[Duplicate Code] getDockerBridgeGateway() + gatewayIps construction duplicated in setupHostIptables

[github-actions]

Duplicate Code Opportunity

Summary

• Pattern: Async gateway IP resolution + gatewayIps array construction
• Locations: src/host-iptables-rules.ts lines 242–245 and 261–264 (two occurrences in the same function)
• Impact: Eliminates a redundant async Docker API call; removes 4 duplicate lines; makes both consumers consistent

Evidence

Inside setupHostIptables(), two separate if blocks both call getDockerBridgeGateway() independently and build an identical gatewayIps array:

// Block 1 – inside `if (cliProxyConfig)` (lines 242–245)
const gatewayIp = await getDockerBridgeGateway();
const gatewayIps = [AWF_NETWORK_GATEWAY];
if (gatewayIp) {
  gatewayIps.push(gatewayIp);
}

// Block 2 – inside `if (hostAccess?.enabled)` (lines 261–264) – byte-for-byte identical
const gatewayIp = await getDockerBridgeGateway();
const gatewayIps = [AWF_NETWORK_GATEWAY];
if (gatewayIp) {
  gatewayIps.push(gatewayIp);
}

When both cliProxyConfig and hostAccess.enabled are active, getDockerBridgeGateway() makes two separate docker network inspect bridge calls that return the same value.

Suggested Refactoring

Hoist the gateway resolution before both if blocks, computing it once:

// Resolve gateway IPs once — used by both cliProxyConfig and hostAccess blocks
const needsGatewayIps = !!cliProxyConfig || !!hostAccess?.enabled;
const resolvedGatewayIp = needsGatewayIps ? await getDockerBridgeGateway() : null;
const gatewayIps = [AWF_NETWORK_GATEWAY, ...(resolvedGatewayIp ? [resolvedGatewayIp] : [])];

if (cliProxyConfig) {
  // use gatewayIps directly
}

if (hostAccess?.enabled) {
  // use gatewayIps directly
}

Affected Files

• src/host-iptables-rules.ts — lines 237–265 (the two if preambles)

Effort Estimate

Low

---

Detected by Duplicate Code Detector workflow. Run date: 2026-05-25

Generated by Duplicate Code Detector · sonnet46 3.6M · ◷

• expires on Jun 24, 2026, 10:05 PM UTC