#!/usr/bin/env bash
# Creates the gbr-boottest Docker network and blocks it from private networks, so boot-tested game
# servers can download what they need from the internet but never reach the LAN or the host.
# Safe to re-run; the systemd unit in this folder runs it after every Docker start.
set -euo pipefail

NETWORK=gbr-boottest
SUBNET=172.30.99.0/24

if ! docker network inspect "$NETWORK" > /dev/null 2>&1; then
  docker network create --driver bridge --subnet "$SUBNET" \
    -o com.docker.network.bridge.name=br-gbrboot "$NETWORK"
fi

# DOCKER-USER is evaluated before Docker's own forwarding rules. Rebuild our rules from scratch.
iptables -N GBR-BOOTTEST 2>/dev/null || iptables -F GBR-BOOTTEST
iptables -C DOCKER-USER -s "$SUBNET" -j GBR-BOOTTEST 2>/dev/null \
  || iptables -I DOCKER-USER -s "$SUBNET" -j GBR-BOOTTEST

# Replies to connections the container opened (downloads) are fine
iptables -A GBR-BOOTTEST -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
for net in 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 100.64.0.0/10 169.254.0.0/16; do
  iptables -A GBR-BOOTTEST -d "$net" -j DROP
done
iptables -A GBR-BOOTTEST -j RETURN

# The host itself (SSH, the Docker API, anything listening) is reached via INPUT, not FORWARD
iptables -C INPUT -i br-gbrboot -j DROP 2>/dev/null || iptables -I INPUT -i br-gbrboot -j DROP

echo "gbr-boottest ready: $SUBNET, private networks and host blocked"