#!/usr/bin/env bash
# Firewall hardening for a rocks-ad self-hosted channel host, matching
# what this stack actually needs:
#   - The MANAGEMENT connection (license-agent -> agent-gateway) is
#     outbound only. It needs nothing inbound, ever.
#   - The live video FEED into this machine (SRT input, whatever encoder/
#     camera is pushing your program to media-engine) DOES need one
#     inbound UDP port open — that's real, not optional, and any claim
#     that self-hosting needs "zero inbound ports" is only true for the
#     control/management path, not the video path.
#   - Nothing else needs to be reachable from outside this machine at all
#     — not control-api, not the OBS websocket, nothing.
#
# Uses ufw (Ubuntu/Debian default). If you're on a distro without ufw,
# read this script and translate the rules to your own firewall — the
# rules themselves are the point, not the tool.
set -euo pipefail

SRT_PORT="${1:-9000}"
SSH_PORT="${SSH_PORT:-22}"

if ! command -v ufw >/dev/null 2>&1; then
  echo "ufw not found. On Debian/Ubuntu: sudo apt-get install -y ufw" >&2
  echo "On another distro, apply the equivalent of these rules manually:" >&2
  echo "  - default deny incoming, default allow outgoing" >&2
  echo "  - allow tcp/$SSH_PORT (SSH)" >&2
  echo "  - allow udp/$SRT_PORT (SRT input feed)" >&2
  exit 1
fi

echo "==> Setting default policy: deny all incoming, allow all outgoing"
ufw default deny incoming
ufw default allow outgoing

echo "==> Allowing SSH (tcp/$SSH_PORT) — remove this rule yourself if you manage this box another way"
ufw allow "$SSH_PORT"/tcp comment "SSH admin access"

echo "==> Allowing SRT input feed (udp/$SRT_PORT) — this is where your encoder/camera pushes the live feed"
ufw allow "$SRT_PORT"/udp comment "rocks-ad SRT input"

echo "==> NOT opening anything else. control-api, the OBS websocket, and"
echo "    every other port this stack uses stay unreachable from outside —"
echo "    they don't need to be, license-agent talks to them over localhost"
echo "    and reaches the platform outbound only."
echo ""
echo "==> Enabling ufw (if not already active)"
ufw --force enable

echo ""
echo "Current rules:"
ufw status verbose