#!/usr/bin/env bash
# Set the two kernel sysctls wg-easy needs, directly on the VPS host.
#
# Why this can't just be docker-compose.yaml's `sysctls:` key: that key
# sets namespaced (per-network-namespace) sysctls inside a container's own
# network namespace. wg-easy runs with network_mode: host (see the comment
# on that service), which means it has no network namespace of its own —
# runc flatly refuses to start the container if `sysctls:` is set at all
# under host networking ("not allowed in host network namespace"),
# confirmed by actually trying it, not assumed. These have to be host-level
# settings instead.
#
# Run this once on the VPS, before `docker compose up -d`.

set -euo pipefail

if [[ $EUID -ne 0 ]]; then
  echo "must be run as root" >&2
  exit 1
fi

CONF_FILE=/etc/sysctl.d/99-furtka-gateway.conf

cat > "$CONF_FILE" <<'EOF'
# Required by furtka-gateway's wg-easy service (network_mode: host) — see
# docker-compose.yaml and ops/host-sysctls.sh.
net.ipv4.ip_forward=1
net.ipv4.conf.all.src_valid_mark=1
EOF

sysctl --system >/dev/null

echo "Applied and persisted (via $CONF_FILE):"
sysctl net.ipv4.ip_forward net.ipv4.conf.all.src_valid_mark