#!/bin/bash



if [ "$EUID" -ne 0 ]; then
  echo "错误: 本脚本必须以 root 权限运行。"
  echo "请使用 'sudo ./脚本名.sh' 或切换到 root 用户后运行。"
  exit 1
fi

export PATH=$PATH:/usr/sbin:/usr/local/openresty/bin
INSTALL_PREFIX="/usr/local/openresty"
NGINX_CONF_DIR="${INSTALL_PREFIX}/nginx/conf"
CONFD_DIR="${NGINX_CONF_DIR}/conf.d"

set -e

/usr/local/bin/proxy-update

service xray restart

echo "=== [5/8] 写入 Nginx 配置文件 ==="

# 5.1 写入 nginx.conf
cat > "${NGINX_CONF_DIR}/nginx.conf" <<EOF
user  www-data;
worker_processes  auto;

error_log  logs/error.log;
error_log  logs/error.log  notice;
error_log  logs/error.log  info;

pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

include stream.conf;

http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '\$remote_addr - \$remote_user [\$time_local] "\$request" '
    #                  '\$status \$body_bytes_sent "\$http_referer" '
    #                  '"\$http_user_agent" "\$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    gzip  on;
    client_max_body_size  20m;
    server_tokens off;

    include ${CONFD_DIR}/*.conf;
}
EOF

# 5.2 写入 stream.conf (SNI 分流逻辑)
cat > "${NGINX_CONF_DIR}/stream.conf" <<EOF
stream {
    map \$ssl_preread_server_name \$backend_name {
        proxy.pabo.me    xray_direct;
        warp.pabo.me     xray_warp;
        default          nginx_web;
    }

    upstream xray_direct {
        server 127.0.0.1:19001;
    }

    upstream xray_warp {
        server 127.0.0.1:19002;
    }

    upstream nginx_web {
        server 127.0.0.1:4443;
    }

    server {
        listen 443 reuseport;
        listen [::]:443 reuseport;

        ssl_preread on;
        proxy_pass \$backend_name;
        proxy_protocol on;
    }
}
EOF

# 5.3 写入 default.conf (Web 站点配置)
# 注意：由于 stream 模块开启了 proxy_protocol，这里的内部监听必须加上 proxy_protocol 关键字，否则连接会断开
cat > "${CONFD_DIR}/default.conf" <<EOF
server {
    #listen 80 default_server;
    #listen [::]:80 default_server;
    listen 443 quic reuseport default_server;
    listen [::]:443 quic reuseport default_server;
    listen      127.0.0.1:4443 ssl default_server proxy_protocol;
    
    http2 on;
    ssl_protocols TLSv1.3 TLSv1.2;
    ssl_certificate      ${CONFD_DIR}/server.crt;
    ssl_certificate_key  ${CONFD_DIR}/server.key;

    set_real_ip_from 127.0.0.1;
    real_ip_header proxy_protocol;

    server_name _;
    return 410;
}
EOF

# 5.4 写入 fallback.conf (回落站点配置)
# 注意：由于 stream 模块开启了 proxy_protocol，这里的内部监听必须加上 proxy_protocol 关键字，否则连接会断开
cat > "${CONFD_DIR}/fallback.conf" <<EOF
server {
    listen      127.0.0.1:19000 proxy_protocol;
    
    http2 on;
    ssl_protocols TLSv1.3 TLSv1.2;
    ssl_certificate      /usr/local/etc/xray/cert.crt;
    ssl_certificate_key  /usr/local/etc/xray/cert.key;

    set_real_ip_from 127.0.0.1;
    real_ip_header proxy_protocol;

    server_name *.pabo.me;

    location / {
        return 404;
    }
}
EOF

systemctl restart openresty