#!/usr/bin/env bash
# Einmalig ausführen: sudo ./scripts/firewall-ufw.sh
# Öffnet die Caddy-Ports (API + Web-Chat) nur für LAN und NetBird (wt0). Caddy filtert zusätzlich selbst.
set -euo pipefail

PORT="${LISTEN_PORT:-8800}"
WEBUI_PORT="${WEBUI_PORT:-8801}"
LAN="${LAN_NET:-192.168.178.0/24}"
VPN_IF="${VPN_IF:-wt0}"

ufw allow from "$LAN" to any port "$PORT" proto tcp comment 'localai LAN'
ufw allow in on "$VPN_IF" to any port "$PORT" proto tcp comment 'localai NetBird'
ufw allow from "$LAN" to any port "$WEBUI_PORT" proto tcp comment 'localai webchat LAN'
ufw allow in on "$VPN_IF" to any port "$WEBUI_PORT" proto tcp comment 'localai webchat NetBird'
ufw status numbered | grep -E "$PORT|$WEBUI_PORT" || true