#!/bin/sh
# ============================================================
# OpenClaw Gitea webhook 通道：群晖主机 8899 -> OpenClaw 容器
# 幂等：重复运行不会产生重复规则；需 root 运行
# 适用：群晖 DSM 7.x，任务计划-开机启动
# ============================================================
export PATH=/sbin:/bin:/usr/sbin:/usr/bin:$PATH

OC_IP="172.21.0.2"              # OpenClaw 容器 IP（容器重建后若 IP 变了，改这里）
PORT="8899"                     # 接收服务端口
LOG="/volume1/scripts/openclaw-webhook-iptables.log"

mkdir -p "$(dirname "$LOG")" 2>/dev/null
log() { echo "[$(date '+%F %T')] $*" >> "$LOG"; }

log "=== run start (OC_IP=$OC_IP PORT=$PORT) ==="

# --- 1) DNAT：群晖主机 PORT -> OpenClaw 容器 ---
if iptables -t nat -C PREROUTING -p tcp --dport "$PORT" \
      -j DNAT --to-destination "$OC_IP:$PORT" 2>/dev/null; then
  log "DNAT 已存在，跳过"
else
  iptables -t nat -A PREROUTING -p tcp --dport "$PORT" \
      -j DNAT --to-destination "$OC_IP:$PORT" && log "已添加 DNAT"
fi

# --- 2) 放行跨 docker 网络转发（插到 DOCKER-USER 最前，绕过隔离 DROP）---
#     开机时 docker 可能还没起，先等 DOCKER-USER 链就绪
i=0
while ! iptables -L DOCKER-USER -n >/dev/null 2>&1; do
  i=$((i+1))
  [ "$i" -gt 36 ] && { log "等待 DOCKER-USER 超时，放弃"; exit 1; }
  sleep 5
done

if iptables -C DOCKER-USER -p tcp -d "$OC_IP" --dport "$PORT" -j ACCEPT 2>/dev/null; then
  log "DOCKER-USER 放行已存在，跳过"
else
  iptables -I DOCKER-USER 1 -p tcp -d "$OC_IP" --dport "$PORT" -j ACCEPT \
      && log "已添加 DOCKER-USER 放行"
fi

log "=== run done ==="

# 可选的即时自检（注释掉即可）
# iptables -t nat -L PREROUTING -n | grep ":$PORT"
# iptables -L DOCKER-USER -n | grep "$OC_IP"