---
# Part of role: pia-gateway
# Included by: tasks/main.yaml
# Description: The one thing this file does now: permit VLAN 50 clients
#   to reach the local Technitium listener on minisforum. Everything
#   else the kill switch needs (the dedicated FORWARD-chain scoping, the
#   routing-table unreachable fallback) lives in tasks/routing.yaml /
#   templates/pia-killswitch.sh.j2 — see those for the actual fail-closed
#   layers.
#
# Two corrections from an earlier version of this file, both from code
# review against the live topology rather than assumption:
#
# 1. Technitium (10.10.40.53) IS minisforum's own address — traffic from
#    a VLAN 50 client to it terminates LOCALLY on minisforum. That's
#    INPUT traffic, not FORWARD/routed traffic, so it needs a normal UFW
#    input allow, not `route: true` (which adds a FORWARD-chain rule for
#    traffic passing *through* the host to some other destination — the
#    wrong chain for a locally-terminated flow, and it would never
#    actually have matched real Technitium queries).
#
# 2. This file used to also force UFW's DEFAULT_FORWARD_POLICY to DROP,
#    intended as a second kill-switch layer. That was never actually
#    proven safe: minisforum is the k3s server and runs Flannel, which
#    depends on the FORWARD chain for pod-to-pod and pod-to-internet
#    traffic (source 10.42.0.0/16) — changing the chain-wide default
#    policy risked breaking that, for a benefit (fail-closed for VLAN 50
#    specifically) that's already fully covered by the dedicated
#    {{ pia_iptables_chain }} chain in pia-killswitch.sh.j2, which is
#    scoped to source {{ pia_vlan50_subnet }} only and can structurally
#    never see Flannel's traffic (disjoint source CIDR). Removed rather
#    than shipped unproven.
#
# Inspection commands (read-only):
#   sudo iptables -S FORWARD | head -3          # confirm the single
#                                                # jump to {{ pia_iptables_chain }}
#                                                # at position 1, and that
#                                                # the chain-wide policy
#                                                # is still whatever it
#                                                # was before this role
#                                                # (ACCEPT, typically)
#   sudo iptables -S {{ pia_iptables_chain }}    # the kill-switch chain
#                                                # itself: ACCEPT pair
#                                                # when pia-wg is up,
#                                                # LOG+DROP catch-all
#                                                # always present
#   sudo ufw status verbose | grep 53            # the Technitium INPUT
#                                                # allow, both protocols
#
# Rollback (this file's part only — see routing.yaml/README.md for the
# rest of the role's rollback):
#   sudo ufw delete allow from 10.10.50.0/24 to 10.10.40.53 port 53 proto tcp
#   sudo ufw delete allow from 10.10.50.0/24 to 10.10.40.53 port 53 proto udp

- name: Allow VLAN 50 clients to reach Technitium DNS (local INPUT traffic)
  community.general.ufw:
    rule: allow
    direction: in
    src: "{{ pia_vlan50_subnet }}"
    dest: "{{ k3s_dns_resolver }}"
    port: "53"
    proto: "{{ item }}"
    comment: VLAN 50 clients to Technitium (local, not routed)
  loop:
    - tcp
    - udp