#!/bin/sh
# Run on Mango: ssh root@192.168.8.1 'sh -s' < scripts/configure-mango-dns.sh
# Forward public DNS to pinix, preserving Mango's LAN resolver and uplink.
set -eu
[ "$(uci -q get firewall.wan6.name)" = wan6 ]
[ -z "$(uci changes firewall)" ] || {
  echo 'Unsaved firewall changes; refusing to overwrite.' >&2
  exit 1
}
backup_dir=$(mktemp -d /root/pinix-dns-firewall-backup.XXXXXX)
cp /etc/config/firewall "$backup_dir/firewall"
echo "Firewall backup: $backup_dir/firewall"
trap 'uci revert firewall' EXIT
uci -q delete firewall.pinix_dns || true
uci set firewall.pinix_dns=redirect
uci set firewall.pinix_dns.name='IPv6 DNS pinix'
uci set firewall.pinix_dns.family=ipv6
uci set firewall.pinix_dns.src=wan6
uci set firewall.pinix_dns.src_dport=53
uci set firewall.pinix_dns.dest=lan
uci set firewall.pinix_dns.dest_ip='fdee:3c40:44f0:0:dea6:32ff:fe48:c6c8'
uci set firewall.pinix_dns.dest_port=53
uci set firewall.pinix_dns.proto='tcp udp'
uci set firewall.pinix_dns.target=DNAT
uci set firewall.pinix_dns.reflection=0
fw4 check
uci commit firewall
trap - EXIT
if ! /etc/init.d/firewall reload; then
  cp "$backup_dir/firewall" /etc/config/firewall
  /etc/init.d/firewall reload
  echo 'Firewall reload failed; restored backup.' >&2
  exit 1
fi
echo 'Persistent public DNS forwarding to pinix installed.'