#!/usr/bin/env bash

set -euo pipefail

CHAIN="{{ k3s_firewall_svc_allow_chain | default('PROLE-SVC-ALLOW') }}"
PORTS="{{ (k3s_firewall_svc_allow_tcp_ports | default([80, 443])) | join(' ') }}"

log() {
  echo "[prole-svc-iptables-allow] $*" >&2
}

apply_rules() {
  local ipt="$1"

  command -v "$ipt" >/dev/null 2>&1 || return 0

  # Ensure chain exists.
  "$ipt" -t filter -N "$CHAIN" 2>/dev/null || true
  "$ipt" -t filter -F "$CHAIN" || true

  # Populate chain with port accepts.
  for p in $PORTS; do
    if [[ ! "$p" =~ ^[0-9]+$ ]]; then
      log "Skipping non-numeric port: $p"
      continue
    fi
    "$ipt" -t filter -A "$CHAIN" -p tcp --dport "$p" -j ACCEPT
  done

  # Ensure we jump to our chain at the very top of INPUT.
  # Delete any existing jumps (wherever they are), then insert at position 1.
  while "$ipt" -t filter -D INPUT -j "$CHAIN" 2>/dev/null; do
    :
  done
  "$ipt" -t filter -I INPUT 1 -j "$CHAIN"
}

apply_rules iptables
apply_rules ip6tables

log "Applied ACCEPT rules for TCP ports: $PORTS"