#!/usr/bin/env bash
# web/real-ip -- trust the proxy in front of nginx (CDN, load balancer)
#
# Without this, every visitor appears to come from the proxy address, which
# breaks rate limiting, fail2ban and access logs.
set -o pipefail
SELF=$(readlink -f "${BASH_SOURCE[0]}")
NV_BASE=$(cd "$(dirname "$SELF")/../../.." && pwd)
export NV_BASE
# shellcheck source=/dev/null
. "$NV_BASE/lib/core/bootstrap.sh"

nv_require_root || exit 1
ui_header "$(t web_m_realip)"

cfg=/etc/nginx/conf.d/10-nhanhvps-realip.conf
if [ -f "$cfg" ]; then
    ui_kv "$(t web_state)" "$(t state_enabled)"
    sed -n '1,10p' "$cfg" | sed 's/^/  /'
else
    ui_kv "$(t web_state)" "$(t state_disabled)"
fi
ui_blank
ui_info "$(t realip_hint)"
ui_blank

printf '  %s (0 = %s): ' "$(t realip_prompt)" "$(t web_remove_protection)"
read -r ranges || exit 130
ranges=$(nv_trim "$ranges")

if [ "$ranges" = "0" ]; then
    rm -f "$cfg"
    nginx -t >/dev/null 2>&1 && svc_reload nginx
    nv_trace realip "disabled"
    ui_ok "$(t realip_off)"
    exit 0
fi

# only plain CIDR/address tokens are accepted
for r in $ranges; do
    case $r in
        *[!0-9./:]*) ui_err "$(t realip_bad "$r")"; exit 2 ;;
    esac
done

{
    printf '# managed by nhanhvps -- trusted proxy addresses\n'
    for r in $ranges; do printf 'set_real_ip_from %s;\n' "$r"; done
    printf 'real_ip_header X-Forwarded-For;\n'
    printf 'real_ip_recursive on;\n'
} >"$cfg"

if nginx -t >/dev/null 2>&1; then
    svc_reload nginx
    nv_trace realip "$ranges"
    ui_ok "$(t realip_on)"
    ui_warn "$(t realip_warn)"
else
    rm -f "$cfg"
    nv_fail 2201 "$(t site_fail_nginx)"
    exit 1
fi
exit 0
