#!/usr/bin/env bash
# heleos: block outbound SMTP from containers (spam prevention from hacked sites).
# Managed by Ansible. Implemented as a dedicated chain jumped from DOCKER-USER,
# which Docker evaluates before its own FORWARD rules. Idempotent on re-run.
set -euo pipefail

PORTS="{{ smtp_blocked_ports | join(',') }}"
RELAY="{{ smtp_relay_host }}"

# DOCKER-USER only exists once the Docker daemon has set up networking. Wait for it.
for _ in $(seq 1 30); do
    if iptables -L DOCKER-USER -n >/dev/null 2>&1; then
        break
    fi
    sleep 1
done

# (Re)build our chain from scratch.
iptables -N HELEOS-EGRESS 2>/dev/null || true
iptables -F HELEOS-EGRESS

# Let established/return traffic through fast.
iptables -A HELEOS-EGRESS -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN

{% if smtp_relay_host | length > 0 %}
# Permit SMTP only to the approved relay.
iptables -A HELEOS-EGRESS -p tcp -d "${RELAY}" -m multiport --dports "${PORTS}" -j RETURN
{% endif %}

# Reject all other outbound SMTP.
iptables -A HELEOS-EGRESS -p tcp -m multiport --dports "${PORTS}" \
    -j REJECT --reject-with icmp-admin-prohibited

# Ensure DOCKER-USER jumps into our chain exactly once.
if ! iptables -C DOCKER-USER -j HELEOS-EGRESS 2>/dev/null; then
    iptables -I DOCKER-USER -j HELEOS-EGRESS
fi