#!/usr/bin/env bash
# Firewall for a node that runs BOTH planes:
#   * TCP 22/80/443 — ssh + nginx (the six WS inbounds and the 3x-ui panel are all
#     127.0.0.1-only and reach the world only through nginx:443).
#   * UDP x4        — Hysteria2 / TUIC terminate QUIC themselves, so unlike the TCP
#     inbounds they need genuinely public UDP ports. UDP 443 (hy2-direct) coexists
#     with nginx's TCP 443: different protocol, different socket.
# RackNerd KVM has no provider-side firewall, so ufw is the only gate here.
. "$(dirname "$0")/_lib.sh"

require_vars PORT_HY2_DIRECT PORT_HY2_WARP PORT_TUIC_DIRECT PORT_TUIC_WARP

run "for p in 22 80 443; do ufw allow \$p/tcp >/dev/null 2>&1; done
     for p in $PORT_HY2_DIRECT $PORT_HY2_WARP $PORT_TUIC_DIRECT $PORT_TUIC_WARP; do
       ufw allow \$p/udp >/dev/null 2>&1
     done
     yes | ufw enable >/dev/null 2>&1 || true
     ufw status verbose | grep -E 'Status|/tcp|/udp'"