#!/usr/bin/env bash
set -euo pipefail

[[ "$#" -eq 2 ]] || {
  echo "usage: apply-valheim-klops-firewall.sh WG_IPV4 WG_IPV6" >&2
  exit 2
}
wg_ipv4="$1"
wg_ipv6="$2"
[[ "$wg_ipv4" = 10.100.0.2 && "$wg_ipv6" = fd00:100::2 ]] || {
  echo "refusing invalid Valheim firewall input" >&2
  exit 2
}

zone="$(firewall-cmd --get-zone-of-interface=wg0 2>/dev/null || true)"
[[ -n "$zone" && "$zone" != "no zone" ]] || zone="$(firewall-cmd --get-default-zone)"
for family in ipv4 ipv6; do
  address="$wg_ipv4"
  [[ "$family" = ipv6 ]] && address="$wg_ipv6"
  rule="rule family=${family} destination address=${address} port port=2456-2457 protocol=udp accept"
  firewall-cmd --permanent --zone="$zone" --query-rich-rule="$rule" >/dev/null || firewall-cmd --permanent --zone="$zone" --add-rich-rule="$rule"
  firewall-cmd --zone="$zone" --query-rich-rule="$rule" >/dev/null || firewall-cmd --zone="$zone" --add-rich-rule="$rule"
done
printf 'changed: firewalld runtime and permanent Valheim rules in zone %s\n' "$zone"