#!/usr/bin/env bash
# VPS 一键部署：sing-box (Reality + Hysteria2) + Nginx fallback
# 适用：Ubuntu 22.04/24.04、Debian 12
# 用法：sudo bash scripts/install.sh
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOT_DIR="$(dirname "$SCRIPT_DIR")"
ENV_FILE="${ROOT_DIR}/.env"

RED='\033[0;31m'
GREEN='\033[0;32m'
NC='\033[0m'

log()  { echo -e "${GREEN}[+]${NC} $*"; }
err()  { echo -e "${RED}[!]${NC} $*" >&2; exit 1; }

[[ $EUID -eq 0 ]] || err "请使用 root 运行: sudo bash scripts/install.sh"
[[ -f "$ENV_FILE" ]] || err "缺少 .env 文件，请先: cp .env.example .env 并填写"

# shellcheck disable=SC1090
source "$ENV_FILE"

: "${VPS_IP:?请在 .env 中设置 VPS_IP}"
: "${DOMAIN:?请在 .env 中设置 DOMAIN}"
: "${ACME_EMAIL:?请在 .env 中设置 ACME_EMAIL}"
: "${REALITY_SERVER_NAME:=www.microsoft.com}"

if [[ -z "${UUID:-}" || -z "${REALITY_PRIVATE_KEY:-}" ]]; then
  log "未检测到密钥，运行 generate-keys.sh ..."
  bash "$SCRIPT_DIR/generate-keys.sh"
  source "$ENV_FILE"
fi

: "${UUID:?}"
: "${REALITY_PRIVATE_KEY:?}"
: "${REALITY_SHORT_ID:?}"
: "${HY2_PASSWORD:?}"

ARCH="$(uname -m)"
case "$ARCH" in
  x86_64)  SB_ARCH="amd64" ;;
  aarch64) SB_ARCH="arm64" ;;
  *) err "不支持的架构: $ARCH" ;;
esac

SB_VERSION="1.11.0"
SB_URL="https://github.com/SagerNet/sing-box/releases/download/v${SB_VERSION}/sing-box-${SB_VERSION}-linux-${SB_ARCH}.tar.gz"

log "更新系统包 ..."
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y -qq curl wget nginx ufw ca-certificates

log "安装 sing-box ${SB_VERSION} ..."
TMP="$(mktemp -d)"
curl -fsSL "$SB_URL" | tar -xz -C "$TMP" --strip-components=1
install -m 755 "$TMP/sing-box" /usr/local/bin/sing-box
rm -rf "$TMP"

log "配置防火墙 ..."
ufw --force reset
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp comment 'SSH'
ufw allow 80/tcp comment 'HTTP-ACME'
ufw allow 443/tcp comment 'Reality'
ufw allow 8443/udp comment 'Hysteria2'
ufw --force enable

log "部署 Nginx fallback 站点 ..."
mkdir -p /var/www/fallback
cp "$ROOT_DIR/server/nginx/index.html" /var/www/fallback/
cp "$ROOT_DIR/server/nginx/fallback.conf" /etc/nginx/sites-available/fallback
ln -sf /etc/nginx/sites-available/fallback /etc/nginx/sites-enabled/fallback
rm -f /etc/nginx/sites-enabled/default

log "部署 Nginx ACME 验证站点 (80) ..."
mkdir -p /var/www/acme
sed "s|__DOMAIN__|${DOMAIN}|g" "$ROOT_DIR/server/nginx/acme.conf.template" \
  > /etc/nginx/sites-available/acme
ln -sf /etc/nginx/sites-available/acme /etc/nginx/sites-enabled/acme
nginx -t && systemctl enable nginx && systemctl restart nginx

log "申请 TLS 证书 (Let's Encrypt) ..."
mkdir -p /etc/sing-box/certs
if [[ ! -f /root/.acme.sh/acme.sh ]]; then
  curl -fsSL https://get.acme.sh | sh -s email="$ACME_EMAIL"
fi
# shellcheck disable=SC1091
source /root/.acme.sh/acme.sh.env || true

# 确保域名已解析到本机
CURRENT_IP="$(curl -4 -fsSL ifconfig.me 2>/dev/null || curl -4 -fsSL ip.sb)"
if [[ "$CURRENT_IP" != "$VPS_IP" ]]; then
  err "域名 $DOMAIN 需先解析到 VPS IP ($VPS_IP)，当前 VPS 出口 IP 为 $CURRENT_IP"
fi

/root/.acme.sh/acme.sh --set-default-ca --server letsencrypt
/root/.acme.sh/acme.sh --issue -d "$DOMAIN" -w /var/www/acme --force
/root/.acme.sh/acme.sh --install-cert -d "$DOMAIN" \
  --key-file /etc/sing-box/certs/privkey.pem \
  --fullchain-file /etc/sing-box/certs/fullchain.pem \
  --reloadcmd "systemctl restart sing-box"

log "生成 sing-box 服务端配置 ..."
mkdir -p /etc/sing-box
sed -e "s|\${UUID}|${UUID}|g" \
    -e "s|\${REALITY_SERVER_NAME}|${REALITY_SERVER_NAME}|g" \
    -e "s|\${REALITY_PRIVATE_KEY}|${REALITY_PRIVATE_KEY}|g" \
    -e "s|\${REALITY_SHORT_ID}|${REALITY_SHORT_ID}|g" \
    -e "s|\${HY2_PASSWORD}|${HY2_PASSWORD}|g" \
    -e "s|\${DOMAIN}|${DOMAIN}|g" \
    "$ROOT_DIR/server/sing-box.json.template" > /etc/sing-box/config.json

sing-box check -c /etc/sing-box/config.json

log "创建 systemd 服务 ..."
cat > /etc/systemd/system/sing-box.service <<'UNIT'
[Unit]
Description=sing-box service
After=network-online.target nginx.service
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
Restart=on-failure
RestartSec=5
LimitNOFILE=1048576

[Install]
WantedBy=multi-user.target
UNIT

systemctl daemon-reload
systemctl enable sing-box
systemctl restart sing-box

log "生成客户端配置 ..."
CLIENT_DIR="${ROOT_DIR}/client/generated"
mkdir -p "$CLIENT_DIR"
: "${REALITY_PUBLIC_KEY:?请在 .env 中设置 REALITY_PUBLIC_KEY（运行 generate-keys.sh 可自动生成）}"

sed -e "s|\${VPS_IP}|${VPS_IP}|g" \
    -e "s|\${DOMAIN}|${DOMAIN}|g" \
    -e "s|\${UUID}|${UUID}|g" \
    -e "s|\${REALITY_SERVER_NAME}|${REALITY_SERVER_NAME}|g" \
    -e "s|\${REALITY_PUBLIC_KEY}|${REALITY_PUBLIC_KEY}|g" \
    -e "s|\${REALITY_SHORT_ID}|${REALITY_SHORT_ID}|g" \
    -e "s|\${HY2_PASSWORD}|${HY2_PASSWORD}|g" \
    "$ROOT_DIR/client/sing-box-client.json.template" > "$CLIENT_DIR/sing-box-client.json"

# 生成分享链接
cat > "$CLIENT_DIR/share-links.txt" <<EOF
========== VLESS + Reality (主力) ==========
vless://${UUID}@${VPS_IP}:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=${REALITY_SERVER_NAME}&fp=chrome&pbk=${REALITY_PUBLIC_KEY}&sid=${REALITY_SHORT_ID}&type=tcp#Reality-Main

========== Hysteria2 (备用) ==========
hy2://${HY2_PASSWORD}@${DOMAIN}:8443?sni=${DOMAIN}#Hysteria2-Backup

========== 参数明细 ==========
VPS IP:           ${VPS_IP}
UUID:             ${UUID}
Reality SNI:      ${REALITY_SERVER_NAME}
Reality PublicKey: ${REALITY_PUBLIC_KEY}
Reality ShortId:  ${REALITY_SHORT_ID}
Hysteria2 域名:   ${DOMAIN}
Hysteria2 密码:   ${HY2_PASSWORD}
EOF

log "部署完成！"
echo ""
cat "$CLIENT_DIR/share-links.txt"
echo ""
log "客户端配置文件: ${CLIENT_DIR}/sing-box-client.json"
log "sing-box 状态: systemctl status sing-box"
log "查看日志: journalctl -u sing-box -f"