#!/bin/bash
# microvm-net.sh — host prep for microvm taps + NAT (idempotent; #615)
# Run by microvm-net.service at boot, and by 13-microvm-setup.sh.
set -euo pipefail

# tap pool: mv-<prefix><slot>; per-tap /30 inside the user's /24
POOLS=(
  "reachableceo 172.30.0 r"
  "reachableceo-offstage 172.30.1 o"
)

sysctl -qw net.ipv4.ip_forward=1

for entry in "${POOLS[@]}"; do
  read -r user subnet prefix <<<"$entry"
  for slot in 0 1 2 3; do
    tap="mv-$prefix$slot"
    ip tuntap add mode tap user "$user" dev "$tap" 2>/dev/null || true
    ip addr replace "$subnet.$((4*slot+1))/30" dev "$tap"
    ip link set "$tap" up
  done
done

# NAT for both pools (iptables-nft; coexists with docker chains)
iptables -t nat -C POSTROUTING -s 172.30.0.0/23 -j MASQUERADE 2>/dev/null || \
  iptables -t nat -A POSTROUTING -s 172.30.0.0/23 -j MASQUERADE
iptables -C FORWARD -s 172.30.0.0/23 -j ACCEPT 2>/dev/null || \
  iptables -A FORWARD -s 172.30.0.0/23 -j ACCEPT
iptables -C FORWARD -d 172.30.0.0/23 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || \
  iptables -A FORWARD -d 172.30.0.0/23 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

echo "microvm-net: taps + NAT ready"
ip -br addr | grep '^mv-'