#!/usr/bin/env bash
# Restrict only this stack's published LAN ports, not SSH or other containers.
set -euo pipefail
source /etc/host-metrics-access.conf
iptables -w 5 -N DOCKER-USER 2>/dev/null || iptables -w 5 -S DOCKER-USER >/dev/null
iptables -w 5 -N HOST-METRICS-ACCESS 2>/dev/null || iptables -w 5 -F HOST-METRICS-ACCESS
for port in 4900 5601 9090 9092 9200 9273; do
  iptables -w 5 -A HOST-METRICS-ACCESS -p tcp -s "$WORKSTATION_IP" \
    -m conntrack --ctdir ORIGINAL --ctorigdst "$VM_LAN_IP" --ctorigdstport "$port" -j RETURN
  iptables -w 5 -A HOST-METRICS-ACCESS -p tcp \
    -m conntrack --ctdir ORIGINAL --ctorigdst "$VM_LAN_IP" --ctorigdstport "$port" -j DROP
done
iptables -w 5 -A HOST-METRICS-ACCESS -j RETURN
if ! iptables -w 5 -C DOCKER-USER -j HOST-METRICS-ACCESS 2>/dev/null; then
  iptables -w 5 -I DOCKER-USER 1 -j HOST-METRICS-ACCESS
fi