fix(archsetup): add firewall validation with critical warning

- Verify ufw is active after setup completes
- Display critical security warning in outro if firewall not active
- Include manual fix commands in warning message

1 files changed, 21 insertions, 0 deletions

diff --git a/archsetup b/archsetup
index 177afcc..8cb5db6 100755
--- a/archsetup
+++ b/archsetup
@@ -105,6 +105,7 @@ archsetup_packages="/var/log/archsetup-installed-packages.txt"
 min_disk_space_gb=20
 state_dir="/var/lib/archsetup/state"
 error_messages=()
+firewall_verified=false
 
 ### Cleanup Trap
 # Ensures tmpfs is unmounted if script exits unexpectedly
@@ -847,6 +848,14 @@ EOF
     action="starting firewall service" && display "task" "$action"
     systemctl start ufw.service >> "$logfile" 2>&1 || error "error" "$action" "$?"
 
+    # Verify firewall is actually active
+    action="verifying firewall is active" && display "task" "$action"
+    if ufw status | grep -q "Status: active"; then
+        firewall_verified=true
+    else
+        error "error" "firewall verification failed - ufw is not active" "1"
+    fi
+
     # Service Discovery
 
     display "subtitle" "Network Service Discovery"
@@ -1697,6 +1706,18 @@ outro() {
         done
     fi
 
+    # Critical security warning if firewall setup failed
+    if [ "$firewall_verified" != "true" ]; then
+        printf "\n" | tee -a "$logfile"
+        printf "!!! CRITICAL SECURITY WARNING !!!\n" | tee -a "$logfile"
+        printf "!!! FIREWALL IS NOT ACTIVE !!!\n" | tee -a "$logfile"
+        printf "Your system may be unprotected. Please run these commands manually:\n" | tee -a "$logfile"
+        printf "  sudo ufw default deny incoming\n" | tee -a "$logfile"
+        printf "  sudo ufw enable\n" | tee -a "$logfile"
+        printf "  sudo ufw status\n" | tee -a "$logfile"
+        printf "\n" | tee -a "$logfile"
+    fi
+
     printf "\n"
     printf "Please reboot before working with your new workstation.\n\n"