#!/bin/bash
# ITPP Phase Two C1 - DOCKER-USER hardening (management consoles Tailscale-only)
# Host: app2 (152.53.39.202) | Applied 2026-08-13 | Authorized: Phase Two Workstream 1 C1 (Germaine)
# Idempotent: flushes and rebuilds DOCKER-USER (IPv4 + IPv6). Safe to re-run manually.
#
# Closes (Tailscale-only, dropped by the final eth0 DROP; admin UIs still reachable via Caddy :443 -> localhost):
#   unifi-controller admin UI 8443 + guest portal 8843/8880 (unifi.itpropartner.com -> Caddy -> localhost:8443);
#   unms-nginx admin UI 8444 + http 81 (unms.forefrontwireless.com -> Caddy -> localhost:8444);
#   minio console 9001, infinity 23817+23820, ragflow 9380-9384+9392+9393 (ragflow.itpropartner.com -> Caddy -> localhost:9392);
#   gitea ssh 3022 (web is 127.0.0.1:3001 -> Caddy git.itpropartner.com).
# Preserves (public):
#   technitium DNS 53 tcp+udp;
#   bookstack 6875 (published 6875 -> container 80, matched via ctorigdstport; app3 support site proxies here);
#   support-api 6880 (app3 support.itpropartner.com -> 152.53.39.202:6880);
#   traccar 8082 + 5000-5150 tcp+udp (GPS devices + Core Caddy cross-proxy);
#   unifi-controller 8080 tcp (23 remote devices inform here) + 3478/10001 udp (STUN/discovery);
#   unms-nginx 8089 tcp + unms-netflow 2055 udp (UISP device-facing; conservative - see change log notes).
set -eu

if ! iptables -L DOCKER-USER -n >/dev/null 2>&1; then
    iptables -N DOCKER-USER
fi
iptables -F DOCKER-USER
iptables -A DOCKER-USER -s 100.64.0.0/10 -j RETURN
iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
iptables -A DOCKER-USER -i eth0 -p tcp -m multiport --dports 53,6880,8080,8082,8089,5000:5150 -j RETURN
iptables -A DOCKER-USER -i eth0 -p tcp -m conntrack --ctorigdstport 6875 -j RETURN
iptables -A DOCKER-USER -i eth0 -p udp -m multiport --dports 53,2055,3478,10001,5000:5150 -j RETURN
iptables -A DOCKER-USER -i eth0 -j DROP
iptables -A DOCKER-USER -j RETURN

if ip6tables -L DOCKER-USER -n >/dev/null 2>&1; then
    ip6tables -F DOCKER-USER
    ip6tables -A DOCKER-USER -s fd7a:115c:a1e0::/48 -j RETURN
    ip6tables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
    ip6tables -A DOCKER-USER -i eth0 -p tcp -m multiport --dports 53,6880,8080,8082,8089,5000:5150 -j RETURN
    ip6tables -A DOCKER-USER -i eth0 -p tcp -m conntrack --ctorigdstport 6875 -j RETURN
    ip6tables -A DOCKER-USER -i eth0 -p udp -m multiport --dports 53,2055,3478,10001,5000:5150 -j RETURN
    ip6tables -A DOCKER-USER -i eth0 -j DROP
    ip6tables -A DOCKER-USER -j RETURN
fi
exit 0