#!/usr/bin/env bash
set -Eeuo pipefail
trap 'echo "[错误] 第 $LINENO 行执行失败：$BASH_COMMAND" >&2' ERR

CONFIG_FILE="/etc/hysteria/config.yaml"
SERVICE_NAME="hysteria-server.service"

red()    { printf '\033[31m%s\033[0m\n' "$*"; }
green()  { printf '\033[32m%s\033[0m\n' "$*"; }
yellow() { printf '\033[33m%s\033[0m\n' "$*"; }
blue()   { printf '\033[36m%s\033[0m\n' "$*"; }

require_root() {
  if [[ "${EUID}" -ne 0 ]]; then
    red "请使用 root 运行此脚本。"
    exit 1
  fi
}

require_cmd() {
  command -v "$1" >/dev/null 2>&1 || {
    red "缺少命令: $1"
    exit 1
  }
}

random_subdomain_prefix() {
  openssl rand -hex 8 | cut -c1-8
}

prompt_nonempty() {
  local prompt="$1"
  local value=""
  while true; do
    read -r -p "$prompt" value < /dev/tty
    if [[ -n "${value// }" ]]; then
      printf '%s' "$value"
      return 0
    fi
    yellow "输入不能为空，请重新输入。" >&2
  done
}

confirm_yn() {
  local prompt="${1:-是否继续？}"
  local answer
  read -r -p "${prompt} [Y/n]: " answer
  case "${answer:-Y}" in
    Y|y|yes|YES|"") return 0 ;;
    N|n|no|NO) return 1 ;;
    *) yellow "输入无效，默认按 Y 处理。"; return 0 ;;
  esac
}

wait_for_apt_lock() {
  local timeout="${1:-300}"
  local waited=0

  while pgrep -x apt >/dev/null 2>&1 \
     || pgrep -x apt-get >/dev/null 2>&1 \
     || pgrep -x dpkg >/dev/null 2>&1 \
     || pgrep -f unattended-upgrades >/dev/null 2>&1; do
    if (( waited == 0 )); then
      yellow "检测到 APT/DPKG 正被其他进程占用，正在等待..."
      ps -ef | grep -E 'apt|apt-get|dpkg|unattended' | grep -v grep || true
    fi

    if (( waited >= timeout )); then
      red "等待 APT 锁超时（${timeout} 秒）。"
      if confirm_yn "是否继续等待？"; then
        waited=0
      else
        return 1
      fi
    fi

    sleep 2
    waited=$((waited + 2))
  done

  green "APT 锁已释放。"
  return 0
}

generate_password() {
  openssl rand -base64 24 | tr -dc 'A-Za-z0-9' | head -c 24
  echo
}

mask_secret() {
  local secret="$1"
  local len="${#secret}"
  if (( len <= 8 )); then
    printf '********'
  else
    printf '%s****%s' "${secret:0:4}" "${secret: -4}"
  fi
}

validate_domain() {
  local domain="$1"
  [[ -n "$domain" ]] || return 1
  [[ "$domain" != *$'\n'* ]] || return 1
  [[ "$domain" != *$'\r'* ]] || return 1
  [[ "$domain" =~ ^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ ]]
}

get_server_ip() {
  local ipv4 ipv6
  ipv4="$(curl -4 -fsSL https://api.ipify.org || true)"
  ipv6="$(curl -6 -fsSL https://api64.ipify.org || true)"
  echo "${ipv4}|${ipv6}"
}

apt_update_and_install_base() {
  if ! confirm_yn "即将执行 apt update 并安装基础依赖 curl sed ufw openssl，是否继续？"; then
    red "已取消。"
    exit 1
  fi

  export DEBIAN_FRONTEND=noninteractive

  blue "==> 更新 APT 软件库"
  wait_for_apt_lock 300 || { red "APT 被占用，无法继续。"; exit 1; }
  apt update -y

  blue "==> 安装基础依赖"
  wait_for_apt_lock 300 || { red "APT 被占用，无法继续。"; exit 1; }
  apt install -y curl sed ufw openssl
}

disable_existing_firewalls() {
  if ! confirm_yn "即将关闭系统现有防火墙并清理规则，是否继续？"; then
    red "已取消关闭现有防火墙。"
    exit 1
  fi

  blue "==> 自动检测并关闭当前系统防火墙"

  if command -v ufw >/dev/null 2>&1; then
    yellow "检测到 UFW，正在关闭并重置"
    ufw disable || true
    yes | ufw reset || true
  fi

  if systemctl list-unit-files 2>/dev/null | grep -q '^firewalld\.service'; then
    yellow "检测到 firewalld，正在停止并禁用"
    systemctl stop firewalld || true
    systemctl disable firewalld || true
    systemctl mask firewalld || true
  fi

  if systemctl list-unit-files 2>/dev/null | grep -q '^nftables\.service'; then
    yellow "检测到 nftables，正在停止并禁用"
    systemctl stop nftables || true
    systemctl disable nftables || true
  fi

  if command -v nft >/dev/null 2>&1; then
    yellow "清空 nftables 规则"
    nft flush ruleset || true
  fi

  if command -v iptables >/dev/null 2>&1; then
    yellow "清空 iptables 规则"
    iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT || true
    iptables -F || true
    iptables -X || true
    iptables -Z || true
    iptables -P INPUT ACCEPT || true
    iptables -P FORWARD ACCEPT || true
    iptables -P OUTPUT ACCEPT || true
  else
    yellow "未检测到 iptables，跳过。"
  fi

  if command -v ip6tables >/dev/null 2>&1; then
    yellow "清空 ip6tables 规则"
    ip6tables -I INPUT 1 -p tcp --dport 22 -j ACCEPT || true
    ip6tables -F || true
    ip6tables -X || true
    ip6tables -Z || true
    ip6tables -P INPUT ACCEPT || true
    ip6tables -P FORWARD ACCEPT || true
    ip6tables -P OUTPUT ACCEPT || true
  else
    yellow "未检测到 ip6tables，跳过。"
  fi

  green "现有防火墙处理完成。"
}

configure_ufw() {
  if ! confirm_yn "即将配置并启用 UFW（开放 22/80/443 TCP 和 443 UDP），是否继续？"; then
    red "已取消 UFW 配置。"
    exit 1
  fi

  blue "==> 配置 UFW"

  if [[ -f /etc/default/ufw ]]; then
    sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw || true
  fi

  ufw default deny incoming || true
  ufw default allow outgoing || true
  ufw allow 22/tcp || true
  ufw allow 80/tcp || true
  ufw allow 443/tcp || true
  ufw allow 443/udp || true
  yes | ufw enable || true

  green "UFW 配置完成。"
}

install_hysteria2() {
  if ! confirm_yn "即将安装 Hysteria 2，是否继续？"; then
    red "已取消 Hysteria 2 安装。"
    exit 1
  fi

  blue "==> 安装 Hysteria 2"
  bash <(curl -fsSL https://get.hy2.sh/)
  green "Hysteria 2 安装完成。"
}

run_domain_selector() {
  if confirm_yn "是否执行外部域名筛选脚本？"; then
    blue "==> 执行域名筛选脚本"
    bash <(curl -sL https://raw.githubusercontent.com/ccxkai233/Domain_Selector/main/domain_check.sh) || true
  else
    yellow "已跳过域名筛选脚本。"
  fi
}

cf_api_request() {
  local method="$1"
  local url="$2"
  local data="${3:-}"

  if [[ -n "$data" ]]; then
    curl -fsSL -X "$method" "$url" \
      -H "Authorization: Bearer ${CF_API_TOKEN}" \
      -H "Content-Type: application/json" \
      --data "$data"
  else
    curl -fsSL -X "$method" "$url" \
      -H "Authorization: Bearer ${CF_API_TOKEN}" \
      -H "Content-Type: application/json"
  fi
}

get_cf_zone_id() {
  local zone="$1"
  cf_api_request GET "https://api.cloudflare.com/client/v4/zones?name=${zone}" \
    | sed -n 's/.*"id":"\([^"]*\)".*/\1/p' | head -n 1
}

delete_existing_cf_dns_record() {
  local zone_id="$1"
  local full_domain="$2"
  local type="$3"
  local record_id

  record_id="$(
    cf_api_request GET "https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records?name=${full_domain}&type=${type}" \
      | sed -n 's/.*"id":"\([^"]*\)".*/\1/p' | head -n 1
  )"

  if [[ -n "$record_id" ]]; then
    cf_api_request DELETE "https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records/${record_id}" >/dev/null
  fi
}

create_cf_dns_record_type() {
  local zone_id="$1"
  local full_domain="$2"
  local type="$3"
  local content="$4"

  [[ -z "$content" ]] && return 0

  local payload
  payload=$(
    cat <<EOF
{"type":"${type}","name":"${full_domain}","content":"${content}","ttl":120,"proxied":false}
EOF
  )

  if ! cf_api_request POST "https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records" "$payload" >/dev/null; then
    red "创建 Cloudflare ${type} 记录失败，请检查 Token 权限和 Zone 配置。" >&2
    return 1
  fi
}

create_cloudflare_dns_record() {
  local zone="$1"
  local subdomain="$2"
  local ipv4="$3"
  local ipv6="$4"
  local full_domain="${subdomain}.${zone}"
  local zone_id

  echo "==> 在 Cloudflare 中创建 DNS 记录" >&2
  echo "Zone: ${zone}" >&2
  echo "完整域名: ${full_domain}" >&2

  if ! zone_id="$(get_cf_zone_id "$zone")"; then
    red "调用 Cloudflare API 获取 Zone ID 失败，请检查网络和 Token 权限。" >&2
    return 1
  fi
  if [[ -z "$zone_id" ]]; then
    red "无法获取 Cloudflare Zone ID，请检查 Token 权限或 Zone 名称。" >&2
    return 1
  fi

  delete_existing_cf_dns_record "$zone_id" "$full_domain" "A" || true
  delete_existing_cf_dns_record "$zone_id" "$full_domain" "AAAA" || true

  if [[ -n "$ipv4" ]]; then
    create_cf_dns_record_type "$zone_id" "$full_domain" "A" "$ipv4" || return 1
    echo "已创建 A 记录 -> ${ipv4}" >&2
  fi

  if [[ -n "$ipv6" ]]; then
    create_cf_dns_record_type "$zone_id" "$full_domain" "AAAA" "$ipv6" || return 1
    echo "已创建 AAAA 记录 -> ${ipv6}" >&2
  fi

  if ! validate_domain "$full_domain"; then
    red "生成的域名格式无效：${full_domain}" >&2
    return 1
  fi

  printf '%s\n' "$full_domain"
}

backup_existing_config() {
  if [[ -f "${CONFIG_FILE}" ]]; then
    local backup_file="${CONFIG_FILE}.bak.$(date +%Y%m%d_%H%M%S)"
    cp -a "${CONFIG_FILE}" "${backup_file}"
    yellow "检测到已有配置，已备份到: ${backup_file}"
  fi
}

write_config() {
  local domain="$1"
  local email="$2"
  local cf_token="$3"
  local password="$4"
  local proxy_url="$5"
  local masked_token

  if ! validate_domain "$domain"; then
    red "域名无效，拒绝写入配置：${domain@Q}"
    exit 1
  fi

  masked_token="$(mask_secret "$cf_token")"

  echo
  blue "==> 即将写入如下配置到 ${CONFIG_FILE}"
  cat <<EOF
listen: :443

acme:
  domains:
    - ${domain}
  email: ${email}
  type: dns
  dns:
    name: cloudflare
    config:
      cloudflare_api_token: ${masked_token}

auth:
  type: password
  password: ${password}

masquerade:
  type: proxy
  proxy:
    url: ${proxy_url}
    rewriteHost: true
EOF
  echo

  if ! confirm_yn "是否确认写入配置文件？"; then
    red "已取消写入配置。"
    exit 1
  fi

  mkdir -p /etc/hysteria
  backup_existing_config

  cat > "${CONFIG_FILE}" <<EOF
listen: :443

acme:
  domains:
    - ${domain}
  email: ${email}
  type: dns
  dns:
    name: cloudflare
    config:
      cloudflare_api_token: ${cf_token}

auth:
  type: password
  password: ${password}

masquerade:
  type: proxy
  proxy:
    url: ${proxy_url}
    rewriteHost: true
EOF

  chown root:root "${CONFIG_FILE}"
  chmod 644 "${CONFIG_FILE}"
  green "配置已写入 ${CONFIG_FILE}"
}

start_service() {
  if ! confirm_yn "是否启动并设置 Hysteria 服务开机自启？"; then
    red "已取消启动服务。"
    exit 1
  fi

  blue "==> 启动并设置开机自启"
  systemctl daemon-reload || true
  systemctl enable --now "${SERVICE_NAME}"
  systemctl restart "${SERVICE_NAME}"
  green "服务已启动。"
}

show_result() {
  local domain="$1"
  local password="$2"
  local proxy_url="$3"
  local ip_info="$4"
  local ipv4="${ip_info%%|*}"
  local ipv6="${ip_info##*|}"

  local share_link="hysteria2://${password}@${domain}:443/?sni=${domain}&insecure=0"

  echo
  green "================= HY2 节点信息 ================="
  echo "域名: ${domain}"
  echo "端口: 443"
  echo "密码: ${password}"
  echo "伪装站点: ${proxy_url}"
  [[ -n "${ipv4}" ]] && echo "IPv4: ${ipv4}"
  [[ -n "${ipv6}" ]] && echo "IPv6: ${ipv6}"
  echo
  echo "代理链接:"
  echo "${share_link}"
  echo
  echo "hysteria 状态:"
  systemctl --no-pager --full status "${SERVICE_NAME}" || true
  echo
  echo "最近日志:"
  journalctl --no-pager -n 30 -u "${SERVICE_NAME}" || true
  echo "================================================"
}

main() {
  require_root

  if ! confirm_yn "本脚本将更新软件源、关闭现有防火墙、配置 UFW、安装并配置 Hysteria 2，是否继续？"; then
    red "用户取消执行。"
    exit 1
  fi

  apt_update_and_install_base

  require_cmd curl
  require_cmd sed
  require_cmd systemctl
  require_cmd ufw
  require_cmd openssl

  local email zone subdomain proxy_url password ip_info ipv4 ipv6 domain

  email="$(prompt_nonempty '请输入 ACME 邮箱: ')"
  zone="$(prompt_nonempty '请输入 Cloudflare Zone（例如 example.com）: ')"
  
  default_subdomain="$(random_subdomain_prefix)"
  read -r -p "请输入要创建的子域名前缀（例如 hy2，直接回车使用默认值 ${default_subdomain}）: " subdomain
  subdomain="${subdomain:-$default_subdomain}"
  subdomain="$(printf '%s' "$subdomain" | tr 'A-Z' 'a-z' | tr -cd 'a-z0-9-')"

  CF_API_TOKEN="$(prompt_nonempty '请输入 Cloudflare API Token: ')"
  export CF_API_TOKEN

  password="$(generate_password)"

  ip_info="$(get_server_ip)"
  ipv4="${ip_info%%|*}"
  ipv6="${ip_info##*|}"

  if [[ -z "$ipv4" && -z "$ipv6" ]]; then
    red "无法获取服务器公网 IP。"
    exit 1
  fi

  disable_existing_firewalls
  configure_ufw
  install_hysteria2
  run_domain_selector

  proxy_url="$(prompt_nonempty '请输入最终用于 masquerade 的完整 URL（例如 https://example.com/）: ')"

  if confirm_yn "是否在 Cloudflare 中自动创建 DNS 记录 ${subdomain}.${zone}？"; then
    if ! domain="$(create_cloudflare_dns_record "$zone" "$subdomain" "$ipv4" "$ipv6")"; then
      red "自动创建 Cloudflare DNS 记录失败，脚本已中止，未写入 Hysteria 配置。"
      exit 1
    fi
  else
    domain="$(prompt_nonempty '请输入已存在并已解析到本机的完整域名: ')"
  fi

  write_config "${domain}" "${email}" "${CF_API_TOKEN}" "${password}" "${proxy_url}"
  start_service
  show_result "${domain}" "${password}" "${proxy_url}" "${ip_info}"
}

main "$@"