#!/bin/bash
# macbook-air-m2 setup, run by install.sh's `setup` step after the files are in
# place. Everything here is state outside ~/.config. Idempotent; honours
# OMARCHY_SETUP_DRY=1.
set -uo pipefail

run() { if [[ ${OMARCHY_SETUP_DRY:-0} == 1 ]]; then echo "  ? would: $*"; else "$@"; fi; }

# NetBird: the AUR package ships no unit; `netbird service install` writes
# /etc/systemd/system/netbird.service. Joining the network (`netbird up`) is
# interactive and stays a manual step.
if command -v netbird >/dev/null; then
  if [[ -f /etc/systemd/system/netbird.service ]]; then
    echo "  = netbird.service installed"
  else
    run sudo netbird service install && echo "  + netbird.service"
  fi
  if systemctl is-enabled --quiet netbird 2>/dev/null; then
    echo "  = netbird.service enabled"
  else
    run sudo systemctl enable --now netbird && echo "  + netbird.service enabled (now run: netbird up)"
  fi
fi

# Firewall, beyond Omarchy's stock rules (LocalSend, Docker DNS) and the 4242
# lan-mouse rule the handoff step opens per peer:
#   22/tcp     sshd, from the home LAN (the HP reaches it as `ssh air`)
#   7746/udp   ocovo fabric, from the home LAN and over NetBird (wt0)
#   7790/tcp   ocovo, anywhere
ufw_rule() {
  if [[ ${OMARCHY_SETUP_DRY:-0} == 1 ]]; then echo "  ? would: ufw $*"; return; fi
  # ufw reports "Skipping adding existing rule" for a duplicate, so this is idempotent.
  local out; out=$(sudo ufw "$@" 2>&1)
  [[ $out == *Skipping* ]] && echo "  = ufw $*" || echo "  + ufw $*"
}
if command -v ufw >/dev/null; then
  if [[ ${OMARCHY_SETUP_DRY:-0} != 1 ]] && ! sudo -n true 2>/dev/null && [[ ! -t 0 ]]; then
    echo "  ! sudo needs a password and there is no terminal; ufw rules not applied"
  else
    ufw_rule allow from 192.168.1.0/24 to any port 22 proto tcp
    ufw_rule allow from 192.168.1.0/24 to any port 7746 proto udp comment 'ohv fabric'
    ufw_rule allow in on wt0 to any port 7746 proto udp
    ufw_rule allow 7790/tcp
  fi
fi