-- Baseline data that makes a fresh install immediately useful without
-- creating an open resolver: a private-network ACL, an empty malware
-- blacklist, and a default policy bound to RFC1918 / ULA space.

INSERT INTO domain_lists (kind, name, description) VALUES
    ('blacklist', 'Malware',                 'Known malware and command-and-control domains.'),
    ('blacklist', 'Advertising',             'Advertising and tracking domains.'),
    ('blacklist', 'Adult Content',           'Adult content domains.'),
    ('blacklist', 'Gambling',                'Gambling and betting domains.'),
    ('blacklist', 'Guest Network Custom Blocks', 'Locally maintained blocks for guest networks.'),
    ('allowlist', 'Global Allowlist',        'Domains that must never be blocked.');

INSERT INTO policies (name, description, block_action) VALUES
    ('Default Protection', 'Malware blocking applied to local networks.', 'nxdomain');

INSERT INTO policy_lists (policy_id, list_id)
SELECT p.id, l.id
FROM policies p, domain_lists l
WHERE p.name = 'Default Protection'
  AND l.name IN ('Malware', 'Global Allowlist');

INSERT INTO networks (name, cidr, description) VALUES
    ('Private IPv4 10.0.0.0/8',     '10.0.0.0/8',     'RFC1918 private address space.'),
    ('Private IPv4 172.16.0.0/12',  '172.16.0.0/12',  'RFC1918 private address space.'),
    ('Private IPv4 192.168.0.0/16', '192.168.0.0/16', 'RFC1918 private address space.'),
    ('Loopback IPv4',               '127.0.0.0/8',    'Local host.'),
    ('Loopback IPv6',               '::1/128',        'Local host.'),
    ('Unique Local IPv6',           'fc00::/7',       'RFC4193 unique local addresses.');

INSERT INTO network_policies (network_id, policy_id)
SELECT n.id, p.id FROM networks n, policies p WHERE p.name = 'Default Protection';
