From 6f09d0a2f32976de86698f4f4f598e41fa9d48ee Mon Sep 17 00:00:00 2001
From: Benjamin Toby <devops@tben.me>
Date: Sun, 20 Sep 2026 19:41:55 +0100
Subject: [PATCH] Update installation script. Setup BunSQLite, configure
 firewall

---
 src/scripts/install-wg-ui.sh | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/src/scripts/install-wg-ui.sh b/src/scripts/install-wg-ui.sh
index 9f4052a..8ddcdda 100755
--- a/src/scripts/install-wg-ui.sh
+++ b/src/scripts/install-wg-ui.sh
@@ -140,6 +140,7 @@ install_dependencies() {
     log "installing app dependencies with bun ..."
     cd "$INSTALL_DIR"
     "$BUN_BIN" install
+    "$BUN_BIN" db:schema
 }
 
 ensure_env_file() {
@@ -244,6 +245,27 @@ grab_port() {
     grep -oE 'ServerPort: [0-9]+' "$INSTALL_DIR/src/data/site-data.ts" 2>/dev/null | grep -oE '[0-9]+' | head -1 || echo "10752"
 }
 
+configure_firewall() {
+    local port="$1"
+    log "configuring firewall to allow inbound traffic on port $port/tcp ..."
+    
+    # Check for firewalld (RHEL, CentOS, Fedora, Rocky, Alma)
+    if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld 2>/dev/null; then
+        log "firewalld is active. opening port $port/tcp ..."
+        firewall-cmd --permanent --add-port="${port}/tcp" >/dev/null 2>&1 || fail "failed to add port to firewalld"
+        firewall-cmd --reload >/dev/null 2>&1 || fail "failed to reload firewalld"
+        
+    # Check for ufw (Ubuntu, Debian, Mint)
+    elif command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
+        log "ufw is active. opening port $port/tcp ..."
+        ufw allow "${port}/tcp" >/dev/null 2>&1 || log "warning: failed to add port to ufw"
+        
+    # Fallback for Alpine or manual iptables
+    else
+        log "no active high-level firewall manager detected (firewalld/ufw). if you use iptables/nftables directly, ensure port $port/tcp is allowed."
+    fi
+}
+
 install_deps
 install_bun
 setup_lib_dirs
@@ -272,6 +294,11 @@ if [ "$DEV_MODE" = false ]; then
 fi
 
 PORT="$(grab_port)"
+
+if [ "$DEV_MODE" = false ]; then
+    configure_firewall "$PORT"
+fi
+
 log "wg-ui install complete."
 log "webapp:      $INSTALL_DIR"
 log "runtime:     $WGUI_LIB_DIR (host configs, keys, iptables, client configs)"