#!/usr/bin/env bash
set -euo pipefail
[[ $EUID == 0 ]] || { echo 'Run with sudo.' >&2; exit 1; }
cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.."
command -v iptables >/dev/null
python3 - <<'PY'
import ipaddress,json,subprocess
from pathlib import Path
values = {}
for line in Path('.env').read_text().splitlines():
    key, sep, value = line.partition('=')
    if sep and key in ('BIND_ADDRESS','WORKSTATION_IP'):
        values[key] = str(ipaddress.IPv4Address(value))
lan, workstation = values['BIND_ADDRESS'], values['WORKSTATION_IP']
interfaces = json.loads(subprocess.check_output(['ip','-j','-4','address','show']))
if lan not in [a.get('local') for i in interfaces for a in i.get('addr_info',[])]:
    raise SystemExit('BIND_ADDRESS is not assigned to this VM.')
if ipaddress.ip_address(lan).is_unspecified or ipaddress.ip_address(lan).is_loopback:
    raise SystemExit('Use the actual VM LAN address.')
p=Path('/etc/host-metrics-access.conf')
p.write_text(f'VM_LAN_IP={lan}\nWORKSTATION_IP={workstation}\n');p.chmod(0o600)
print(f'Restricting the metrics service ports on {lan} to workstation {workstation}.')
PY
install -m 0755 configs/network/access-rules.sh /usr/local/sbin/host-metrics-access
install -m 0644 configs/network/host-metrics-access.service /etc/systemd/system/host-metrics-access.service
systemctl daemon-reload
systemctl enable host-metrics-access.service
systemctl restart host-metrics-access.service
iptables -w 5 -S HOST-METRICS-ACCESS