#!/bin/bash

# Tailscale Exit Node Setup Script
# Automates UFW and IP forwarding requirements

set -e

echo "Setting up Tailscale exit node requirements..."

# 1. Enable IP Forwarding in sysctl
if ! grep -q "^net.ipv4.ip_forward=1" /etc/sysctl.conf; then
    echo "Enabling IPv4 forwarding in sysctl..."
    echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
    echo "net.ipv6.conf.all.forwarding=1" | sudo tee -a /etc/sysctl.conf
    sudo sysctl -p
else
    echo "IPv4 forwarding already enabled."
fi

# 2. Update UFW default forward policy
UFW_DEFAULT="/etc/default/ufw"
if grep -q 'DEFAULT_FORWARD_POLICY="DROP"' "$UFW_DEFAULT"; then
    echo "Updating UFW default forward policy to ACCEPT..."
    sudo sed -i 's/DEFAULT_FORWARD_POLICY="DROP"/DEFAULT_FORWARD_POLICY="ACCEPT"/' "$UFW_DEFAULT"
    sudo ufw reload
else
    echo "UFW default forward policy is already ACCEPT."
fi

# 3. Add NAT MASQUERADE to UFW before.rules
UFW_BEFORE="/etc/ufw/before.rules"
if ! grep -q "POSTROUTING -s 100.64.0.0/10 -o ens3 -j MASQUERADE" "$UFW_BEFORE"; then
    echo "Adding NAT MASQUERADE rule to $UFW_BEFORE..."
    # This is a bit tricky to automate safely without ruining the file.
    # We look for the *filter line and insert before it.
    sudo sed -i '/\*filter/i # NAT rules\n*nat\n:POSTROUTING ACCEPT [0:0]\n-A POSTROUTING -s 100.64.0.0/10 -o ens3 -j MASQUERADE\nCOMMIT\n' "$UFW_BEFORE"
    sudo ufw reload
else
    echo "NAT MASQUERADE rule already exists in $UFW_BEFORE."
fi

echo "Tailscale exit node setup complete."