#!/bin/sh
# Haven — protect this Mac. Run with sudo.
# 1. Sets family-safe DNS on every network service
# 2. Locks SafeSearch and YouTube Restricted Mode on in every browser
networksetup -listallnetworkservices | tail -n +2 | while IFS= read -r service; do
  case "$service" in \**) continue ;; esac
  echo "Protecting: $service"
  networksetup -setdnsservers "$service" 1.1.1.3 1.0.0.3 2606:4700:4700::1113 2606:4700:4700::1003
done

# --- Lock search and video safety on -------------------------------------
# Addresses are resolved now rather than hard-coded, so a provider renumbering
# cannot leave a stale pin quietly protecting nothing.
HOSTS=/etc/hosts
TMP=$(mktemp)
sed '/# BEGIN HAVEN SAFE SEARCH/,/# END HAVEN SAFE SEARCH/d' "$HOSTS" > "$TMP"
echo '# BEGIN HAVEN SAFE SEARCH' >> "$TMP"
echo 'forcesafesearch.google.com www.google.com google.com www.google.co.uk www.google.ca www.google.com.au
restrict.youtube.com www.youtube.com m.youtube.com youtube.com youtubei.googleapis.com youtube.googleapis.com
strict.bing.com www.bing.com bing.com
safe.duckduckgo.com duckduckgo.com www.duckduckgo.com' | while read -r target names; do
  [ -z "$target" ] && continue
  ip=$(dscacheutil -q host -a name "$target" 2>/dev/null | awk '/^ip_address:/ { print $2; exit }')
  [ -z "$ip" ] && ip=$(dig +short "$target" A 2>/dev/null | head -n 1)
  if [ -n "$ip" ]; then
    echo "Locking safety on: $target"
    for name in $names; do printf '%s\t%s\n' "$ip" "$name" >> "$TMP"; done
  else
    echo "Skipped $target — could not look it up"
  fi
done
echo '# END HAVEN SAFE SEARCH' >> "$TMP"
cat "$TMP" > "$HOSTS"
rm -f "$TMP"
dscacheutil -flushcache 2>/dev/null
killall -HUP mDNSResponder 2>/dev/null

echo ''
echo 'Done. Return to the Haven setup page and run the verification check.'