1#!/bin/bash
 2set -euo pipefail
 3
 4if [[ $EUID -ne 0 ]]; then
 5    echo "Run as root: sudo $0"
 6    exit 1
 7fi
 8
 9echo "Checking PreRequisites"
10
11# ── ufWall ───────────────────────────────────────────────────────────────
12if ! command -v ufWall &>/dev/null; then
13    if ! command -v yay &>/dev/null; then
14        echo "yay not found — install yay first: https://github.com/Jguer/yay"
15        exit 1
16    fi
17    echo "Installing ufwall..."
18    
19		sudo -u "$SUDO_USER" yay -S --noconfirm ufwall
20fi
21
22# ── ufw-docker ───────────────────────────────────────────────────────────────
23if ! command -v ufw-docker &>/dev/null; then
24	echo "Installing ufw-docker..."
25	if command -v curl &>/dev/null; then
26		curl -fsSL -o /usr/local/bin/ufw-docker \
27			https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
28	else
29		echo "Neither curl nor wget found — install ufw-docker manually"
30		exit 1
31	fi
32	chmod +x /usr/local/bin/ufw-docker
33fi
34
35echo "Configuring UFW..."
36
37ufw default deny incoming
38ufw default deny routed
39ufw default allow outgoing
40ufw logging medium
41
42# LocalSend needs both tcp and udp 
43ufw allow 53317/tcp comment 'localsend tcp'
44ufw allow 53317/udp comment 'localsend udp'
45
46# Allow Docker containers to resolve DNS via host
47ufw allow in proto udp from 172.17.0.0/16 to 172.17.0.1 port 53 comment 'docker dns'
48
49ufw allow 22/tcp comment 'ssh port'
50
51ufw --force enable
52systemctl enable ufw
53
54echo "Configuring ufw-docker..."
55
56ufw-docker install --docker-subnets
57ufw reload
58
59if systemctl is-active --quiet docker; then
60    systemctl restart docker
61fi
62
63echo ""
64echo "Firewall setup complete!"