#!/bin/bash
# Optional firewall for a demo host: clearnet cannot reach Next/nginx loopback fronts.
# Run once with sudo after SSH access is confirmed. Re-read if your SSH port is not 22.
#
#   sudo bash scripts/classroom-ufw.sh
#
set -euo pipefail
[[ "${EUID}" -eq 0 ]] || { echo "Run as root (sudo)."; exit 1; }

SSH_PORT="${SSH_PORT:-22}"

echo "This will enable UFW: default deny incoming, allow outgoing, allow TCP ${SSH_PORT} (SSH)."
echo "Tor hidden services use outbound circuits only; no inbound clearnet ports are opened for CyberLux."
read -r -p "Continue? [y/N] " ok || true
[[ "${ok:-}" =~ ^[Yy]$ ]] || { echo "Aborted."; exit 0; }

ufw default deny incoming
ufw default allow outgoing
ufw allow "${SSH_PORT}/tcp" comment "ssh"
ufw --force enable
ufw status verbose