#!/bin/sh
# {{ ansible_managed }}
# Rebuilds the geo sets of table inet host from ipdeny. Any failed download or
# check exits before the swap, so the previous file stays in place.
set -eu

out=/etc/nftables.d/host-geo.nft
countries="{{ firewall.geo_countries | join(' ') }}"
prefix='^[0-9a-f.:]+/[0-9]+$'

tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT

fetch() {
	curl -fsS --retry 3 --max-time 120 -o "$2" "$1"
	grep -Eq "$prefix" "$2" || { echo "no prefixes in $1" >&2; exit 1; }
}

for cc in $countries; do
	fetch "https://www.ipdeny.com/ipblocks/data/aggregated/$cc-aggregated.zone" "$tmp/$cc.v4"
	fetch "https://www.ipdeny.com/ipv6/ipaddresses/aggregated/$cc-aggregated.zone" "$tmp/$cc.v6"
done

elements() {
	cat "$@" | grep -E "$prefix" | sed 's/$/,/'
}

{
	echo "# Generated by $0, do not edit."
	echo 'table inet host {'
	echo '	set geo_v4 { type ipv4_addr; flags interval; auto-merge; elements = {'
	elements "$tmp"/*.v4
	echo '	} }'
	echo '	set geo_v6 { type ipv6_addr; flags interval; auto-merge; elements = {'
	elements "$tmp"/*.v6
	echo '	} }'
	echo '}'
} >"$tmp/host-geo.nft"

nft -c -f "$tmp/host-geo.nft"
install -m 0644 "$tmp/host-geo.nft" "$out.new"
mv -f "$out.new" "$out"

if systemctl -q is-active nft-host.service; then
	systemctl reload nft-host.service
fi