#!/bin/sh
# SOS 0.18 — petit profil de protection Linux (DNS chiffre + pare-feu existant)
set -eu
if [ "$(id -u)" -ne 0 ]; then
  echo "Lancez ce petit fichier avec les droits administrateur : sudo sh $0"
  exit 1
fi
mkdir -p /var/lib/sos
if command -v resolvectl >/dev/null 2>&1 && command -v systemctl >/dev/null 2>&1; then
  mkdir -p /etc/systemd/resolved.conf.d
  [ -f /etc/systemd/resolved.conf.d/90-sos-protection.conf ] && cp /etc/systemd/resolved.conf.d/90-sos-protection.conf /var/lib/sos/90-sos-protection.conf.bak || true
  cat >/etc/systemd/resolved.conf.d/90-sos-protection.conf <<'EOC'
[Resolve]
DNS=9.9.9.9 149.112.112.112
FallbackDNS=2620:fe::fe 2620:fe::9
DNSOverTLS=yes
EOC
  systemctl restart systemd-resolved
fi
if command -v ufw >/dev/null 2>&1; then ufw --force enable >/dev/null 2>&1 || true; fi
if command -v firewall-cmd >/dev/null 2>&1 && command -v systemctl >/dev/null 2>&1; then systemctl enable --now firewalld >/dev/null 2>&1 || true; fi
echo "SOS : protection reseau configuree avec les fonctions disponibles sur ce systeme."
if command -v xdg-open >/dev/null 2>&1; then xdg-open 'https://www.suiteofsecurity.com/?sos_profile=linux' >/dev/null 2>&1 || true; fi