#!/usr/bin/env bash
# Docker 在部分环境里只写了 nft 规则，内核仍走 iptables-legacy 且 FORWARD 为 DROP，
# 容器之间会连不上 MySQL。本脚本给 Ragflow 网桥补上转发放行。
set -euo pipefail
bridge=$(ip -br link | awk '/^br-/ && $2 ~ /UP/ {print $1; exit}')
if [[ -z "${bridge}" ]]; then
  echo "no up bridge" >&2
  exit 1
fi
sudo iptables-legacy -C FORWARD -i "$bridge" -j ACCEPT 2>/dev/null || sudo iptables-legacy -I FORWARD 1 -i "$bridge" -j ACCEPT
sudo iptables-legacy -C FORWARD -o "$bridge" -j ACCEPT 2>/dev/null || sudo iptables-legacy -I FORWARD 1 -o "$bridge" -j ACCEPT
echo "forward allowed on ${bridge}"