#!/usr/bin/env bash
# Docker-published ports bypass ufw. Flag any container port bound to a public address.
# Exit 1 if anything is exposed beyond loopback.
set -uo pipefail
bad=0
while IFS=$'\t' read -r name ports; do
  [ -z "$ports" ] && continue
  IFS=',' read -ra arr <<<"$ports"
  for p in "${arr[@]}"; do
    p="${p# }"
    [[ "$p" == *"->"* ]] || continue
    if [[ "$p" == 127.0.0.1:* || "$p" == "[::1]:"* ]]; then continue; fi
    echo "EXPOSED  $name  $p   (bypasses ufw — bind to 127.0.0.1 and proxy via Caddy)"; bad=1
  done
done < <(docker ps --format '{{.Names}}\t{{.Ports}}')
[ $bad -eq 0 ] && echo "OK: no container ports published beyond loopback"
exit $bad