#!/bin/sh
# Auf Mango nach configure-mango-ipv6-web.sh ausfuehren:
# ssh root@192.168.8.1 'sh -s' < scripts/configure-mango-ipv6-ssh.sh
# Stabile SLAAC-Ziele, ohne statische NixOS-Adresse (RA bleibt aktiv).
# Nur Host-SSH; keine Freigabe der Routerverwaltung.
# HOSTS=tnix aktualisiert nur tnix; Standard bleibt pinix und tnix.
set -eu
[ "$(uci -q get firewall.wan6.name)" = wan6 ]
[ -z "$(uci changes firewall)" ] || {
  echo 'Unsaved firewall changes; refusing to overwrite.' >&2
  exit 1
}
backup_dir=$(mktemp -d /root/ipv6-ssh-firewall-backup.XXXXXX)
cp /etc/config/firewall "$backup_dir/firewall"
echo "Firewall backup: $backup_dir/firewall"
trap 'uci revert firewall' EXIT
for host in ${HOSTS:-pinix tnix}; do
  case "$host" in
    pinix) port=2222; target=fdee:3c40:44f0:0:dea6:32ff:fe48:c6c8 ;;
    tnix) port=2223; target=fdee:3c40:44f0:0:ca5b:76ff:fe96:e24 ;;
    *) echo "Unknown host: $host" >&2; exit 1 ;;
  esac
  rule="firewall.${host}_ssh"
  uci -q delete "$rule" || true
  uci set "$rule=redirect"
  uci set "$rule.name=IPv6 SSH $host"
  uci set "$rule.family=ipv6"
  uci set "$rule.src=wan6"
  uci set "$rule.src_dport=$port"
  uci set "$rule.dest=lan"
  uci set "$rule.dest_ip=$target"
  uci set "$rule.dest_port=22"
  uci set "$rule.proto=tcp"
  uci set "$rule.target=DNAT"
  uci set "$rule.reflection=0"
  if [ "$host" = tnix ]; then
    # tnix behaelt den iPhone-Hotspot als Default-Route. Oeffentliche
    # SSH-Clients erscheinen daher als Mango-LAN-Adresse, damit Antworten
    # ueber Ethernet zum Mango zurueckgehen. Nur TCP 22 zu diesem Host.
    uci -q delete firewall.tnix_ssh_return || true
    uci set firewall.tnix_ssh_return=nat
    uci set firewall.tnix_ssh_return.name='IPv6 SSH tnix return via Mango'
    uci set firewall.tnix_ssh_return.family=ipv6
    uci set firewall.tnix_ssh_return.src=lan
    uci set firewall.tnix_ssh_return.src_ip='2000::/3'
    uci set firewall.tnix_ssh_return.dest_ip="$target"
    uci set firewall.tnix_ssh_return.dest_port=22
    uci set firewall.tnix_ssh_return.proto=tcp
    uci set firewall.tnix_ssh_return.target=SNAT
    uci set firewall.tnix_ssh_return.snat_ip='fdee:3c40:44f0::1'
  fi
done
fw4 check
uci commit firewall
trap - EXIT
if ! /etc/init.d/firewall reload; then
  cp "$backup_dir/firewall" /etc/config/firewall
  /etc/init.d/firewall reload
  echo 'Firewall reload failed; restored backup.' >&2
  exit 1
fi
echo 'Persistent IPv6 SSH forwarding installed.'