#!/bin/bash
#
# Purpose : Turn on the ufw firewall. Incoming connections are blocked except
#           for the services CoreDesktop runs, and ufw-docker stops ports
#           published by Docker containers from getting around the firewall.

set -e

source "$HOME/.local/share/coredesktop/utils.sh"

install_packages ufw ufw-docker

sudo ufw default deny incoming
sudo ufw default allow outgoing

sudo ufw allow 22/tcp comment 'SSH'
sudo ufw allow 5353/udp comment 'mDNS'
sudo ufw allow 53317 comment 'LocalSend'
sudo ufw allow in on tailscale0 comment 'Tailscale'

sudo ufw --force enable
sudo systemctl enable ufw.service

# ufw-docker only installs its rules while ufw is active, and they take effect
# once ufw restarts
if ! sudo grep -q 'BEGIN UFW AND DOCKER' /etc/ufw/after.rules; then
  sudo ufw-docker install
  sudo systemctl restart ufw.service
fi

sudo ufw status verbose