#!/bin/sh
# Consurgam Schutz fuer Linux / Consurgam protection for Linux (version 1)
# Source: consurgam.com/schutz  -  Sends nothing to Consurgam, downloads nothing.
#
# What it does (run as root: sudo sh consurgam-linux.sh, or su -c 'sh consurgam-linux.sh'):
#   1. systemd-resolved: DNS over TLS with Cloudflare for Families (blocks adult and malware sites) for ALL
#      domains (Domains=~.), no fallback servers. Drop-in /etc/systemd/resolved.conf.d/consurgam.conf
#   2. Browser policies: no private windows/incognito/guest mode, secure DNS fixed to Cloudflare for Families,
#      SafeSearch. Chrome, Chromium, Edge, Brave: own file consurgam.json in .../policies/managed/.
#      Firefox: /etc/firefox/policies/policies.json (merged with existing policies if python3 is present).
#   3. Checks the result: a Cloudflare test domain must resolve to 0.0.0.0.
# Safe to run again. To undo: consurgam-linux-entfernen.sh
# The key: whoever has root (sudo) can undo this. Your own account should not be in the sudo/wheel group;
# your anchor keeps the root or admin password.
set -eu

DOH='https://family.cloudflare-dns.com/dns-query'
TEST='nudity.testcategory.com'   # Cloudflare test domain in the adult category, harmless

if [ "$(id -u)" -ne 0 ]; then
  echo "Bitte als root starten (sudo sh $0) / Please run as root (sudo sh $0)." >&2
  exit 1
fi

# --- 1. systemd-resolved ---
if ! command -v resolvectl >/dev/null 2>&1 || ! systemctl is-active --quiet systemd-resolved; then
  echo "systemd-resolved laeuft nicht. Ohne ihn richtet dieses Skript den DNS-Filter nicht ein." >&2
  echo "systemd-resolved is not running. This script needs it for the DNS filter." >&2
  echo "Alternative: DNS-Server 1.1.1.3 und 1.0.0.3 im Router oder im Netzwerk-Manager eintragen." >&2
  exit 2
fi
mkdir -p /etc/systemd/resolved.conf.d
cat > /etc/systemd/resolved.conf.d/consurgam.conf <<'EOF'
# Consurgam: Cloudflare for Families over DNS-over-TLS for all domains. Remove with consurgam-linux-entfernen.sh
[Resolve]
DNS=1.1.1.3#family.cloudflare-dns.com 1.0.0.3#family.cloudflare-dns.com 2606:4700:4700::1113#family.cloudflare-dns.com 2606:4700:4700::1003#family.cloudflare-dns.com
DNSOverTLS=yes
Domains=~.
FallbackDNS=
EOF
systemctl restart systemd-resolved
resolvectl flush-caches 2>/dev/null || true
echo "[1/3] systemd-resolved: DNS ueber TLS zu Cloudflare for Families / DNS over TLS to Cloudflare for Families"
case "$(readlink -f /etc/resolv.conf 2>/dev/null || true)" in
  */systemd/resolve/stub-resolv.conf|*/systemd/resolve/resolv.conf) ;;
  *) echo "      Achtung: /etc/resolv.conf zeigt nicht auf systemd-resolved. Netzwerk-Manager auf systemd-resolved umstellen." >&2
     echo "      Warning: /etc/resolv.conf does not point to systemd-resolved. Switch your network manager to systemd-resolved." >&2 ;;
esac

# --- 2. Browser policies ---
CHROMIUM_JSON='{
  "IncognitoModeAvailability": 1,
  "BrowserGuestModeEnabled": false,
  "SafeSitesFilterBehavior": 1,
  "ForceGoogleSafeSearch": true,
  "DnsOverHttpsMode": "secure",
  "DnsOverHttpsTemplates": "'"$DOH"'"
}'
EDGE_JSON='{
  "InPrivateModeAvailability": 1,
  "BrowserGuestModeEnabled": false,
  "ForceGoogleSafeSearch": true,
  "ForceBingSafeSearch": 2,
  "DnsOverHttpsMode": "secure",
  "DnsOverHttpsTemplates": "'"$DOH"'"
}'
for d in /etc/opt/chrome/policies/managed /etc/chromium/policies/managed /etc/chromium-browser/policies/managed /etc/brave/policies/managed; do
  mkdir -p "$d" && printf '%s\n' "$CHROMIUM_JSON" > "$d/consurgam.json"
done
mkdir -p /etc/opt/edge/policies/managed && printf '%s\n' "$EDGE_JSON" > /etc/opt/edge/policies/managed/consurgam.json

FF=/etc/firefox/policies/policies.json
mkdir -p /etc/firefox/policies
if [ -s "$FF" ] && [ ! -f /etc/firefox/policies/.consurgam ]; then
  if command -v python3 >/dev/null 2>&1; then
    python3 - "$FF" "$DOH" <<'EOF'
import json, sys
p, doh = sys.argv[1], sys.argv[2]
d = json.load(open(p))
pol = d.setdefault("policies", {})
pol.update({"DisablePrivateBrowsing": True, "PrivateBrowsingModeAvailability": 1,
            "DNSOverHTTPS": {"Enabled": True, "ProviderURL": doh, "Locked": True, "Fallback": False}})
json.dump(d, open(p, "w"), indent=2)
EOF
    echo "      Firefox: bestehende Richtlinien ergaenzt / existing policies extended"
  else
    echo "      Firefox: $FF existiert schon und python3 fehlt. Bitte von Hand ergaenzen. / exists, python3 missing: please merge by hand." >&2
  fi
else
  cat > "$FF" <<EOF
{
  "policies": {
    "DisablePrivateBrowsing": true,
    "PrivateBrowsingModeAvailability": 1,
    "DNSOverHTTPS": { "Enabled": true, "ProviderURL": "$DOH", "Locked": true, "Fallback": false }
  }
}
EOF
  : > /etc/firefox/policies/.consurgam   # marks the file as ours, so the removal script may delete it
fi
echo "[2/3] Richtlinien fuer Chrome, Chromium, Edge, Brave, Firefox gesetzt (Browser neu starten) / browser policies set (restart browsers)"

# --- 3. Check ---
ERG=$(resolvectl query --legend=no -t A "$TEST" 2>/dev/null | head -1 || true)
case "$ERG" in
  *0.0.0.0*) echo "[3/3] OK: $TEST -> 0.0.0.0. Der Filter wirkt. / The filter works." ;;
  *) echo "[3/3] Achtung: $TEST -> ${ERG:-keine Antwort}. Erwartet 0.0.0.0. VPN aktiv? / Check failed, expected 0.0.0.0." >&2 ;;
esac
echo "Jetzt: dein eigenes Konto ohne sudo, das Root- oder Admin-Passwort behaelt dein Anker."
echo "Next: your own account without sudo; your anchor keeps the root or admin password."