#!/usr/bin/bash
set -euo pipefail
. data/vps.env
export DEBIAN_FRONTEND=noninteractive
apt-get install -y software-properties-common python3-launchpadlib gnupg2 linux-headers-$(uname -r)
add-apt-repository -y ppa:amnezia/ppa
apt-get install -y amneziawg amneziawg-tools iptables-persistent
cat <<EOF >> /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.all.forwarding = 1
net.ipv6.conf.all.forwarding = 1
EOF
for v in "" 6; do
    ip${v}tables -P FORWARD DROP
    ip${v}tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    ip${v}tables -A FORWARD -i awg0 -j ACCEPT
    ip${v}tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
done
for route in tcp:25 tcp:80 tcp:443 udp:443; do
    PROTO=${route%:*}
    PORT=${route#*:}
    iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -p $PROTO --dport $PORT -j DNAT --to-destination $DEST:$PORT
    iptables -A FORWARD -d $DEST -p $PROTO --dport $PORT -j ACCEPT
    ip6tables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -p $PROTO --dport $PORT -j DNAT --to-destination [$DEST6]:$PORT
    ip6tables -A FORWARD -d $DEST6 -p $PROTO --dport $PORT -j ACCEPT
done
netfilter-persistent save
mv data/awg0.conf /etc/amnezia/amneziawg
systemctl enable awg-quick@awg0
apt-get autoremove --purge -y
apt-get clean
echo Installed in $(($(date +%s)-$(cat start)))s
rm -r *
reboot
exit