#!/bin/bash

printf "Better to run as root, because of permisions handeling.\n"

sleep 2


### Firewall 

printf "Do you want to set up firewall rules by iptables? [Y/n]: \n"
read ansFirewallSetup


if [[ "$ansFirewallSetup" =~ ("N"|"n") ]]; then

	printf "+ Thanks, working on next bit\n"


elif [[ "$ansFirewallSetup" =~ ("Y"|"y") || -z $ansFirewallSetup ]]; then
	
	printf "Do you want to block non-Tailscale ssh connections? [Y/n]: "
	read sshBlockRange


	if [[ "$sshBlockRange" =~ ("n"|"N") ]]; then
	
		printf "If you want, input your own IP range [N/range]\n"
		read sshRange

		if [[ "$sshRange" =~ ("n"|"N") || -z $sshRange ]]; then
			printf "+ Making your SSH connections wide and open. After we are done, do somethink with it. /n"
			ipList="*"
		else
			printf "+ Accepting SSH connections only on these ip's: $sshRange\n"
			ipList="$sshRange"
		fi

	fi	
fi

### Update 

sleep 2

printf "+ Updating your base system\n"

apt update && apt upgrade -y

printf "+ Installing depandencies \n"

apt install openjdk-17-jre-headless screen


if [[ "$ansFirewallSetup" =~ ("Y"|"y") || -z $ansFirewallSetup  ]]; then
	 apt install iptables -y
fi

### User managment 

printf "+ creating group and user for proxy \n"
groupadd velocity

useradd --system --shell /usr/sbin/nologin --home /opt/velocity -g velocity velocity


### File structure 

printf "+ creating file structure in /opt/velocity/ \n"
mkdir /opt/velocity

mv data/velocity*.jar start.sh /opt/velocity/

mkdir /opt/velocity/plugins
mv data/Ambassador*.jar /opt/velocity/plugins

mv data/velocity.toml /opt/velocity/
mv data/forwarding.secret /opt/velocity/
mv data/start.sh /opt/velocity/


### Permisions 

printf "+ handeling permisions \n"
chown -R velocity:velocity  /opt/velocity/



### SystemD service
printf "+ Preparign systemD service\n"
mv data/mc-velocity.service /etc/systemd/system/

systemctl daemon-reload

### integration of Maxopoly's instructions on firewall 

if [[ "$ansFirewallSetup" =~ ("Y"|"y") || -z "$ansFirewallSetup" ]]; then
	
		printf "+ Executing firewall setup"

		iptables -P INPUT ACCEPT #Clears existing rules

		iptables -A INPUT -i lo -j ACCEPT #Allow loopback

		iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #Allow continuing connections

		iptables -A INPUT -p tcp --dport 25577 -j ACCEPT #Allow Velocity port

		if [[ "$ipList" = "*" ]]; then
			
			### Wide and open

			iiptables -A INPUT -p tcp --dport 22 j ACCEPT # Allow wide and open ssh on port 22
		
		elif [[! "$ipList" -z ]]; then

			### Manual IP range

			iptables -A INPUT -p tcp --dport 22 --source $ipList -j ACCEPT # Allow limited ssh port 22
		fi

		iptables -L ### Good place to paste a manual check to not lock yourself out 

		printf "\n Does it looks right? [Y/n]: "
			read ansFirewallOK

		if [[ "$ansFirewallOK" =~ ("Y"|"y") || -z "$ansFirewallOK" ]]; then	
		
			iptables -P INPUT DROP #Disallow everythink else

			iptables -P FORWARD DROP #Block all forwarding

			iptables -P OUTPUT ACCEPT #Allow all outgouing
	
			 apt install iptables-persistent -y

		else
			
			printf "\nOK it is time for manual configuration"
			printf "\nAfter you are done ramamber to run 'apt install iptables-persistent' to save your config. System will automaticly remove your work after restart"

		fi
fi

### tailsclae install

printf "Do you want to install Tailscale now? [Y/n]: \n"
read ansTail

if [[ "$ansTail" =~ ("y"|"Y") || -z $ansTail ]]; then
	
	curl -fsSL https://tailscale.com/install.sh | sh


	if [[ "$sshBlockRange" =~ ("y"|"Y") || -z $sshBlockRange ]]; then
		tailscale up --ssh
	else
		tailscale up
	fi

fi	


### Start service

printf "Do you want to start velocity proxy right now? [Y/n]: \n"
read startServer

if [[ "$startServer" =~ ("y"|"Y") || -z $startServer ]]; then
	systemctl start mc-velocity
fi
	
systemctl enable mc-velocity

printf "\n Everythink is now set up. It is good idea to check these:"
printf "\n systemctl status mc-velocity"
printf "\n su velocity -s /bin/bash \n"