#!/usr/bin/env bash
# One-shot OpenSnitch optimization apply. Runs as root via systemd-run escape.
set -euo pipefail
RULES=/etc/opensnitchd/rules
ts=$(date +%Y%m%d-%H%M%S)
cp -a "$RULES" "/etc/opensnitchd/rules.bak-$ts"
echo "backup: /etc/opensnitchd/rules.bak-$ts"
TS=$(date -u +%Y-%m-%dT%H:%M:%S.000000000Z)
node /home/user/opensnitch-staging/apply-optim.js "$TS"
own=$(stat -c '%U:%G' "$RULES")
chown "$own" "$RULES"/0*.json "$RULES"/9*.json 2>/dev/null || true
chmod 0600 "$RULES"/0*.json "$RULES"/9*.json
echo "== final ruleset =="
ls -1 "$RULES"/*.json