---
# Host inbound filtering lives in a DEDICATED nftables table (inet heleos) so it
# never flushes or clobbers the ip/ip6 filter+nat tables that Docker manages.
- name: Ensure nftables include dir exists
  ansible.builtin.file:
    path: /etc/nftables.d
    state: directory
    mode: "0755"

- name: Install root nftables config (include-only, no global flush)
  ansible.builtin.copy:
    dest: /etc/nftables.conf
    owner: root
    group: root
    mode: "0755"
    content: |
      #!/usr/sbin/nft -f
      # Managed by heleos platform-infra. Include per-table files WITHOUT
      # flushing the global ruleset, so Docker's own tables are left intact.
      include "/etc/nftables.d/*.nft"
  notify: Reload nftables

- name: Install heleos host input table
  ansible.builtin.template:
    src: heleos-input.nft.j2
    dest: /etc/nftables.d/heleos-input.nft
    owner: root
    group: root
    mode: "0644"
  notify: Reload nftables

- name: Enable and start nftables
  ansible.builtin.systemd:
    name: nftables
    enabled: true
    state: started

# --- Container egress SMTP filtering (via DOCKER-USER) -----------------------
- name: Install container egress filter script
  ansible.builtin.template:
    src: heleos-docker-egress.sh.j2
    dest: /usr/local/sbin/heleos-docker-egress.sh
    owner: root
    group: root
    mode: "0755"
  notify: Reapply docker egress rules

- name: Install container egress systemd unit
  ansible.builtin.copy:
    dest: /etc/systemd/system/heleos-docker-egress.service
    owner: root
    group: root
    mode: "0644"
    content: |
      [Unit]
      Description=heleos: block outbound SMTP from containers (DOCKER-USER)
      After=docker.service
      Requires=docker.service

      [Service]
      Type=oneshot
      ExecStart=/usr/local/sbin/heleos-docker-egress.sh
      RemainAfterExit=yes

      [Install]
      WantedBy=multi-user.target
  notify: Reapply docker egress rules

- name: Enable container egress service
  ansible.builtin.systemd:
    name: heleos-docker-egress.service
    enabled: true
    daemon_reload: true
    state: started