#!/usr/bin/env bash
# UFW rules for NPMPlus + LocalAI hardening. Run: sudo ./scripts/configure-firewall.sh
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

if [[ "${EUID}" -ne 0 ]]; then
  echo "Run as root: sudo ${SCRIPT_DIR}/configure-firewall.sh"
  exit 1
fi

LAN_CIDR="${LAN_CIDR:-192.168.100.0/24}"

echo "=== NPMPlus firewall (ufw) ==="
echo "LAN CIDR for admin port 81: ${LAN_CIDR}"
echo ""

if ! command -v ufw &>/dev/null; then
  echo "Installing ufw..."
  apt-get update -qq && apt-get install -y ufw
fi

ufw default deny incoming
ufw default allow outgoing

ufw allow 22/tcp comment 'SSH'
ufw allow 80/tcp comment 'NPMPlus HTTP / ACME'
ufw allow 443/tcp comment 'NPMPlus HTTPS'
ufw allow 443/udp comment 'NPMPlus HTTP/3'
ufw allow from "${LAN_CIDR}" to any port 81 proto tcp comment 'NPMPlus admin LAN only'

ufw deny 8070/tcp comment 'LocalAI localhost only'
ufw deny 8090/tcp comment 'gpu-fan not public'

echo ""
echo "Rules to apply:"
ufw show added || true
echo ""

ufw --force enable
ufw status verbose

echo ""
echo "Done. Admin UI: https://<LAN-IP>:81 (from ${LAN_CIDR} only)"
echo "Public HTTPS: ports 80/443"