc/nftables.conf"