#!/usr/bin/env bash
# Open rootless pepsi high-ports on koopa (firewalld).
# Compose map (LAN bind 192.168.100.95):
#   1025→25  1465→465  1587→587  1993→993  18443→443
# Freigabe: human this session. Run on koopa as root / sudo.
set -euo pipefail

PORTS=(1025/tcp 1465/tcp 1587/tcp 1993/tcp 18443/tcp)
ZONE="${FIREWALLD_ZONE:-}"

if [[ ${EUID:-$(id -u)} -ne 0 ]]; then
  echo "STATUS=need_root HINT='sudo $0'"
  exit 2
fi

if ! command -v firewall-cmd >/dev/null 2>&1; then
  echo "STATUS=no_firewalld"
  exit 3
fi

if ! firewall-cmd --state >/dev/null 2>&1; then
  echo "STATUS=firewalld_down"
  exit 4
fi

if [[ -z "$ZONE" ]]; then
  # Prefer the zone that owns the LAN NIC; else default.
  ZONE=$(firewall-cmd --get-zone-of-interface=eno1 2>/dev/null || true)
  if [[ -z "$ZONE" ]]; then
    ZONE=$(firewall-cmd --get-default-zone)
  fi
fi

echo "STATUS=start ZONE=$ZONE HOST=$(hostname -s)"

added=0
present=0
for p in "${PORTS[@]}"; do
  if firewall-cmd --zone="$ZONE" --query-port="$p" >/dev/null 2>&1; then
    echo "PORT=$p STATE=present"
    present=$((present + 1))
  else
    firewall-cmd --zone="$ZONE" --add-port="$p" --permanent
    echo "PORT=$p STATE=added_permanent"
    added=$((added + 1))
  fi
done

firewall-cmd --reload
echo "STATUS=reloaded"

ok=0
for p in "${PORTS[@]}"; do
  if firewall-cmd --zone="$ZONE" --query-port="$p" >/dev/null 2>&1; then
    echo "VERIFY=$p OK=1"
    ok=$((ok + 1))
  else
    echo "VERIFY=$p OK=0"
  fi
done

echo "STATUS=done ZONE=$ZONE ADDED=$added PRESENT_BEFORE=$present VERIFY_OK=$ok EXPECT=${#PORTS[@]}"
if [[ "$ok" -eq "${#PORTS[@]}" ]]; then
  exit 0
fi
exit 1