#!/bin/sh
set -eu
here=$(cd "$(dirname "$0")/.." && pwd)
. "$here/bin/env.sh"

run=$TNGL_STATE/run
mkdir -p "$run/empty"
pidf=$run/ns.pid
rm -f "$pidf"

# slirp4netns serves dns at 10.0.2.3, so that is the upstream
command -v slirp4netns >/dev/null 2>&1 && export TNGL_DNS_UPSTREAM=10.0.2.3

uid=$(id -u)
gid=$(id -g)
sub=$(awk -F: -v u="$(id -un)" '$1 == u { print $2; exit }' /etc/subgid)

# postgres refuses root, so the uid maps to itself, and the offline gid goes to a subgid so files stay yours
unshare --user --keep-caps --map-users="$uid:$uid:1" \
	--map-groups="$gid:$gid:1" --map-groups="$TNGL_OFFLINE_GID:$sub:1" \
	--net --mount sh "$TNGL_PC/bin/ns-inner" "$pidf" "$@" &
ns=$!

jobs_to_kill="$ns"
cleanup() {
	# shellcheck disable=SC2086
	kill $jobs_to_kill 2>/dev/null || true
}
trap cleanup EXIT INT TERM

while [ ! -s "$pidf" ]; do
	kill -0 "$ns" 2>/dev/null || exit 1
	sleep 0.1
done

if command -v slirp4netns >/dev/null 2>&1; then
	slirp4netns --configure --mtu=65520 --disable-host-loopback "$ns" tap0 >"$run/slirp.log" 2>&1 &
	jobs_to_kill="$jobs_to_kill $!"
fi

for m in $(echo "${TNGL_FORWARD:-}" | tr , ' '); do
	host=${m%%:*}
	inner=${m##*:}
	socat "TCP-LISTEN:$host,bind=127.0.0.1,fork,reuseaddr" \
		EXEC:"nsenter --user --preserve-credentials --net -t $ns socat STDIO TCP\\:127.0.0.1\\:$inner" &
	jobs_to_kill="$jobs_to_kill $!"
done

status=0
wait "$ns" || status=$?
exit "$status"