#!/bin/bash
# ITPP Phase Two C1 - DOCKER-USER hardening (management consoles Tailscale-only)
# Host: app1 (152.53.36.131) | Applied 2026-08-13 | Authorized: Phase Two Workstream 1 C1 (Germaine)
# Idempotent: flushes and rebuilds DOCKER-USER (IPv4 + IPv6). Safe to re-run manually.
# Closes (Tailscale-only): komodo 9120, twenty-server 3003, wazuh dashboard 5601, wazuh indexer 9200.
# Preserves (public): wazuh manager 1514/1515/55000 tcp + 514 udp (5 active agents).
# NOTE: litellm is 127.0.0.1:4000 behind Caddy (admin-ai.itpropartner.com) - untouched here.
set -eu

if ! iptables -L DOCKER-USER -n >/dev/null 2>&1; then
    iptables -N DOCKER-USER
fi
iptables -F DOCKER-USER
iptables -A DOCKER-USER -s 100.64.0.0/10 -j RETURN
iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
iptables -A DOCKER-USER -i eth0 -p tcp -m multiport --dports 1514,1515,55000 -j RETURN
iptables -A DOCKER-USER -i eth0 -p udp -m multiport --dports 514 -j RETURN
iptables -A DOCKER-USER -i eth0 -j DROP
iptables -A DOCKER-USER -j RETURN

if ip6tables -L DOCKER-USER -n >/dev/null 2>&1; then
    ip6tables -F DOCKER-USER
    ip6tables -A DOCKER-USER -s fd7a:115c:a1e0::/48 -j RETURN
    ip6tables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
    ip6tables -A DOCKER-USER -i eth0 -p tcp -m multiport --dports 1514,1515,55000 -j RETURN
    ip6tables -A DOCKER-USER -i eth0 -p udp -m multiport --dports 514 -j RETURN
    ip6tables -A DOCKER-USER -i eth0 -j DROP
    ip6tables -A DOCKER-USER -j RETURN
fi
exit 0