#!/bin/bash
#
# disable-ipv6.sh — kill IPv6 live + persist (no reboot) [#748]
# Run as root. Idempotent. Charles ruling 2026-09-03: IPv6 off fleet-wide.
# Rollback per host: delete /etc/sysctl.d/99-disable-ipv6.conf, then
#   sysctl -w net.ipv6.conf.all.disable_ipv6=0 (and per-interface =0 as needed).
#
set -euo pipefail

CONF=/etc/sysctl.d/99-disable-ipv6.conf
cat > "$CONF" <<'EOF'
# IPv6 disabled fleet-wide (Charles ruling 2026-09-03, [#748], follow-on to [#745])
# Rollback: delete this file, then set net.ipv6.conf.{all,default,lo}.disable_ipv6=0
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
EOF

# Live apply: 'all' gates new traffic; per-interface flags disable existing ifs
# (incl. lo, tailscale0, docker0 — fleet-wide consistent, v4 everywhere).
sysctl -q -w net.ipv6.conf.all.disable_ipv6=1
sysctl -q -w net.ipv6.conf.default.disable_ipv6=1
sysctl -q -w net.ipv6.conf.lo.disable_ipv6=1
for f in /proc/sys/net/ipv6/conf/*/disable_ipv6; do
  echo 1 > "$f" 2>/dev/null || true
done

v=$(sysctl -n net.ipv6.conf.all.disable_ipv6)
n=$(ip -6 addr show 2>/dev/null | grep -c inet6 || true)
echo "host=$(hostname) ipv6_disabled=$v remaining_inet6_addrs=$n"