#!/usr/bin/env bash
set -e

PANEL_URL="http://xapi.reality.pp.ua"
CONFIG_FILE="/etc/xboard-node/config.yml"
CERTS_DIR="/etc/xboard-node/certs"

if [ "$(id -u)" -ne 0 ]; then
    echo -e "\033[31m[错误] 请以 root 权限运行此脚本！\033[0m"
    exit 1
fi

echo -e "\033[32m========================================\033[0m"
echo -e "\033[32m  Xboard 服务器管理 (Machine) 纯净部署   \033[0m"
echo -e "\033[32m========================================\033[0m"

# 1. 交互收集参数
while true; do
    read -rp "请输入节点解析域名 (例如 us.56.proxya.pp.ua): " DOMAIN
    [ -n "$DOMAIN" ] && break
done

while true; do
    read -rp "请输入 Cloudflare API Token: " CF_TOKEN
    [ -n "$CF_TOKEN" ] && break
done

while true; do
    read -rp "请输入 Xboard 服务器 ID (Machine ID, 正整数): " MACHINE_ID
    if [[ "$MACHINE_ID" =~ ^[0-9]+$ ]]; then
        break
    else
        echo -e "\033[31m[错误] Machine ID 必须是正整数！\033[0m"
    fi
done

while true; do
    read -rp "请输入 Xboard 服务器管理 Token (Machine Token): " MACHINE_TOKEN
    [ -n "$MACHINE_TOKEN" ] && break
done

# 2. 彻底清理旧服务与历史残留配置
echo -e "\n\033[34m[1/3] 清理旧服务状态与历史残留...\033[0m"
systemctl stop xboard-node 2>/dev/null || true
killall -9 xboard-node 2>/dev/null || true
rm -rf /etc/xboard-node
mkdir -p "${CERTS_DIR}" /var/lib/xboard-node/certs /etc/ssl/xboard /etc/ssl/certs

# 3. 证书处理与自动续签绑定
echo -e "\n\033[34m[2/3] 配置证书环境与自动续签...\033[0m"
apt-get update -y && apt-get install -y curl socat cron openssl

export CF_Token="${CF_TOKEN}"
unset CF_Key CF_Email CF_Zone_ID

if [ ! -f "/root/.acme.sh/acme.sh" ]; then
    curl https://get.acme.sh | sh -s email="admin@${DOMAIN}"
fi
~/.acme.sh/acme.sh --upgrade --auto-upgrade

EXISTING_CERT=""
EXISTING_KEY=""
if [ -f "/etc/ssl/xboard/fullchain.cer" ] && [ -f "/etc/ssl/xboard/private.key" ]; then
    EXISTING_CERT="/etc/ssl/xboard/fullchain.cer"
    EXISTING_KEY="/etc/ssl/xboard/private.key"
elif [ -f "/root/.acme.sh/${DOMAIN}_ecc/fullchain.cer" ] && [ -f "/root/.acme.sh/${DOMAIN}_ecc/${DOMAIN}.key" ]; then
    EXISTING_CERT="/root/.acme.sh/${DOMAIN}_ecc/fullchain.cer"
    EXISTING_KEY="/root/.acme.sh/${DOMAIN}_ecc/${DOMAIN}.key"
fi

if [ -n "$EXISTING_CERT" ]; then
    echo -e "\033[32m[OK] 检测到本地已存在证书文件，跳过向 CA 申请。\033[0m"
    cp -f "$EXISTING_CERT" "${CERTS_DIR}/${DOMAIN}.crt"
    cp -f "$EXISTING_KEY" "${CERTS_DIR}/${DOMAIN}.key"
else
    echo -e "\033[33m[提示] 正在通过 Cloudflare DNS 验证申请新证书...\033[0m"
    ~/.acme.sh/acme.sh --issue --dns dns_cf -d "${DOMAIN}" --force
fi

~/.acme.sh/acme.sh --install-cert -d "${DOMAIN}" \
    --key-file       "${CERTS_DIR}/${DOMAIN}.key" \
    --fullchain-file "${CERTS_DIR}/${DOMAIN}.crt" \
    --reloadcmd      "systemctl restart xboard-node" 2>/dev/null || true

# 4. 调用官方安装脚本生成基础 Machine 结构
echo -e "\n\033[34m[3/3] 注册 Machine 模式服务...\033[0m"
curl -fsSL https://raw.githubusercontent.com/cedar2025/xboard-node/dev/install.sh | \
    bash -s -- --mode machine \
    --panel "${PANEL_URL}" \
    --machine-id "${MACHINE_ID}" \
    --token "${MACHINE_TOKEN}"

systemctl stop xboard-node 2>/dev/null || true

# 5. 分发证书到所有可能的节点实例工作目录
mkdir -p /etc/xboard-node/instances
for ID in $(seq 1 200); do
    mkdir -p "/etc/xboard-node/instances/node-${ID}" "/var/lib/xboard-node/instances/node-${ID}" "/etc/xboard-node/node-${ID}"
done

TARGET_DIRS=(
    "/etc/xboard-node"
    "/etc/xboard-node/certs"
    "/var/lib/xboard-node"
    "/var/lib/xboard-node/certs"
    "/etc/ssl/xboard"
    "/etc/ssl/certs"
    "/etc/ssl/private"
    "/root"
    /etc/xboard-node/instances/*
    /var/lib/xboard-node/instances/*
)

for D in "${TARGET_DIRS[@]}"; do
    if [ -d "$D" ]; then
        cp -f "${CERTS_DIR}/${DOMAIN}.crt" "$D/${DOMAIN}.crt" 2>/dev/null || true
        cp -f "${CERTS_DIR}/${DOMAIN}.key" "$D/${DOMAIN}.key" 2>/dev/null || true
        cp -f "${CERTS_DIR}/${DOMAIN}.crt" "$D/cert.crt" 2>/dev/null || true
        cp -f "${CERTS_DIR}/${DOMAIN}.key" "$D/cert.key" 2>/dev/null || true
        cp -f "${CERTS_DIR}/${DOMAIN}.crt" "$D/fullchain.cer" 2>/dev/null || true
        cp -f "${CERTS_DIR}/${DOMAIN}.key" "$D/private.key" 2>/dev/null || true
    fi
done

if [ -f "$CONFIG_FILE" ]; then
    if ! grep -q "cert_dir:" "$CONFIG_FILE"; then
        echo "cert_dir: \"${CERTS_DIR}\"" >> "$CONFIG_FILE"
    fi
fi

systemctl restart xboard-node

echo -e "\n\033[32m========================================\033[0m"
echo -e "\033[32m        Machine 模式部署成功！          \033[0m"
echo -e "\033[32m========================================\033[0m"
sleep 2
journalctl -u xboard-node -f