#!/bin/ash
set -eu

echo "STEP_032B apply firewall vpn_out integration"

IDX="$(uci show firewall | sed -n "s/^firewall\.@zone\[\([0-9][0-9]*\)\]\.name='vpn_out'/\1/p" | head -n1)"
[ -n "$IDX" ] || { echo "ERROR: vpn_out zone not found"; exit 1; }

BACK="/root/router-ops-backups/firewall-before-step032b-$(date +%Y%m%d-%H%M%S)"
mkdir -p /root/router-ops-backups
cp /etc/config/firewall "$BACK"
chmod 600 "$BACK"
echo "backup=$BACK"

echo "vpn_out before:"
uci show firewall.@zone[$IDX]

for n in vpn3 vpn4 vpn5; do
  if uci -q get firewall.@zone[$IDX].network | grep -qw "$n"; then
    echo "$n already present"
  else
    uci add_list firewall.@zone[$IDX].network="$n"
    echo "added $n"
  fi
done

uci commit firewall
/etc/init.d/firewall reload

echo "vpn_out after:"
uci show firewall.@zone[$IDX]