# Router firewall/NAT policy (nftables). Trust model:
#   mgmt VLAN  -> trusted: router services, all VLANs, WAN
#   other VLANs -> DNS/DHCP on the router + WAN (if allowWan); no inter-VLAN
#   WAN (ppp0) -> nothing inbound beyond established/related
#   mesh       -> admin SSH + metrics scrapes (same trust boundary as the fleet)
#   staging    -> admin SSH only (pre-cutover uplink into the old LAN)
{ settings }:
{ lib, ... }:
let
  cfg = settings;

  vlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") cfg.vlans;
  wanVlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") (
    lib.filterAttrs (_: vlan: vlan.allowWan) cfg.vlans
  );
  nonMgmtIfs = lib.filter (i: i != "vlan-mgmt") vlanIfs;
in
{
  networking.nftables.enable = true;

  # SSH reachable only from the mgmt VLAN (trusted) and the mesh — never
  # from the WAN or the other VLANs.
  services.openssh.openFirewall = false;

  networking.firewall = {
    enable = true;
    filterForward = true;
    trustedInterfaces = [ "vlan-mgmt" ];

    # Non-mgmt VLANs may only talk to the router's DNS and DHCP; the staging
    # uplink (old LAN, pre-cutover) gets admin SSH so the box can be reached
    # before the mgmt VLAN or the mesh are up.
    interfaces =
      lib.genAttrs nonMgmtIfs (_: {
        allowedTCPPorts = [ 53 ];
        allowedUDPPorts = [
          53
          67
        ];
      })
      // lib.optionalAttrs (cfg.stagingPort != null) {
        ${cfg.stagingPort}.allowedTCPPorts = [ 22 ];
      };

    extraInputRules = ''
      ip6 saddr ${cfg.mesh.subnet} tcp dport 22 accept comment "admin ssh over the mesh"
      ip6 saddr ${cfg.mesh.subnet} tcp dport 4000 accept comment "blocky metrics scrape from control"
    '';

    extraForwardRules = ''
      tcp flags syn tcp option maxseg size set rt mtu comment "MSS clamp for PPPoE mtu 1492"
      iifname "vlan-mgmt" accept comment "mgmt reaches all VLANs and the WAN"
    '';
  };

  # networking.nat both masquerades and opens forward-to-WAN for exactly its
  # internalInterfaces — so this list, not a rule of our own, is where
  # `allowWan` is enforced. Listing every VLAN here would silently let
  # allowWan = false VLANs out.
  networking.nat = {
    enable = true;
    externalInterface = "ppp0";
    internalInterfaces = wanVlanIfs;
  };
}