package model

import "time"

// FirewallRule is a single user-defined nftables rule scoped to one server.
// Rules are combined with the server's baseline (listen-port accept +
// WireGuard-interface forwarding) to build the full ruleset that gets
// applied via `nft -f`.
type FirewallRule struct {
	ID        string    `json:"id"`
	ServerID  string    `json:"server_id"`
	Direction string    `json:"direction"` // "input" or "forward"
	Protocol  string    `json:"protocol"`  // "tcp", "udp", or "" (any)
	Port      string    `json:"port"`      // e.g. "8080" or "8000-9000", "" = any
	Source    string    `json:"source"`    // optional CIDR, "" = any
	Action    string    `json:"action"`    // "accept", "drop", or "reject"
	Comment   string    `json:"comment"`
	Enabled   bool      `json:"enabled"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}