#!/usr/bin/env bash
# nh3-scale (CT107): SOCKS5 egress proxy over the mesh — fleet-internal only.
# Successor to the retired nh3-dev danted (2026-09-06): same residential NH3 egress,
# now hosted ON the exit-node router so mesh peers reach it at 100.64.0.1:1080.
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive
dpkg -s dante-server >/dev/null 2>&1 || { apt-get update -qq; apt-get install -y -qq dante-server; }
cat > /etc/danted.conf <<'CONF'
# Fleet egress proxy on nh3-scale (PFI infra) — SOCKS5, INTERNAL-ONLY.
# Egress via NH3's residential line. Managed from eshpfi-management
# (scripts/setup-nh3-scale-socks-egress.sh) — edit there, not here.
logoutput: syslog
internal: 0.0.0.0 port = 1080
external: eth0
socksmethod: none
clientmethod: none
user.privileged: root
user.unprivileged: nobody
# Client ACL — mesh + fleet RFC1918 only. NOT an open proxy.
client pass {
    from: 100.64.0.0/10 to: 0.0.0.0/0
    log: error
}
client pass {
    from: 10.0.0.0/8 to: 0.0.0.0/0
    log: error
}
client block {
    from: 0.0.0.0/0 to: 0.0.0.0/0
    log: connect error
}
socks pass {
    from: 100.64.0.0/10 to: 0.0.0.0/0
    protocol: tcp udp
    log: error
}
socks pass {
    from: 10.0.0.0/8 to: 0.0.0.0/0
    protocol: tcp udp
    log: error
}
socks block {
    from: 0.0.0.0/0 to: 0.0.0.0/0
}
CONF
mkdir -p /etc/systemd/system/danted.service.d
cat > /etc/systemd/system/danted.service.d/override.conf <<'UNIT'
[Unit]
After=network-online.target tailscaled.service
Wants=network-online.target
[Service]
Restart=on-failure
RestartSec=5
UNIT
systemctl daemon-reload
systemctl enable --now danted
systemctl restart danted
sleep 1
systemctl is-active danted
ss -ltn | grep ":1080 "