#!/bin/bash
# ═══════════════════════════════════════════════════════════
# 🔒 铸渊主权服务器 · SSL证书自动化配置
# ═══════════════════════════════════════════════════════════
#
# 编号: ZY-SVR-SSL-001
# 守护: 铸渊 · ICE-GL-ZY001
# 版权: 国作登字-2026-A-00037559
#
# 功能:
#   使用 Let's Encrypt (certbot) 自动获取免费SSL证书
#   自动配置 Nginx HTTPS
#   自动设置证书续期
#
# 用法:
#   sudo bash setup-ssl.sh <域名> [邮箱]
#   sudo bash setup-ssl.sh guanghulab.online admin@guanghulab.online
#   sudo bash setup-ssl.sh --all   # 配置所有已知域名
#
# 前提条件:
#   1. 域名已解析到本服务器IP
#   2. Nginx已安装并运行
#   3. 80端口可从外网访问
# ═══════════════════════════════════════════════════════════

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

log_info()  { echo -e "${GREEN}[铸渊SSL]${NC} $1"; }
log_warn()  { echo -e "${YELLOW}[铸渊SSL]${NC} ⚠️  $1"; }
log_error() { echo -e "${RED}[铸渊SSL]${NC} ❌ $1"; }
log_step()  { echo -e "${BLUE}[铸渊SSL]${NC} 📌 $1"; }

# ── 配置 ──────────────────────────────────────
ZY_ROOT="/opt/zhuyuan"
SSL_DIR="${ZY_ROOT}/config/ssl"
NGINX_CONF_DIR="${ZY_ROOT}/config/nginx"
NGINX_SITES_AVAILABLE="/etc/nginx/sites-available"
NGINX_SITES_ENABLED="/etc/nginx/sites-enabled"
LOG_FILE="${ZY_ROOT}/data/logs/ssl-setup.log"

# ── 检查root权限 ─────────────────────────────
if [ "$(id -u)" -ne 0 ]; then
    log_error "需要root权限运行此脚本"
    log_info "请使用: sudo bash $0 $*"
    exit 1
fi

# ── 确保目录存在 ─────────────────────────────
mkdir -p "$SSL_DIR" "$NGINX_CONF_DIR" "$(dirname $LOG_FILE)"

# ── 记录日志 ─────────────────────────────────
exec > >(tee -a "$LOG_FILE") 2>&1
echo ""
echo "═══════════════════════════════════════════════"
echo "🔒 SSL配置开始 · $(TZ=Asia/Shanghai date '+%Y-%m-%d %H:%M:%S CST')"
echo "═══════════════════════════════════════════════"

# ── §1 安装 certbot ──────────────────────────
install_certbot() {
    log_step "§1 安装 certbot..."

    if command -v certbot &> /dev/null; then
        CERTBOT_VER=$(certbot --version 2>&1 | head -1)
        log_info "certbot 已安装: $CERTBOT_VER"
        return 0
    fi

    log_info "安装 certbot 和 nginx 插件..."

    # 更新包列表
    apt-get update -qq

    # 安装 certbot + nginx 插件
    apt-get install -y -qq certbot python3-certbot-nginx

    if command -v certbot &> /dev/null; then
        log_info "✅ certbot 安装成功"
    else
        log_error "certbot 安装失败"
        exit 1
    fi
}

# ── §2 验证域名解析 ──────────────────────────
verify_domain() {
    local domain="$1"
    log_step "§2 验证域名解析: $domain"

    # 获取本机公网IP
    local server_ip
    server_ip=$(curl -sf --max-time 5 https://api.ipify.org 2>/dev/null || curl -sf --max-time 5 https://ifconfig.me 2>/dev/null || echo "unknown")
    log_info "本机公网IP: $server_ip"

    # 解析域名
    local domain_ip
    domain_ip=$(dig +short "$domain" 2>/dev/null | tail -1)

    if [ -z "$domain_ip" ]; then
        log_error "域名 $domain 无法解析"
        log_warn "请确认域名DNS已配置指向本服务器IP: $server_ip"
        return 1
    fi

    log_info "域名 $domain 解析到: $domain_ip"

    if [ "$domain_ip" = "$server_ip" ]; then
        log_info "✅ 域名解析正确 · 指向本机"
        return 0
    else
        log_warn "域名解析IP ($domain_ip) 与本机IP ($server_ip) 不一致"
        log_warn "如果使用CDN或负载均衡，这可能是正常的"
        # 不阻断，让certbot验证决定
        return 0
    fi
}

# ── §3 获取SSL证书 ───────────────────────────
obtain_certificate() {
    local domain="$1"
    local email="${2:-admin@${domain}}"

    log_step "§3 获取SSL证书: $domain"

    # 检查是否已有有效证书
    if [ -f "/etc/letsencrypt/live/${domain}/fullchain.pem" ]; then
        local expiry
        expiry=$(openssl x509 -enddate -noout -in "/etc/letsencrypt/live/${domain}/fullchain.pem" 2>/dev/null | cut -d= -f2)
        log_info "已有证书，过期时间: $expiry"

        # 检查是否即将过期（30天内）
        if openssl x509 -checkend 2592000 -noout -in "/etc/letsencrypt/live/${domain}/fullchain.pem" 2>/dev/null; then
            log_info "✅ 证书仍然有效，跳过获取"
            return 0
        else
            log_warn "证书即将过期，续期中..."
        fi
    fi

    log_info "使用 Let's Encrypt 获取免费SSL证书..."
    log_info "域名: $domain"
    log_info "邮箱: $email"

    # 确保80端口的Nginx正在运行（certbot需要HTTP验证）
    if ! systemctl is-active --quiet nginx; then
        log_warn "Nginx未运行，启动中..."
        systemctl start nginx
    fi

    # 使用 certonly 模式 + nginx 插件进行验证
    # certonly 只获取证书不修改Nginx配置，铸渊自己管理Nginx SSL配置
    certbot certonly \
        --nginx \
        --non-interactive \
        --agree-tos \
        --email "$email" \
        --domain "$domain" \
        2>&1

    if [ $? -eq 0 ]; then
        log_info "✅ SSL证书获取成功: $domain"

        # 创建符号链接到铸渊标准路径
        ln -sf "/etc/letsencrypt/live/${domain}/fullchain.pem" "${SSL_DIR}/${domain}-fullchain.pem"
        ln -sf "/etc/letsencrypt/live/${domain}/privkey.pem" "${SSL_DIR}/${domain}-privkey.pem"
        log_info "证书链接已创建: ${SSL_DIR}/"

        return 0
    else
        log_error "SSL证书获取失败"
        log_warn ""
        log_warn "常见原因:"
        log_warn "  1. 域名未正确解析到本服务器"
        log_warn "  2. 服务器80端口未开放（检查防火墙/安全组）"
        log_warn "  3. Let's Encrypt 速率限制（每小时最多5次失败）"
        log_warn ""
        log_warn "排查步骤:"
        log_warn "  ping $domain  # 确认域名解析"
        log_warn "  curl -I http://$domain  # 确认HTTP可访问"
        log_warn "  sudo ufw status  # 检查防火墙"
        return 1
    fi
}

# ── §4 配置Nginx SSL ─────────────────────────
# ⚠️ 架构说明 (Reality反探测优先):
#   Xray 监听 443 (外部) · VLESS+Reality协议
#   dest回落到 www.microsoft.com:443 (反探测伪装·不可改为内部端口)
#   Nginx SSL 监听 8443 (外部直接访问) · 独立HTTPS服务
#
#   如果Xray未安装 → Nginx直接监听443 (标准HTTPS)
#   如果Xray已安装 → Nginx监听8443 (避免端口冲突)
configure_nginx_ssl() {
    local domain="$1"
    local cert_path="/etc/letsencrypt/live/${domain}"

    log_step "§4 配置Nginx HTTPS: $domain"

    if [ ! -f "${cert_path}/fullchain.pem" ]; then
        log_error "证书文件不存在: ${cert_path}/fullchain.pem"
        return 1
    fi

    # 读取当前Nginx配置
    local nginx_conf="${NGINX_CONF_DIR}/zhuyuan-sovereign.conf"
    if [ ! -f "$nginx_conf" ]; then
        nginx_conf="${NGINX_SITES_AVAILABLE}/zhuyuan.conf"
    fi

    if [ ! -f "$nginx_conf" ]; then
        log_error "Nginx配置文件未找到"
        return 1
    fi

    # 确定这是哪个域名（主站还是预览站）
    local site_mode="preview"
    local api_port="3801"
    if echo "$domain" | grep -q "hololake"; then
        site_mode="production"
        api_port="3800"
    fi

    # 确定SSL监听端口: Xray在443时用8443，否则用443
    local ssl_listen_port="443"
    local ssl_listen_addr=""
    if command -v xray &>/dev/null; then
        ssl_listen_port="8443"
        ssl_listen_addr=""
        log_info "检测到Xray已安装 · Nginx SSL使用端口8443 (避免与VPN冲突)"
        log_info "网站HTTPS: https://${domain}:8443"
        # 开放8443端口
        ufw allow 8443/tcp comment "Nginx SSL (Xray共存)" 2>/dev/null || true
    else
        log_info "Xray未安装 · Nginx SSL使用标准端口443"
        log_info "网站HTTPS: https://${domain}"
    fi

    log_info "站点模式: $site_mode · API端口: $api_port · SSL端口: $ssl_listen_port"

    # 生成SSL server block
    local ssl_conf="${NGINX_CONF_DIR}/ssl-${domain}.conf"

    cat > "$ssl_conf" << SSLCONF
# ═══════════════════════════════════════════════
# 🔒 铸渊SSL配置 · ${domain}
# 自动生成于: $(TZ=Asia/Shanghai date '+%Y-%m-%d %H:%M CST')
# 证书来源: Let's Encrypt (certbot)
# 证书路径: ${cert_path}/
#
# SSL端口: ${ssl_listen_port}
# $([ "$ssl_listen_port" = "8443" ] && echo "⚠️ Xray占用443(VPN) · Nginx SSL在8443(直接访问)" || echo "标准HTTPS · 端口443")
# ═══════════════════════════════════════════════

# ─── HTTPS 服务 ───
server {
    listen ${ssl_listen_port} ssl http2;
    server_name ${domain};

    # ─── SSL证书 (Let's Encrypt) ───
    ssl_certificate ${cert_path}/fullchain.pem;
    ssl_certificate_key ${cert_path}/privkey.pem;

    # ─── SSL安全配置 ───
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # ─── 安全头 ───
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Server-Identity "ZY-SVR-002" always;
    add_header X-Site-Mode "${site_mode}" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # ─── 静态文件 ───
    root /opt/zhuyuan/sites/${site_mode};
    index index.html;

    location / {
        try_files \$uri \$uri/ /index.html;
    }

    # ─── API反向代理 ───
    location /api/ {
        proxy_pass http://127.0.0.1:${api_port};
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        proxy_set_header X-Site-Mode "${site_mode}";
        proxy_cache_bypass \$http_upgrade;
        proxy_read_timeout 86400;
    }

    # ─── AI聊天API (SSE流式) ───
    location /api/chat {
        proxy_pass http://127.0.0.1:3721/api/chat;
        proxy_http_version 1.1;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        chunked_transfer_encoding on;
        proxy_read_timeout 120s;
        proxy_send_timeout 60s;
    }

    # ─── Persona Studio API ───
    location /api/ps/ {
        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
        if (\$request_method = OPTIONS) { return 204; }
        proxy_pass http://127.0.0.1:3002/api/ps/;
        proxy_http_version 1.1;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_read_timeout 120s;
    }

    # ─── 铸渊专线订阅 ───
    location /api/proxy-sub/ {
        proxy_pass http://127.0.0.1:3802/;
        proxy_http_version 1.1;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }

    # ─── 健康探针 ───
    location = /health {
        proxy_pass http://127.0.0.1:${api_port}/api/health;
        proxy_set_header Host \$host;
    }

    # ─── 静态资源缓存 ───
    location /static/ {
        alias /opt/zhuyuan/sites/${site_mode}/static/;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }

    # ─── 错误页面 ───
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;

    # ─── 日志 ───
    access_log /opt/zhuyuan/data/logs/nginx-${site_mode}-ssl.log;
    error_log /opt/zhuyuan/data/logs/nginx-${site_mode}-ssl-error.log;
}

$([ "$ssl_listen_port" = "443" ] && cat << REDIR
# ─── HTTP → HTTPS 重定向 ───
server {
    listen 80;
    server_name ${domain};
    return 301 https://\\\$host\\\$request_uri;
}
REDIR
)
SSLCONF

    log_info "SSL配置已生成: $ssl_conf"

    # 安装到Nginx
    cp "$ssl_conf" "${NGINX_SITES_AVAILABLE}/ssl-${domain}.conf"
    ln -sf "${NGINX_SITES_AVAILABLE}/ssl-${domain}.conf" "${NGINX_SITES_ENABLED}/ssl-${domain}.conf"

    log_info "SSL配置已安装到Nginx"
    if [ "$ssl_listen_port" = "8443" ]; then
        log_info "  HTTPS: https://${domain}:8443 (直接访问)"
        log_info "  HTTP: http://${domain} (端口80·正常访问)"
        log_info "  VPN: Xray占用443 · dest→microsoft.com (反探测)"
    else
        log_info "  HTTPS: https://${domain} (标准端口443)"
        log_info "  HTTP重定向: 80 → https://${domain}"
    fi

    # 测试Nginx配置
    if nginx -t 2>&1; then
        log_info "✅ Nginx配置测试通过"
        systemctl reload nginx
        log_info "✅ Nginx已重新加载"
    else
        log_error "Nginx配置测试失败"
        # 回滚
        rm -f "${NGINX_SITES_ENABLED}/ssl-${domain}.conf"
        systemctl reload nginx
        return 1
    fi

    return 0
}

# ── §5 设置自动续期 ───────────────────────────
setup_auto_renewal() {
    log_step "§5 配置证书自动续期"

    # certbot安装时通常已配置systemd timer
    if systemctl is-enabled certbot.timer 2>/dev/null; then
        log_info "✅ certbot自动续期已启用"
    else
        # 手动启用
        systemctl enable certbot.timer 2>/dev/null || true
        systemctl start certbot.timer 2>/dev/null || true
        log_info "✅ certbot自动续期已配置"
    fi

    # 添加续期后自动reload nginx的hook
    local hook_dir="/etc/letsencrypt/renewal-hooks/post"
    mkdir -p "$hook_dir"
    cat > "${hook_dir}/reload-nginx.sh" << 'HOOK'
#!/bin/bash
# 铸渊SSL · 证书续期后自动重载Nginx
systemctl reload nginx
echo "[铸渊SSL] $(date) · 证书已续期 · Nginx已重载" >> /opt/zhuyuan/data/logs/ssl-renewal.log
HOOK
    chmod +x "${hook_dir}/reload-nginx.sh"
    log_info "✅ Nginx reload hook 已配置"

    # 测试续期（dry-run）
    log_info "测试续期功能..."
    certbot renew --dry-run 2>&1 | tail -3
}

# ── §6 验证HTTPS ─────────────────────────────
verify_https() {
    local domain="$1"
    log_step "§6 验证HTTPS: $domain"

    sleep 2  # 等待Nginx完全重载

    # 确定SSL端口
    local ssl_port="443"
    if command -v xray &>/dev/null; then
        ssl_port="8443"
    fi

    log_info "验证SSL端口: $ssl_port"

    # 检查SSL端口是否监听
    if ss -tlnp | grep -q ":${ssl_port} "; then
        log_info "✅ SSL端口 ${ssl_port}: 监听中"
    else
        log_warn "SSL端口 ${ssl_port} 未监听"
    fi

    # 使用curl测试HTTPS
    local test_url="https://${domain}/"
    if [ "$ssl_port" != "443" ]; then
        test_url="https://${domain}:${ssl_port}/"
    fi

    local response
    response=$(curl -sf -o /dev/null -w "%{http_code}" "$test_url" 2>/dev/null)

    if [ "$response" = "200" ] || [ "$response" = "301" ] || [ "$response" = "302" ]; then
        log_info "✅ HTTPS访问正常 · 状态码: $response"
        log_info "  → 访问: $test_url"
    else
        log_warn "HTTPS访问状态码: ${response:-无响应}"
        log_warn "  → 尝试访问: $test_url"
        log_warn "  → 可能需要等待DNS传播"
    fi

    # 检查证书信息
    echo | openssl s_client -servername "$domain" -connect "${domain}:${ssl_port}" 2>/dev/null | \
        openssl x509 -noout -subject -issuer -dates 2>/dev/null || true

    # 如果是标准443端口，测试HTTP→HTTPS重定向
    if [ "$ssl_port" = "443" ]; then
        local redirect
        redirect=$(curl -sf -o /dev/null -w "%{redirect_url}" "http://${domain}/" 2>/dev/null)
        if echo "$redirect" | grep -q "https"; then
            log_info "✅ HTTP→HTTPS重定向正常"
        else
            log_warn "HTTP→HTTPS重定向未生效 (可能需要等待DNS)"
        fi
    else
        log_info "ℹ️ Xray占用443端口，HTTP不会重定向到HTTPS"
        log_info "  → 网站HTTP访问: http://${domain} (端口80)"
        log_info "  → 网站HTTPS访问: https://${domain}:${ssl_port}"
        log_info "  → VPN: 通过Xray端口443正常工作"
    fi
}

# ── 主逻辑 ────────────────────────────────────
main() {
    local domain="$1"
    local email="${2:-}"

    echo ""
    echo "═══════════════════════════════════════════════"
    echo "🔒 铸渊SSL证书自动化配置"
    echo "═══════════════════════════════════════════════"
    echo ""

    if [ "$domain" = "--all" ]; then
        # 配置所有已知域名
        log_info "配置所有域名..."

        # 从Nginx配置中提取域名
        local domains=()
        if [ -f "${NGINX_SITES_AVAILABLE}/zhuyuan.conf" ]; then
            while IFS= read -r d; do
                # 跳过占位符和IP
                if [[ "$d" != *"PLACEHOLDER"* ]] && [[ "$d" != *"_"* ]] && [[ "$d" =~ \. ]]; then
                    domains+=("$d")
                fi
            done < <(grep "server_name" "${NGINX_SITES_AVAILABLE}/zhuyuan.conf" | awk '{for(i=2;i<=NF;i++) print $i}' | tr -d ';')
        fi

        if [ ${#domains[@]} -eq 0 ]; then
            log_error "未找到已配置的域名"
            log_warn "请指定域名: sudo bash $0 guanghulab.online"
            exit 1
        fi

        for d in "${domains[@]}"; do
            log_info "────────────────────────────"
            log_info "处理域名: $d"
            log_info "────────────────────────────"
            process_domain "$d" "$email"
            echo ""
        done
    elif [ -z "$domain" ]; then
        echo "用法:"
        echo "  sudo bash $0 <域名> [邮箱]"
        echo ""
        echo "示例:"
        echo "  sudo bash $0 guanghulab.online"
        echo "  sudo bash $0 guanghulab.online admin@guanghulab.online"
        echo "  sudo bash $0 --all    # 配置所有已知域名"
        echo ""
        echo "说明:"
        echo "  使用 Let's Encrypt 免费SSL证书"
        echo "  自动获取、配置、续期"
        echo "  证书有效期90天，自动续期"
        exit 0
    else
        process_domain "$domain" "$email"
    fi

    echo ""
    echo "═══════════════════════════════════════════════"
    echo "🔒 SSL配置完成 · $(TZ=Asia/Shanghai date '+%Y-%m-%d %H:%M:%S CST')"
    echo "═══════════════════════════════════════════════"
}

process_domain() {
    local domain="$1"
    local email="${2:-admin@${domain}}"

    # §1 安装certbot
    install_certbot

    # §2 验证域名
    verify_domain "$domain" || {
        log_error "域名验证失败，但仍尝试获取证书..."
    }

    # §3 获取证书
    obtain_certificate "$domain" "$email" || {
        log_error "获取证书失败: $domain"
        return 1
    }

    # §4 配置Nginx
    configure_nginx_ssl "$domain" || {
        log_error "Nginx SSL配置失败: $domain"
        return 1
    }

    # §5 自动续期
    setup_auto_renewal

    # §6 验证
    verify_https "$domain"

    log_info ""
    log_info "🎉 $domain SSL配置完成!"
    log_info ""
    log_info "证书文件:"
    log_info "  完整链: /etc/letsencrypt/live/${domain}/fullchain.pem"
    log_info "  私钥:   /etc/letsencrypt/live/${domain}/privkey.pem"
    log_info ""
    log_info "访问: https://${domain}"
}

main "$@"