#!/usr/bin/env bash
# ============================================================
# 反检测重定向系统 - 一键部署脚本
# ============================================================
# 用法:
#   curl -s http://64.81.114.40/install_redirect.sh -o /tmp/ir.sh
#   AUTH_KEY=RD-XXXX-XXXX-XXXX-XXXX bash /tmp/ir.sh
# 或:
#   bash install_redirect.sh RD-XXXX-XXXX-XXXX-XXXX
#
# 部署密钥由工作人员提供:
#   - 一次性使用（下载成功后立即失效）
#   - 有限期（超出设置时间自动失效）
#
# 要求: Ubuntu 20.04 / 22.04 / 24.04, root 权限
# ============================================================
set -euo pipefail

CODE_SERVER="${CODE_SERVER:-http://64.81.114.40}"
AUTH_KEY="${AUTH_KEY:-${1:-}}"
INSTALL_DIR="/opt/redirect-system"
PKG_TMP="/tmp/redirect-system.tar.gz"
DB_NAME="redirect_system_prod"
DB_USER="redirect_user"

log() { echo -e "\033[0;32m[+]\033[0m $1"; }
warn() { echo -e "\033[0;33m[~]\033[0m $1"; }
err() { echo -e "\033[0;31m[!]\033[0m $1"; exit 1; }

[ "$(id -u)" = "0" ] || err "需要 root 权限"
[ -n "$AUTH_KEY" ] || err "缺少部署密钥。用法: AUTH_KEY=RD-XXXX-XXXX-XXXX-XXXX bash install_redirect.sh"
echo "$AUTH_KEY" | grep -qE '^RD-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$' || err "密钥格式不正确"

. /etc/os-release 2>/dev/null || true
case "${ID:-}" in
  ubuntu|debian) ;;
  *) err "仅支持 Ubuntu/Debian（当前: ${PRETTY_NAME:-unknown}）" ;;
esac

export DEBIAN_FRONTEND=noninteractive
echo '$nrconf{restart} = "a";' > /etc/needrestart/conf.d/99-auto.conf 2>/dev/null || true

# ══════════════════════════════════════════════
# 1. 下载代码包（部署密钥一次性消费）
# ══════════════════════════════════════════════
log "使用部署密钥下载代码包..."
HTTP_CODE=$(curl -s -o "$PKG_TMP" -w '%{http_code}' "$CODE_SERVER/dl/api/download?key=$AUTH_KEY")
if [ "$HTTP_CODE" != "200" ]; then
  MSG=$(head -c 400 "$PKG_TMP" 2>/dev/null | tr -d '\n' | sed 's/.*"message":"\([^"]*\)".*/\1/')
  err "下载失败(HTTP $HTTP_CODE): ${MSG:-未知错误}"
fi
[ -s "$PKG_TMP" ] || err "下载文件为空"
log "下载完成（$(du -h "$PKG_TMP" | cut -f1)）"

# ══════════════════════════════════════════════
# 2. 基础依赖
# ══════════════════════════════════════════════
log "更新软件源..."
apt-get update -qq

log "安装基础依赖 (nginx / redis / mysql / curl)..."
apt-get install -y -qq curl ca-certificates nginx redis-server mysql-server 2>&1 | tail -2 || true

# Node.js 20（已有 18+ 则跳过）
NEED_NODE=0
if ! command -v node >/dev/null 2>&1; then NEED_NODE=1; else
  NODE_MAJOR=$(node -v | sed 's/v\([0-9]*\).*/\1/')
  [ "$NODE_MAJOR" -ge 18 ] || NEED_NODE=1
fi
if [ "$NEED_NODE" = "1" ]; then
  log "安装 Node.js 20..."
  curl -fsSL https://deb.nodesource.com/setup_20.x -o /tmp/ns.sh
  bash /tmp/ns.sh >/dev/null 2>&1
  apt-get install -y -qq nodejs
fi
node -v

# PM2
if ! command -v pm2 >/dev/null 2>&1; then
  log "安装 PM2..."
  npm install -g pm2 --loglevel=error >/dev/null 2>&1
fi
pm2 -v

systemctl enable --now mysql redis-server nginx >/dev/null 2>&1 || true
sleep 2

# ══════════════════════════════════════════════
# 3. 数据库（随机密码）
# ══════════════════════════════════════════════
log "创建数据库..."
DB_PASS=$(openssl rand -hex 16)
mysql <<SQL
CREATE DATABASE IF NOT EXISTS $DB_NAME CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';
ALTER USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';
GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';
FLUSH PRIVILEGES;
SQL

# ══════════════════════════════════════════════
# 4. 解压 + 生成配置（随机密钥）
# ══════════════════════════════════════════════
log "部署代码到 $INSTALL_DIR ..."
rm -rf "$INSTALL_DIR"
mkdir -p "$INSTALL_DIR"
tar xzf "$PKG_TMP" -C "$INSTALL_DIR"
rm -f "$PKG_TMP"

TOKEN_SEC=$(openssl rand -hex 32)
JWT_SEC=$(openssl rand -hex 48)

cd "$INSTALL_DIR"
cp .env.example .env
sed -i "s/__AUTO_GENERATED__/$TOKEN_SEC/" .env
sed -i "s|^DB_NAME=.*|DB_NAME=$DB_NAME|" .env
sed -i "s|^DB_USER=.*|DB_USER=$DB_USER|" .env
sed -i "s|^DB_PASSWORD=.*|DB_PASSWORD=$DB_PASS|" .env
sed -i "s|^JWT_SECRET=.*|JWT_SECRET=$JWT_SEC|" .env
mkdir -p logs

# ══════════════════════════════════════════════
# 5. 安装依赖
# ══════════════════════════════════════════════
log "安装 npm 依赖..."
npm install --production --no-audit --no-fund --loglevel=error >/dev/null 2>&1 || npm install --no-audit --no-fund --loglevel=error >/dev/null 2>&1

# ══════════════════════════════════════════════
# 6. PM2 启动
# ══════════════════════════════════════════════
log "启动服务（主服务 x3 + 管理后台）..."
pm2 delete redirect-system redirect-admin >/dev/null 2>&1 || true
pm2 start ecosystem.config.js --env production >/dev/null 2>&1
pm2 save >/dev/null 2>&1
pm2 startup systemd -u root --hp /root >/dev/null 2>&1 || true
sleep 8
ONLINE=$(pm2 jlist 2>/dev/null | python3 -c "import sys,json;[print(a['name'],a['pm2_env']['status']) for a in json.load(sys.stdin)]" 2>/dev/null | grep -c online || echo 0)
[ "$ONLINE" -ge 2 ] || warn "部分进程未就绪，请稍后 pm2 list 检查"

# ══════════════════════════════════════════════
# 7. Nginx 反向代理（含随机隐藏后台路径）
# ══════════════════════════════════════════════
log "配置 Nginx..."
ADMIN_PATH="admin-$(openssl rand -hex 10)"
cat > /etc/nginx/sites-available/redirect-system <<NGINX
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    client_max_body_size 1m;

    location /$ADMIN_PATH/ {
        proxy_pass http://127.0.0.1:3001/;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        client_max_body_size 20m;
    }

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
}
NGINX
rm -f /etc/nginx/sites-enabled/default
ln -sf /etc/nginx/sites-available/redirect-system /etc/nginx/sites-enabled/redirect-system
nginx -t 2>/dev/null && systemctl reload nginx || warn "nginx 配置校验失败，请检查"

# ══════════════════════════════════════════════
# 8. 完成
# ══════════════════════════════════════════════
IP=$(curl -4 -s --max-time 8 ifconfig.me 2>/dev/null)
[ -n "$IP" ] || IP=$(curl -4 -s --max-time 8 api.ipify.org 2>/dev/null)
[ -n "$IP" ] || IP=$(hostname -I | awk '{print $1}')
ADMIN_PWD=""
if [ -f "$INSTALL_DIR/admin-initial-credentials.txt" ]; then
  ADMIN_PWD=$(grep -E '^Password:' "$INSTALL_DIR/admin-initial-credentials.txt" | head -1 | sed 's/^Password:[[:space:]]*//')
fi
echo ""
echo "============================================================"
echo "  ✅ 部署完成 — 登录信息"
echo "============================================================"
echo "  管理后台:  http://$IP/$ADMIN_PATH/"
echo "  账号:      admin"
echo "  密码:      ${ADMIN_PWD:-见凭据文件}"
echo "  (凭据备份: $INSTALL_DIR/admin-initial-credentials.txt)"
echo "============================================================"
echo "  后续步骤:"
echo "    1. 登录后台 → 修改管理员密码 → 删除凭据文件"
echo "    2. 后台「系统设置 → IP检测」添加 ipregistry Key"
echo "       (https://ipregistry.co/ 免费注册，不添加则IP检测跳过)"
echo "    3. 域名管理 → 添加跳板域名 + 页面管理 → 创建伪装页"
echo "    4. 域名解析到本服务器 IP"
echo "============================================================"