#!/bin/bash

#=============================================
#Global Variables
router_wan_nic=enp1s0
router_lan_nic=enp2s0

# MACs
jump_mac=52:54:00:d1:8a:24
storage_mac=52:54:00:77:42:84


#Network plan
domain=tux.local
ip_network=172.16.0
ip_router=.1
ip_jump=.2
ip_storage=.4
#=============================================





#Install common programs and upgrade
dnf install mc vim nano -y
dnf upgrade -y

#Disabler SELinux
sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config

#Opretter pingu
useradd pingu
echo 'Pa$$w0rd' | passwd --stdin pingu
usermod -aG wheel pingu

#SSH setup
sed -i 's/.*PermitRootLogin.*/PermitRootLogin no/g' /etc/ssh/sshd_config
echo AllowUsers pingu >> /etc/ssh/sshd_config


#Setup Hostname
hostnamectl set-hostname router.$domain

#Starting external nic and enableing autoconnect
nmcli device connect $router_wan_nic
nmcli connection modify $router_wan_nic connection.autoconnect yes

#Static internal nic
nmcli connection modify $router_lan_nic ipv4.addresses $ip_network$ip_router/24
nmcli connection modify $router_lan_nic ipv4.method manual
nmcli connection modify $router_lan_nic connection.autoconnect yes
#nmcli connection up $router_lan_nic
nmcli device connect $router_lan_nic

#Setup external firewall zone
firewall-cmd --permanent --zone=external --change-interface=$router_wan_nic
firewall-cmd --permanent --zone=external --remove-service=ssh
firewall-cmd --permanent --zone=external --add-forward-port=port=22:proto=tcp:toport=22:toaddr=$ip_network$ip_jump

#Setup internal firewall zone
firewall-cmd --permanent --zone=internal --change-interface=$router_lan_nic
firewall-cmd --permanent --zone=internal --remove-service={ssh,mdns,dhcpv6-client,cockpit,samba-client}
firewall-cmd --permanent --zone=internal --add-service={dns,dhcp}

#Setup secure firewall zone
firewall-cmd --permanent --new-zone=secure
firewall-cmd --permanent --zone=secure --add-source=$ip_network$ip_jump
firewall-cmd --permanent --zone=secure --add-service={ssh,dns,dhcp}

#Setup firewall forwarding policy
firewall-cmd --permanent --new-policy=lan2wan
firewall-cmd --permanent --policy=lan2wan --add-ingress-zone=internal
firewall-cmd --permanent --policy=lan2wan --add-ingress-zone=secure
firewall-cmd --permanent --policy=lan2wan --add-egress-zone=external
firewall-cmd --permanent --policy=lan2wan --set-priority=100
firewall-cmd --permanent --policy=lan2wan --set-target=ACCEPT



#Enable ip forwarding permanent
echo net.ipv4.ip_forward=1 >> /etc/sysctl.d/ipforward.conf

#Setup dnsmasq including static dhcp
dnf install dnsmasq -y
systemctl enable dnsmasq.service

cat << EOF >> /etc/dnsmasq.d/my.conf
# DHCP SERVER SETTINGS
listen-address=$ip_network$ip_router
interface=$router_lan_nic

# DHCP CLIENT INFORMATION
dhcp-range=$ip_network.100,$ip_network.200,24h
dhcp-option=option:router,$ip_network$ip_router
dhcp-option=option:dns-server,$ip_network$ip_router

### Jump host
dhcp-host=$jump_mac,$ip_network$ip_jump

### Storage host
dhcp-host=$storage_mac,$ip_network$ip_storage

# DNS SERVER SETTINGS
domain=$domain
local=/$domain/

#DNS RECORDS
host-record=router.$domain,$ip_network$ip_router
host-record=jump.$domain,$ip_network$ip_jump
host-record=storage.$domain,$ip_network$ip_storage

EOF

reboot
