turn on firewalld

utils.sh

@@ -73,3 +73,66 @@ install_script() {
   local tmp
   tmp="$(mktemp "$2.XXXXXX")" && cp "$1" "$tmp" && chmod 755 "$tmp" && mv -f "$tmp" "$2"
 }
+
+# Start Cockpit. Safe to re-run: does nothing once set up. The cockpit package
+# itself comes from packages.conf; its firewall port is in firewall.conf.
+setup_cockpit() {
+  if ! systemctl is-enabled --quiet cockpit.socket || ! systemctl is-active --quiet cockpit.socket; then
+    echo "Enabling Cockpit..."
+    sudo systemctl enable --now cockpit.socket
+  fi
+}
+
+# Allow the services and ports in firewall.conf through firewalld's default
+# zone, then make sure firewalld is running. Only adds rules, never removes
+# them, so rules added by hand or by sibling projects stay. Safe to re-run.
+setup_firewall() {
+  command -v firewall-offline-cmd &> /dev/null || return 0
+  source "$HOME/.local/share/MiniServer/firewall.conf"
+
+  # firewall-cmd only works while firewalld is running; before that, write the
+  # permanent config directly so SSH is allowed before the firewall comes up
+  local fw running=0 changed=0 svc port
+  if systemctl is-active --quiet firewalld; then
+    running=1
+    fw=(sudo firewall-cmd --permanent)
+  else
+    fw=(sudo firewall-offline-cmd)
+  fi
+
+  # Keep SSH reachable if sshd listens on a port other than 22
+  local ports=("${FIREWALL_PORTS[@]}")
+  if command -v sshd &> /dev/null; then
+    for port in $(sudo sshd -T 2> /dev/null | awk '$1 == "port" && $2 != 22 { print $2 }'); do
+      ports+=("$port/tcp")
+    done
+  fi
+
+  for svc in "${FIREWALL_SERVICES[@]}"; do
+    if ! "${fw[@]}" --query-service="$svc" &> /dev/null; then
+      echo "Firewall: allowing $svc"
+      "${fw[@]}" --add-service="$svc"
+      changed=1
+    fi
+  done
+  for port in "${ports[@]}"; do
+    if ! "${fw[@]}" --query-port="$port" &> /dev/null; then
+      echo "Firewall: allowing $port"
+      "${fw[@]}" --add-port="$port"
+      changed=1
+    fi
+  done
+
+  if (( running )); then
+    if (( changed )); then
+      sudo firewall-cmd --reload
+    fi
+  else
+    echo "Starting firewalld..."
+    sudo systemctl enable --now firewalld
+    # Docker sets up its firewalld zone only when it starts
+    if systemctl is-active --quiet docker; then
+      echo "Docker started before firewalld. Restart it (sudo systemctl restart docker) or reboot so its containers' ports work through the firewall."
+    fi
+  fi
+}