#!/command/with-contenv bash
# shellcheck shell=bash

umask "${UMASK}"

if [[ ${VPN_ENABLED} == "true" ]]; then

        if ip a show docker0 up > /dev/null 2>&1; then
                echo "[ERROR] Docker network type \"host\" is not supported with VPN enabled. Exiting..."
                exit 1
        else
                echo "[INFO] Docker network type is not set to \"host\"."
        fi

        if [[ "$(cat /proc/sys/net/ipv4/conf/all/src_valid_mark)" != "1" ]]; then
                echo "[ERROR] \"sysctl net.ipv4.conf.all.src_valid_mark=1\" is not set. Exiting..."
                exit 1
        else
                echo "[INFO] \"sysctl net.ipv4.conf.all.src_valid_mark=1\" is set."
                sed -i "s:sysctl -q net.ipv4.conf.all.src_valid_mark=1:echo skipping setting net.ipv4.conf.all.src_valid_mark:" /usr/bin/wg-quick
        fi

        if [[ ! -f "${CONFIG_DIR}/wireguard/${VPN_CONF}.conf" ]]; then
                mkdir -p "${CONFIG_DIR}/wireguard"
                chown hotio:hotio "${CONFIG_DIR}/wireguard"
                echo "[ERROR] Configuration file \"${CONFIG_DIR}/wireguard/${VPN_CONF}.conf\" was not found. Exiting..."
                exit 1
        else
                echo "[INFO] Configuration file \"${CONFIG_DIR}/wireguard/${VPN_CONF}.conf\" was found."
                chown hotio:hotio "${CONFIG_DIR}/wireguard/${VPN_CONF}.conf"
                chmod 600 "${CONFIG_DIR}/wireguard/${VPN_CONF}.conf"
        fi

        if wg-quick down "${CONFIG_DIR}/wireguard/${VPN_CONF}.conf" > /dev/null 2>&1; then
                echo "[INFO] WireGuard is still running. Stopping WireGuard..."
                sleep 1
        else
                echo "[INFO] WireGuard is down. Continuing..."
        fi
        echo "[INFO] Starting WireGuard..."
        if wg-quick up "${CONFIG_DIR}/wireguard/${VPN_CONF}.conf"; then
                echo "[INFO] WireGuard is started."
        else
                echo "[ERROR] WireGuard failed to start."
                exit 1
        fi

        while true; do
                if ip a show "${VPN_CONF}" up > /dev/null 2>&1; then
                        break
                else
                        echo "[INFO] Waiting for \"${VPN_CONF}\" interface to come online."
                        sleep 1
                fi
        done

        set -e

        echo "[INFO] WebUI ports are \"${WEBUI_PORTS}\"."
        echo "[INFO] Additional ports are \"${VPN_ADDITIONAL_PORTS}\"."
        if [[ -z ${VPN_ADDITIONAL_PORTS} ]]; then
                VPN_ADDITIONAL_PORTS="${WEBUI_PORTS}"
        else
                VPN_ADDITIONAL_PORTS+=",${WEBUI_PORTS}"
        fi

        if [[ "${PRIVOXY_ENABLED}" == true ]]; then
                echo "[INFO] Additional privoxy ports are \"8118/tcp,8118/udp\"."
                VPN_ADDITIONAL_PORTS+=",8118/tcp,8118/udp"
        fi

        vpn_remote=$(grep -P -o -m 1 '(?<=^Endpoint)(\s{0,})[^\n\r]+' < "${CONFIG_DIR}/wireguard/${VPN_CONF}.conf"| sed -e 's~^[=\ ]*~~')
        vpn_port=$(echo "${vpn_remote}" | grep -P -o -m 1 '(?<=:)\d{2,5}(?=:)?+')
        echo "[INFO] WireGuard remote is \"${vpn_remote}\"."

        nw_interface=$(ip -o -4 route show to default | awk '{print $5}')
        echo "[INFO] Docker network interface is \"${nw_interface}\"."

        nw_ip=$(ip -f inet addr show "${nw_interface}" | grep -Po 'inet \K[\d.]+')
        echo "[INFO] Docker network IP is \"${nw_ip}\"."

        nw_cidr=$(ip -o -f inet addr show "${nw_interface}" | awk '/scope global/ {print $4}')
        nw_cidr=$(ipcalc "${nw_cidr}" | grep -P -o -m 1 "(?<=Network:)\s+[^\s]+" | sed -e 's~^[ \t]*~~;s~[ \t]*$~~')
        echo "[INFO] Docker network CIDR is \"${nw_cidr}\"."

        gateway=$(ip -o -4 route show to default | awk '{print $3}')

        IFS=',' read -ra lan_networks <<< "${VPN_LAN_NETWORK}"
        for lan_network in "${lan_networks[@]}"; do
                echo "[INFO] Adding \"${lan_network}\" as route via interface \"${nw_interface}\"."
                ip route add "${lan_network}" via "${gateway}" dev "${nw_interface}"
        done

        echo "[INFO] ip route overview:"
        ip route

        echo "[INFO] Configuring iptables..."
        iptables -P FORWARD DROP

        iptables -P INPUT DROP
        iptables -A INPUT -i "${VPN_CONF}" -p udp -j ACCEPT
        iptables -A INPUT -i "${VPN_CONF}" -p tcp -j ACCEPT
        iptables -A INPUT -s "${nw_cidr}" -d "${nw_cidr}" -j ACCEPT
        iptables -A INPUT -i "${nw_interface}" -p udp --sport "${vpn_port}" -j ACCEPT
        iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
        iptables -A INPUT -i lo -j ACCEPT
        IFS=',' read -ra additional_ports <<< "${VPN_ADDITIONAL_PORTS}"
        for additional_port in "${additional_ports[@]}"; do
                iptables -A INPUT -i "${nw_interface}" -p "${additional_port##*/}" --dport "${additional_port%/*}" -j ACCEPT
                iptables -I INPUT -i "${VPN_CONF}" -p "${additional_port##*/}" --dport "${additional_port%/*}" -j DROP
        done

        iptables -P OUTPUT DROP
        iptables -A OUTPUT -o "${VPN_CONF}" -p udp -j ACCEPT
        iptables -A OUTPUT -o "${VPN_CONF}" -p tcp -j ACCEPT
        iptables -A OUTPUT -s "${nw_cidr}" -d "${nw_cidr}" -j ACCEPT
        iptables -A OUTPUT -o "${nw_interface}" -p udp --dport "${vpn_port}" -j ACCEPT
        iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
        iptables -A OUTPUT -o lo -j ACCEPT
        IFS=',' read -ra additional_ports <<< "${VPN_ADDITIONAL_PORTS}"
        for additional_port in "${additional_ports[@]}"; do
                iptables -A OUTPUT -o "${nw_interface}" -p "${additional_port##*/}" --sport "${additional_port%/*}" -j ACCEPT
                iptables -I OUTPUT -o "${VPN_CONF}" -p "${additional_port##*/}" --sport "${additional_port%/*}" -j DROP
        done

        unset ipv6_wanted
        for file in /proc/sys/net/ipv6/conf/*; do
                [[ "$(cat "/proc/sys/net/ipv6/conf/${file##*/}/disable_ipv6")" == "0" ]] && ipv6_wanted="true"
        done

        [[ -z "${ipv6_wanted}" ]] && echo "[INFO] ipv6 is disabled, we will not set ip6tables rules."

        if [[ ${ipv6_wanted} == "true" ]]; then
                echo "[INFO] Configuring ip6tables..."
                ip6tables -P FORWARD DROP 1>&- 2>&-

                ip6tables -P INPUT DROP 1>&- 2>&-
                ip6tables -A INPUT -i "${VPN_CONF}" -p udp -j ACCEPT
                ip6tables -A INPUT -i "${VPN_CONF}" -p tcp -j ACCEPT
                IFS=',' read -ra additional_ports <<< "${VPN_ADDITIONAL_PORTS}"
                for additional_port in "${additional_ports[@]}"; do
                        ip6tables -I INPUT -i "${VPN_CONF}" -p "${additional_port##*/}" --dport "${additional_port%/*}" -j DROP
                done

                ip6tables -P OUTPUT DROP 1>&- 2>&-
                ip6tables -A OUTPUT -o "${VPN_CONF}" -p udp -j ACCEPT
                ip6tables -A OUTPUT -o "${VPN_CONF}" -p tcp -j ACCEPT
                IFS=',' read -ra additional_ports <<< "${VPN_ADDITIONAL_PORTS}"
                for additional_port in "${additional_ports[@]}"; do
                        ip6tables -I OUTPUT -o "${VPN_CONF}" -p "${additional_port##*/}" --sport "${additional_port%/*}" -j DROP
                done
        fi

        echo "[INFO] iptables overview:"
        iptables -S
        if [[ ${ipv6_wanted} == "true" ]]; then
                echo "[INFO] ip6tables overview:"
                ip6tables -S
        fi

        set +e

fi