#!/bin/bash
set -euo pipefail

USER_NAME="${BOOTSTRAP_USER:-atlas}"
PORT="${BOOTSTRAP_PORT:-1488}"
PUBKEY="${BOOTSTRAP_PUBKEY}"
TCP_PORTS="${BOOTSTRAP_TCP_PORTS:-1488 80 443}"
UDP_PORTS="${BOOTSTRAP_UDP_PORTS:-51820}"
UFW_IN="${BOOTSTRAP_UFW_IN:-deny}"
UFW_OUT="${BOOTSTRAP_UFW_OUT:-allow}"
UFW_FWD="${BOOTSTRAP_UFW_FWD:-deny}"
UFW_APP="${BOOTSTRAP_UFW_APP:-skip}"
ENABLE_BBR="${BOOTSTRAP_ENABLE_BBR:-true}"
DISABLE_IPV6="${BOOTSTRAP_DISABLE_IPV6:-true}"
DISABLE_ICMP="${BOOTSTRAP_DISABLE_ICMP:-false}"

id -u "${USER_NAME}" &>/dev/null || useradd -m -s /bin/bash -G sudo "${USER_NAME}"
mkdir -p "/home/${USER_NAME}/.ssh"
echo "${PUBKEY}" > "/home/${USER_NAME}/.ssh/authorized_keys"
chmod 700 "/home/${USER_NAME}/.ssh"
chmod 600 "/home/${USER_NAME}/.ssh/authorized_keys"
chown -R "${USER_NAME}:${USER_NAME}" "/home/${USER_NAME}/.ssh"

echo "${USER_NAME} ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/${USER_NAME}"
chmod 440 "/etc/sudoers.d/${USER_NAME}"

if systemctl is-active --quiet ssh.socket 2>/dev/null; then
    systemctl disable --now ssh.socket
fi

rm -rf /etc/ssh/sshd_config.d/*.conf
cat << SSHEOF > /etc/ssh/sshd_config
Port ${PORT}
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
PubkeyAuthentication yes
X11Forwarding no
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
SSHEOF

systemctl enable --now ssh.service
systemctl restart ssh.service

which ufw >/dev/null 2>&1 || (DEBIAN_FRONTEND=noninteractive apt-get update -y && DEBIAN_FRONTEND=noninteractive apt-get install -y ufw)
ufw --force reset
ufw default ${UFW_IN} incoming
ufw default ${UFW_OUT} outgoing
ufw default ${UFW_FWD} forward
sed -i -E 's/^DEFAULT_APPLICATION_POLICY=.*/DEFAULT_APPLICATION_POLICY="'${UFW_APP}'"/' /etc/default/ufw || true

if [[ "${DISABLE_IPV6}" == "true" ]]; then
    sed -i -E 's/^IPV6=.*/IPV6=no/' /etc/default/ufw || true
fi

for p in ${TCP_PORTS}; do
    ufw allow "${p}/tcp"
done

for p in ${UDP_PORTS}; do
    ufw allow "${p}/udp"
done

ufw --force enable

rm -f /etc/sysctl.d/99-atlas.conf
touch /etc/sysctl.d/99-atlas.conf

if [[ "${ENABLE_BBR}" == "true" ]]; then
    printf "net.core.default_qdisc = fq\nnet.ipv4.tcp_congestion_control = bbr\n" >> /etc/sysctl.d/99-atlas.conf
fi

if [[ "${DISABLE_IPV6}" == "true" ]]; then
    printf "net.ipv6.conf.all.disable_ipv6 = 1\nnet.ipv6.conf.default.disable_ipv6 = 1\nnet.ipv6.conf.lo.disable_ipv6 = 1\n" >> /etc/sysctl.d/99-atlas.conf
fi

if [[ "${DISABLE_ICMP}" == "true" ]]; then
    printf "net.ipv4.icmp_echo_ignore_all = 1\n" >> /etc/sysctl.d/99-atlas.conf
fi

sysctl --system >/dev/null 2>&1 || true