#!/bin/bash
# ITPP Phase Two C1 - DOCKER-USER hardening (management consoles Tailscale-only)
# Host: core (152.53.192.33) | Applied 2026-08-13 | Authorized: Phase Two Workstream 1 C1 (Germaine)
# Idempotent: flushes and rebuilds the DOCKER-USER chain. Safe to re-run manually.
# Closes (Tailscale-only): browserless 3000/tcp, camofox-browser 9377/tcp, uptime-kuma 3001/tcp.
# Preserves: none (no public Docker services on core; Caddy 80/443 is host INPUT chain).
set -eu

if ! iptables -L DOCKER-USER -n >/dev/null 2>&1; then
    iptables -N DOCKER-USER
fi
iptables -F DOCKER-USER
iptables -A DOCKER-USER -s 100.64.0.0/10 -j RETURN
iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
iptables -A DOCKER-USER -i eth0 -j DROP
iptables -A DOCKER-USER -j RETURN

# IPv6: Docker ip6tables integration is off on core (no ip6tables DOCKER-USER chain,
# no IPv6 DNAT). [::] publishes are userland docker-proxy (INPUT path) and are already
# blocked by UFW IPv6 default-deny (only 22/80/443/8080-tailscale/51821/8890 allowed).
exit 0