#!/usr/bin/env bash
set -e

# 固定配置
PANEL_URL="http://xapi.reality.pp.ua"
PANEL_TOKEN="michaeltan057720"
CF_TOKEN="pB7L0EBVHH8egPhLftWdkUSEQpZEGSvCl4gqY77b"
CERT_DIR="/etc/ssl/xboard"

if [ "$(id -u)" -ne 0 ]; then
    echo -e "\033[31m[错误] 请以 root 权限运行此脚本！\033[0m"
    exit 1
fi

echo -e "\033[32m========================================\033[0m"
echo -e "\033[32m  AnyTLS 节点 + 证书自动续签一体化部署  \033[0m"
echo -e "\033[32m========================================\033[0m"

# 1. 交互输入
while true; do
    read -rp "请输入节点解析域名 (例如 us.56.proxya.pp.ua): " DOMAIN
    [ -n "$DOMAIN" ] && break
done

while true; do
    read -rp "请输入 Xboard 节点 ID: " NODE_ID
    if [[ "$NODE_ID" =~ ^[0-9]+$ ]]; then
        break
    else
        echo -e "\033[31m[错误] 节点 ID 必须是正整数！\033[0m"
    fi
done

echo -e "\n\033[34m[1/3] 正在通过 Cloudflare Token 自动申请证书...\033[0m"
apt-get update -y && apt-get install -y curl socat cron openssl
mkdir -p "${CERT_DIR}"

export CF_Token="${CF_TOKEN}"
unset CF_Key
unset CF_Email
unset CF_Zone_ID

curl https://get.acme.sh | sh -s email="admin@${DOMAIN}"
~/.acme.sh/acme.sh --upgrade --auto-upgrade

# 申请证书
~/.acme.sh/acme.sh --issue --dns dns_cf -d "${DOMAIN}" --force

echo -e "\n\033[34m[2/3] 安装/重载 xboard-node 二进制程序...\033[0m"
curl -fsSL https://raw.githubusercontent.com/cedar2025/xboard-node/dev/install.sh | \
    bash -s -- --mode node \
    --panel "${PANEL_URL}" \
    --token "${PANEL_TOKEN}" \
    --node-id "${NODE_ID}"

echo -e "\n\033[34m[3/3] 安装证书并绑定自动续签热重启命令...\033[0m"
# 绑定 reloadcmd 钩子，续签成功后自动重启服务
~/.acme.sh/acme.sh --install-cert -d "${DOMAIN}" \
    --key-file       "${CERT_DIR}/private.key" \
    --fullchain-file "${CERT_DIR}/fullchain.cer" \
    --reloadcmd      "systemctl restart xboard-node"

CONFIG_FILE="/etc/xboard-node/config.yml"
if [ -f "$CONFIG_FILE" ]; then
    if grep -q "cert_path:" "$CONFIG_FILE"; then
        sed -i "s|cert_path:.*|cert_path: \"${CERT_DIR}/fullchain.cer\"|" "$CONFIG_FILE"
        sed -i "s|key_path:.*|key_path: \"${CERT_DIR}/private.key\"|" "$CONFIG_FILE"
    else
        cat << C新た >> "$CONFIG_FILE"
tls:
  cert_path: "${CERT_DIR}/fullchain.cer"
  key_path: "${CERT_DIR}/private.key"
C新た
    fi
    systemctl restart xboard-node
fi

echo -e "\n\033[32m========================================\033[0m"
echo -e "\033[32m          AnyTLS 节点全部部署完成       \033[0m"
echo -e "\033[32m========================================\033[0m"
echo -e "说明: 证书到期前系统将自动续签并重启服务，无需人工维护。"
echo -e "查看状态: systemctl status xboard-node"
echo -e "实时日志: journalctl -u xboard-node -f"