#!/usr/bin/env bash
set -euo pipefail
# ============================================================
# 主控一键部署脚本 (从代码服务器拉取最新主控代码并安装)
# 用法:
#   curl -s http://64.81.114.40/install_master.sh -o /tmp/im.sh
#   AUTH_PWD=你的管理员密码 bash /tmp/im.sh
# 环境变量:
#   CODE_SERVER  代码服务器地址 (默认 http://64.81.114.40)
#   AUTH_USER    主控管理员账号 (默认 admin)
#   AUTH_PWD     主控管理员密码 (默认自动生成随机密码)
# ============================================================
CODE_SERVER="${CODE_SERVER:-http://64.81.114.40}"
AUTH_USER="${AUTH_USER:-admin}"
AUTH_PWD="${AUTH_PWD:-$(head -c 200 /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 12)}"

echo "==> 主控一键部署开始"
echo "    代码服务器: $CODE_SERVER"
echo "    账号: $AUTH_USER  密码: $AUTH_PWD"

# 占位符防护: 密码含中文/空格等非法字符时视为无效, 自动改用随机密码
if printf '%s' "$AUTH_PWD" | LC_ALL=C grep -q '[^a-zA-Z0-9@#$%^&*+._!~=?,-]'; then
  echo "警告: 密码包含非法字符(中文/空格), 已自动改用随机密码"
  AUTH_PWD="$(head -c 200 /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 12)"
  echo "    新随机密码: $AUTH_PWD"
fi

[ "$(id -u)" = "0" ] || { echo "错误: 需要 root 权限"; exit 1; }

. /etc/os-release 2>/dev/null || true
case "${ID:-}" in
  ubuntu|debian) ;;
  *) echo "错误: 仅支持 Ubuntu/Debian (当前: ${PRETTY_NAME:-unknown})"; exit 1 ;;
esac

echo "==> 安装基础依赖 (python3/pip/curl)..."
apt-get update -qq
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3 python3-pip curl ca-certificates

echo "==> 安装 Python 依赖 (flask/flask-sock/paramiko 等)..."
python3 -m pip install -q --no-input flask flask-sock pysocks dnspython dkimpy requests cryptography paramiko aiosmtpd || \
python3 -m pip install -q --no-input --break-system-packages flask flask-sock pysocks dnspython dkimpy requests cryptography paramiko aiosmtpd || \
python3 -m pip install -q --no-input --break-system-packages --ignore-installed flask flask-sock pysocks dnspython dkimpy requests cryptography paramiko aiosmtpd

echo "==> 校验依赖 (必须全部 import 成功)..."
python3 -c "import flask, flask_sock, socks, dns.resolver, dkim, cryptography, requests, paramiko, aiosmtpd; print('依赖校验OK')"

echo "==> 下载主控代码包..."
mkdir -p /root/jpmail /root/core
curl -fsSL "$CODE_SERVER/master_jpmail.tar.gz" -o /tmp/master_jpmail.tar.gz
tar -xzf /tmp/master_jpmail.tar.gz -C /root/
rm -f /tmp/master_jpmail.tar.gz

echo "==> 生成主控配置 web_config.json..."
cat > /root/jpmail/web_config.json <<EOF
{
  "host": "0.0.0.0",
  "port": 5000,
  "auth_user": "$AUTH_USER",
  "auth_pwd": "$AUTH_PWD",
  "enable_direct_send": false,
  "enable_bridge": false
}
EOF

echo "==> 创建 systemd 服务 jpmail..."
cat > /etc/systemd/system/jpmail.service <<'EOF'
[Unit]
Description=JP Mail Master Panel
After=network.target

[Service]
Type=simple
WorkingDirectory=/root/jpmail
Environment=PYTHONIOENCODING=utf-8
ExecStart=/usr/bin/python3 /root/jpmail/app.py
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable jpmail 2>&1 | tail -1 || true
systemctl restart jpmail
sleep 4
STATE=$(systemctl is-active jpmail)
echo "==> jpmail 服务状态: $STATE"
if [ "$STATE" != "active" ]; then
  echo "==> 启动失败, 最近日志:"
  journalctl -u jpmail -n 20 --no-pager
  exit 1
fi

IP="$(curl -4 -s --max-time 8 ifconfig.me 2>/dev/null)"
[ -z "$IP" ] && IP="$(curl -4 -s --max-time 8 api.ipify.org 2>/dev/null)"
[ -z "$IP" ] && IP="$(hostname -I 2>/dev/null | awk '{print $1}')"
echo ""
echo "=========================================="
echo " 主控部署完成!"
echo " 访问地址: http://$IP:5000"
echo " 登录账号: $AUTH_USER"
echo " 登录密码: $AUTH_PWD"
echo " (登录后请立即用「修改密码」更换)"
echo "=========================================="