#!/bin/sh
# NAT + forward for the LXD bridge lxdbr0 (10.33.132.0/24) on crystalcave.
# The Tegra kernel (5.15-tegra) has no nft NAT chains, so LXD's own ipv4.nat
# fails; this installs the equivalent iptables-legacy-style rules instead.
# Idempotent: `apply` adds only what is missing, `remove` deletes only ours.
set -u
NET=10.33.132.0/24
case "${1:-}" in
  apply)
    iptables -t nat -C POSTROUTING -s "$NET" ! -d "$NET" -j MASQUERADE 2>/dev/null ||
      iptables -t nat -A POSTROUTING -s "$NET" ! -d "$NET" -j MASQUERADE || exit 1
    iptables -C DOCKER-USER -s "$NET" -j ACCEPT 2>/dev/null ||
      iptables -I DOCKER-USER -s "$NET" -j ACCEPT || exit 1
    iptables -C DOCKER-USER -d "$NET" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null ||
      iptables -I DOCKER-USER -d "$NET" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT || exit 1
    ;;
  remove)
    iptables -t nat -D POSTROUTING -s "$NET" ! -d "$NET" -j MASQUERADE 2>/dev/null
    iptables -D DOCKER-USER -s "$NET" -j ACCEPT 2>/dev/null
    iptables -D DOCKER-USER -d "$NET" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null
    exit 0
    ;;
  *) echo "usage: ctg-lxdbr0-nat apply|remove" >&2; exit 2 ;;
esac
