#!/usr/bin/env bash
# location: /usr/local/sbin/ts2-netns-up
set -e

# bail out clean if anything already exists from a previous run
ip netns list | grep -qw ts2 || ip netns add ts2

ip link show veth-ts2 &>/dev/null || \
  ip link add veth-ts2 type veth peer name veth-ts2-ns

# move peer into ns only if it's still on the host
ip link show veth-ts2-ns &>/dev/null && \
  ip link set veth-ts2-ns netns ts2

ip addr add 10.200.0.1/30 dev veth-ts2 2>/dev/null || true
ip link set veth-ts2 up

ip -n ts2 addr add 10.200.0.2/30 dev veth-ts2-ns 2>/dev/null || true
ip -n ts2 link set veth-ts2-ns up
ip -n ts2 link set lo up
ip -n ts2 route add default via 10.200.0.1 2>/dev/null || true

mkdir -p /etc/netns/ts2
echo "nameserver 1.1.1.1" > /etc/netns/ts2/resolv.conf

sysctl -wq net.ipv4.ip_forward=1

# -C checks if rule exists, -A appends only if missing
iptables -t nat -C POSTROUTING -s 10.200.0.0/30 -o br0 -j MASQUERADE 2>/dev/null || \
  iptables -t nat -A POSTROUTING -s 10.200.0.0/30 -o br0 -j MASQUERADE

iptables -C FORWARD -i veth-ts2 -o br0 -j ACCEPT 2>/dev/null || \
  iptables -A FORWARD -i veth-ts2 -o br0 -j ACCEPT

iptables -C FORWARD -o veth-ts2 -i br0 -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \
  iptables -A FORWARD -o veth-ts2 -i br0 -m state --state RELATED,ESTABLISHED -j ACCEPT

# iptables rules + sysctl inside ts2 ns
# Forwarding inside ts2
ip netns exec ts2 sysctl -wq net.ipv4.ip_forward=1

# DNAT incoming ssh to host
ip netns exec ts2 iptables -t nat -C PREROUTING -i tailscale0 -p tcp --dport 22 -j DNAT --to-destination 10.200.0.1:22 2>/dev/null || \
  ip netns exec ts2 iptables -t nat -A PREROUTING -i tailscale0 -p tcp --dport 22 -j DNAT --to-destination 10.200.0.1:22

# DNAT incoming http to host nginx
ip netns exec ts2 iptables -t nat -C PREROUTING -i tailscale0 -p tcp --dport 80 -j DNAT --to-destination 10.200.0.1:80 2>/dev/null || \
  ip netns exec ts2 iptables -t nat -A PREROUTING -i tailscale0 -p tcp --dport 80 -j DNAT --to-destination 10.200.0.1:80

# DNAT incoming 8080 to docker web app in root ns
ip netns exec ts2 iptables -t nat -C PREROUTING -i tailscale0 -p tcp --dport 8080 -j DNAT --to-destination 10.200.0.1:8080 2>/dev/null || \
  ip netns exec ts2 iptables -t nat -A PREROUTING -i tailscale0 -p tcp --dport 8080 -j DNAT --to-destination 10.200.0.1:8080

ip netns exec ts2 iptables -t nat -C POSTROUTING -o veth-ts2-ns -j MASQUERADE 2>/dev/null || \
  ip netns exec ts2 iptables -t nat -A POSTROUTING -o veth-ts2-ns -j MASQUERADE