#!/usr/bin/env bash
# One-time root setup for the C2 feed blocklist: create user-writable feeds dir + install the deny rule.
set -euo pipefail
DIR=/var/lib/opensnitch-c2-feeds
RULES=/etc/opensnitchd/rules
install -d -m 755 "$DIR"
chown user:user "$DIR"
TS=$(date -u +%Y-%m-%dT%H:%M:%S.000000000Z)
node -e 'const fs=require("fs");const r=JSON.parse(fs.readFileSync("/home/user/opensnitch-staging/950-block-c2.json","utf8"));r.created=r.updated=process.argv[1];fs.writeFileSync("/etc/opensnitchd/rules/950-block-c2.json",JSON.stringify(r,null,2));' "$TS"
own=$(stat -c '%U:%G' "$RULES")
chown "$own" "$RULES/950-block-c2.json"; chmod 600 "$RULES/950-block-c2.json"
echo "created $DIR (user-writable) + rule 950-block-c2"
ls -ld "$DIR"; ls -l "$RULES/950-block-c2.json"