#!/usr/bin/env sh
# Restrict the published Hub port so that only the reverse proxy host reaches it.
#
#   HUB_BIND=10.0.10.117 HUB_PORT=8000 PROXY_IP=10.0.10.100 IFACE=ens18 sh restrict_hub_port.sh
#
# Docker-published ports never pass through UFW/INPUT: the packets are DNATed
# and forwarded, so the only supported place for this rule is DOCKER-USER.
# Matching on the conntrack *original* destination selects this published port
# (after DNAT the packet already points at the container); --ctdir ORIGINAL keeps
# the container's replies out of the DROP rule. Idempotent: safe to re-run.
# DOCKER-USER is not persisted across reboots — gti-fiscal-hub-port.service
# re-applies it every time docker.service starts.
set -eu
: "${HUB_BIND:?HUB_BIND is required}" "${PROXY_IP:?PROXY_IP is required}" "${IFACE:?IFACE is required}"
HUB_PORT="${HUB_PORT:-8000}"
MATCH="-i $IFACE -p tcp -m conntrack --ctdir ORIGINAL --ctorigdst $HUB_BIND --ctorigdstport $HUB_PORT"

iptables -N DOCKER-USER 2>/dev/null || true
while iptables -D DOCKER-USER $MATCH -s "$PROXY_IP" -j RETURN 2>/dev/null; do :; done
while iptables -D DOCKER-USER $MATCH -j DROP 2>/dev/null; do :; done
iptables -I DOCKER-USER 1 $MATCH -j DROP
iptables -I DOCKER-USER 1 $MATCH -s "$PROXY_IP" -j RETURN
iptables -S DOCKER-USER