# Only ports of services that actually run are open to the internet.
# Everything else is reachable from the private network and WireGuard.

locals {
  internal_networks = ["10.10.0.0/20", "10.20.0.0/24"] # VPC, WireGuard
  anywhere          = ["0.0.0.0/0", "::/0"]

  ops_public = [
    { protocol = "tcp", port = "22" },    # git over SSH (Forgejo); shell users are limited by sshd
    { protocol = "tcp", port = "80" },    # Traefik
    { protocol = "tcp", port = "443" },   # Traefik
    { protocol = "udp", port = "60101" }, # WireGuard
  ]

  services_public = [
    { protocol = "tcp", port = "25565-25566" }, # Minecraft (Paper, Fossils)
    { protocol = "udp", port = "19132" },       # Minecraft Bedrock (Geyser)
  ]
}

resource "hcloud_firewall" "ops_fw" {
  name = "asxpio-ops-fw"

  dynamic "rule" {
    for_each = ["tcp", "udp"]
    content {
      direction  = "in"
      protocol   = rule.value
      port       = "any"
      source_ips = local.internal_networks
    }
  }

  rule {
    direction  = "in"
    protocol   = "icmp"
    source_ips = local.internal_networks
  }

  dynamic "rule" {
    for_each = local.ops_public
    content {
      direction  = "in"
      protocol   = rule.value.protocol
      port       = rule.value.port
      source_ips = local.anywhere
    }
  }
}

resource "hcloud_firewall" "services_fw" {
  name = "asxpio-services-fw"

  dynamic "rule" {
    for_each = ["tcp", "udp"]
    content {
      direction  = "in"
      protocol   = rule.value
      port       = "any"
      source_ips = local.internal_networks
    }
  }

  rule {
    direction  = "in"
    protocol   = "icmp"
    source_ips = local.internal_networks
  }

  dynamic "rule" {
    for_each = local.services_public
    content {
      direction  = "in"
      protocol   = rule.value.protocol
      port       = rule.value.port
      source_ips = local.anywhere
    }
  }
}