#!/bin/sh
set -eu

NS=le-app-codex
HOST_IF=lecodex-host
NS_IF=lecodex-ns

down() {
  /usr/bin/nft delete table inet le_app_codex 2>/dev/null || true
  /usr/bin/nft delete table ip le_app_codex_nat 2>/dev/null || true
  /usr/bin/ip link delete "$HOST_IF" 2>/dev/null || true
  /usr/bin/ip netns delete "$NS" 2>/dev/null || true
}

case "${1:-}" in
  up)
    test "$(id -u)" -eq 0
    test -r /etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED
    /usr/bin/grep -q 'elements = { 9\.9\.9\.9, 149\.112\.112\.112 }' /etc/nftables.d/50-le-app-codex.nft
    /usr/bin/grep -q 'elements = { 74\.67\.173\.56 }' /etc/nftables.d/50-le-app-codex.nft
    test ! -e /run/netns/$NS
    ! /usr/bin/nft list table inet le_app_codex >/dev/null 2>&1
    ! /usr/bin/nft list table ip le_app_codex_nat >/dev/null 2>&1
    trap down EXIT HUP INT TERM
    /usr/bin/ip netns add "$NS"
    /usr/bin/ip link add "$HOST_IF" type veth peer name "$NS_IF"
    /usr/bin/ip link set "$NS_IF" netns "$NS"
    /usr/bin/ip address add 10.200.120.1/30 dev "$HOST_IF"
    /usr/bin/ip link set "$HOST_IF" up
    /usr/bin/ip -n "$NS" link set lo up
    /usr/bin/ip -n "$NS" address add 10.200.120.2/30 dev "$NS_IF"
    /usr/bin/ip -n "$NS" link set "$NS_IF" up
    /usr/bin/ip -n "$NS" route add default via 10.200.120.1 dev "$NS_IF"
    /usr/bin/ip netns exec "$NS" /usr/bin/sysctl -q -w net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1
    /usr/bin/nft -f /etc/nftables.d/50-le-app-codex.nft
    trap - EXIT HUP INT TERM
    ;;
  down) down ;;
  *) echo 'usage: le-app-codex-netns up|down' >&2; exit 64 ;;
esac