#!/usr/bin/env bash
set -euo pipefail

install -m 0600 -o root -g root /root/wg0.conf /etc/wireguard/wg0.conf
wg-quick down wg0 || true
wg-quick up wg0

if command -v firewall-cmd >/dev/null && systemctl is-active --quiet firewalld; then
  firewall-cmd --permanent --add-port=2222/tcp
  firewall-cmd --permanent --add-port=2223/tcp
  firewall-cmd --reload
fi