#!/bin/bash
set -e

# Start Tailscale in background
/usr/local/bin/tailscaled --tun=userspace-networking --encrypt-state=false --hardware-attestation=false &
TAILSCALED_PID=$!

# Wait for Tailscale to initialize
sleep 2

if [ -z "${TS_AUTHKEY:-}" ]; then
    echo "TS_AUTHKEY must be set when enabling the tailscale profile" >&2
    kill "$TAILSCALED_PID"
    wait "$TAILSCALED_PID" || true
    exit 1
fi

# tailscale up flags change over time; avoid deprecated options.
/usr/local/bin/tailscale up --authkey="$TS_AUTHKEY" ${TS_EXTRA_ARGS:-"--accept-dns=false --advertise-exit-node"}

# Wait a bit for Tailscale to be ready
sleep 3

# Configure iptables to redirect all traffic through redsocks
echo "Setting up iptables rules for traffic redirection..."

# Enable IP forwarding for exit node
sysctl -w net.ipv4.ip_forward=1 2>/dev/null || true
sysctl -w net.ipv6.conf.all.forwarding=1 2>/dev/null || true

# Create a chain for darkproxy traffic
iptables -t nat -N DARKPROXY 2>/dev/null || iptables -t nat -F DARKPROXY

# Whitelist local traffic and Tailscale
iptables -t nat -A DARKPROXY -d 127.0.0.0/8 -j RETURN
iptables -t nat -A DARKPROXY -d 10.5.0.0/16 -j RETURN
iptables -t nat -A DARKPROXY -d 100.64.0.0/10 -j RETURN  # Tailscale IP range

# Redirect all other TCP to redsocks  
iptables -t nat -A DARKPROXY -p tcp -j REDIRECT --to-ports 12345

# Apply chain to all output
iptables -t nat -I OUTPUT 1 -j DARKPROXY 2>/dev/null || true
iptables -t nat -I PREROUTING 1 -j DARKPROXY 2>/dev/null || true

echo "Starting redsocks..."
redsocks -c /etc/redsocks.conf

# Keep container alive
wait $TAILSCALED_PID