use crate::{config::Config, docker};

pub fn apply_firewall(cfg: &Config) -> anyhow::Result<()> {
    let target = docker::discover_target(cfg)?;

    if !cfg.anti_torrent.enabled {
        let _ = docker::run_capture(&[
            "docker",
            "exec",
            &target.container_name,
            "sh",
            "-c",
            "nft delete table inet awg2_harness 2>/dev/null || true",
        ])?;
        return Ok(());
    }

    let rule = format!(
        "nft 'add table inet awg2_harness' 2>/dev/null || true; \
         nft 'add chain inet awg2_harness forward_antitorrent {{ type filter hook forward priority filter; policy accept; }}' 2>/dev/null || true; \
         nft 'flush chain inet awg2_harness forward_antitorrent'; \
         nft 'add rule inet awg2_harness forward_antitorrent ip saddr {cidr} ct state new meter awg2_peer_connlimit_v4 {{ ip saddr ct count over {max} }} counter name antitorrent_dropped_v4 drop'",
        cidr = cfg.anti_torrent.peer_ipv4_cidr,
        max = cfg.anti_torrent.max_connections_per_peer
    );
    let _ = docker::run_capture(&["docker", "exec", &target.container_name, "sh", "-c", &rule])?;
    Ok(())
}