#!/bin/bash
# wg-forward-setup.sh — expose sur l'IP WireGuard du Mac des services qui n'écoutent que sur 127.0.0.1
# (ex. spbgit :7420, api-ka :8000) sans toucher aux apps : un relais socat par port, en LaunchDaemon.
# Usage : bash wg-forward-setup.sh <ip-wg> <mot-de-passe-sudo> <port> [<port>…]
set -euo pipefail
WGIP=${1:?ip wg}; PW=${2:?sudo}; shift 2; PORTS=("$@"); [ ${#PORTS[@]} -gt 0 ] || { echo "ports ?"; exit 1; }
sudo_(){ echo "$PW" | sudo -S -p '' "$@"; }
export PATH=/opt/homebrew/bin:/opt/homebrew/sbin:$PATH
[ -x /opt/homebrew/bin/socat ] || HOMEBREW_NO_AUTO_UPDATE=1 brew install -q socat >/dev/null 2>&1 || HOMEBREW_NO_AUTO_UPDATE=1 brew install socat
CONF=/opt/homebrew/etc/maclustr-wgfwd.conf
T=$(mktemp); { [ -f "$CONF" ] && cat "$CONF"; for p in "${PORTS[@]}"; do echo "$WGIP $p"; done; } | sort -u > "$T"
sudo_ install -m 644 -o root "$T" "$CONF"; rm -f "$T"
TMPP=$(mktemp)
cat > "$TMPP" <<'PLIST'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
  <key>Label</key><string>io.maclustr.wgfwd</string>
  <key>ProgramArguments</key><array>
    <string>/bin/bash</string><string>-c</string>
    <string>export PATH=/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin; pids=""; while read -r ip port; do [ -z "$ip" ] && continue; ( while true; do /opt/homebrew/bin/socat -T 3600 TCP-LISTEN:$port,bind=$ip,fork,reuseaddr TCP:127.0.0.1:$port 2>>/var/log/maclustr-wgfwd.log; sleep 5; done ) &amp; pids="$pids $!"; done &lt; /opt/homebrew/etc/maclustr-wgfwd.conf; wait</string>
  </array>
  <key>RunAtLoad</key><true/>
  <key>KeepAlive</key><true/>
  <key>StandardErrorPath</key><string>/var/log/maclustr-wgfwd.log</string>
</dict></plist>
PLIST
sudo_ install -m 644 -o root -g wheel "$TMPP" /Library/LaunchDaemons/io.maclustr.wgfwd.plist; rm -f "$TMPP"
sudo_ launchctl bootout system/io.maclustr.wgfwd >/dev/null 2>&1 || true
sleep 2
ok=0; for i in 1 2 3 4 5 6; do sudo_ launchctl bootstrap system /Library/LaunchDaemons/io.maclustr.wgfwd.plist 2>/tmp/wgfwd.err && { ok=1; break; }; grep -q -i already /tmp/wgfwd.err && { ok=1; break; }; sleep 3; done
[ $ok = 1 ] || { cat /tmp/wgfwd.err; exit 1; }
sleep 2
for p in "${PORTS[@]}"; do if sudo_ lsof -nP -iTCP@$WGIP:$p -sTCP:LISTEN >/dev/null 2>&1; then echo "relais $WGIP:$p → 127.0.0.1:$p OK"; else echo "relais $WGIP:$p KO"; fi; done