-- Global-compiled long-tail sections: blrules (blacklist/whitelist, processed
-- before normal rules) and conntrack (connection-tracking control). The policies
-- table already exists (migration 0001); this migration only adds the two new
-- tables — policy CRUD is wired on the existing table.

CREATE TABLE blrules (
    id      BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
    priority INT NOT NULL DEFAULT 0,
    action  TEXT NOT NULL,
    source  TEXT NOT NULL DEFAULT '',
    dest    TEXT NOT NULL DEFAULT '',
    proto   TEXT NOT NULL DEFAULT '',
    dport   JSONB NOT NULL DEFAULT '[]'::jsonb,
    sport   JSONB NOT NULL DEFAULT '[]'::jsonb,
    log     TEXT NOT NULL DEFAULT '',
    comment TEXT NOT NULL DEFAULT ''
);

CREATE TABLE conntrack (
    id      BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
    priority INT NOT NULL DEFAULT 0,
    action  TEXT NOT NULL,
    source  TEXT NOT NULL DEFAULT '',
    dest    TEXT NOT NULL DEFAULT '',
    proto   TEXT NOT NULL DEFAULT '',
    dport   JSONB NOT NULL DEFAULT '[]'::jsonb,
    sport   JSONB NOT NULL DEFAULT '[]'::jsonb,
    chain   TEXT NOT NULL DEFAULT '',
    helper  TEXT NOT NULL DEFAULT '',
    "user"  TEXT NOT NULL DEFAULT '',
    comment TEXT NOT NULL DEFAULT ''
);