#!/bin/bash
# ==============================================================================
# OpenResty 全自动编译与配置脚本
# 包含：源码编译、证书生成、Systemd服务、SNI分流配置
# ==============================================================================
if [ "$EUID" -ne 0 ]; then
  echo "错误: 本脚本必须以 root 权限运行。"
  echo "请使用 'sudo ./脚本名.sh' 或切换到 root 用户后运行。"
  exit 1
fi

export PATH=$PATH:/usr/sbin:/usr/local/openresty/bin

# --- 1. 变量定义 (严格遵循指定版本) ---
OPENRESTY_VERSION="1.27.1.2"
OPENSSL_VERSION="3.6.0"
INSTALL_PREFIX="/usr/local/openresty"
NGINX_CONF_DIR="${INSTALL_PREFIX}/nginx/conf"
CONFD_DIR="${NGINX_CONF_DIR}/conf.d"

# 设置遇到错误立即停止
set -e

# 获取 CPU 核心数
JOBS=$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)

echo "安装配置xray"
bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install --install-user root || true
curl -L "https://r2.lishichen.cn/proxy-update-$(dpkg --print-architecture)" -o /usr/local/bin/proxy-update || true
chmod +x /usr/local/bin/proxy-update || true
/usr/local/bin/proxy-update || true
crontab -l 2>/dev/null | grep -q '/usr/local/bin/proxy-update' || \
( crontab -l 2>/dev/null; echo "*/15 * * * * /usr/local/bin/proxy-update" ) | crontab -

echo "=== [1/8] 环境检查与依赖安装 ==="
if [ -f /etc/debian_version ]; then
    apt-get update -y
    apt-get install -y build-essential libpcre2-dev zlib1g-dev curl make
elif [ -f /etc/redhat-release ]; then
    yum install -y gcc gcc-c++ pcre pcre-devel zlib zlib-devel make curl
else
    echo "未识别的操作系统，请手动确保安装了 gcc, make, pcre, zlib, curl"
fi

# 创建 www-data 用户 (如果不存在)
if ! id -u www-data >/dev/null 2>&1; then
    echo "创建 www-data 用户..."
    groupadd www-data || true
    useradd -M -s /usr/sbin/nologin -g www-data www-data || true
fi

echo "=== [2/8] 准备源码 (工作目录: 用户主目录) ==="
# 在用户主目录(~)下创建临时目录
WORK_DIR=$(mktemp -d -p "$HOME" -t openresty_build.XXXXXX)
echo "临时工作目录: ${WORK_DIR}"
cd "${WORK_DIR}"

# 下载
echo "下载 OpenResty ${OPENRESTY_VERSION}..."
curl -fL --retry 5 -O "https://openresty.org/download/openresty-${OPENRESTY_VERSION}.tar.gz"
echo "下载 OpenSSL ${OPENSSL_VERSION}..."
curl -fL --retry 5 -O "https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz"

# 解压
tar -zxvf "openresty-${OPENRESTY_VERSION}.tar.gz" > /dev/null
tar -zxvf "openssl-${OPENSSL_VERSION}.tar.gz" > /dev/null
rm *.tar.gz

echo "=== [3/8] 编译与安装 ==="
cd "openresty-${OPENRESTY_VERSION}"

./configure \
    --with-http_ssl_module \
    --with-http_v2_module \
    --with-http_v3_module \
    --with-http_realip_module \
    --with-http_sub_module \
    --with-stream \
    --with-stream_ssl_module \
    --with-stream_ssl_preread_module \
    --with-openssl="../openssl-${OPENSSL_VERSION}" \
    -j"${JOBS}"

# 编译
if command -v gmake >/dev/null; then
    gmake -j"${JOBS}" && gmake install
else
    make -j"${JOBS}" && make install
fi

if [ ! -e /etc/nginx ]; then
    ln -s /usr/local/openresty/nginx/conf /etc/nginx
    echo "已创建 /etc/nginx -> /usr/local/openresty/nginx/conf"
fi

echo "=== [4/8] 生成 SSL 证书 ==="
mkdir -p "${CONFD_DIR}"
# 使用指定的 openssl 命令生成证书
openssl req -newkey rsa:4096 -x509 -sha256 -days 3650 -nodes \
    -subj "/C=US/ST=NULL/L=NULL/O=NULL/OU=NULL/CN=NULL/emailAddress=NULL@example.com" \
    -out "${CONFD_DIR}/server.crt" \
    -keyout "${CONFD_DIR}/server.key"

# 赋予 www-data 读取权限
chown -R www-data:www-data "${NGINX_CONF_DIR}"
chmod 644 "${CONFD_DIR}/server.key"

echo "=== [5/8] 写入 Nginx 配置文件 ==="

# 5.1 写入 nginx.conf
cat > "${NGINX_CONF_DIR}/nginx.conf" <<EOF
user  www-data;
worker_processes  auto;

error_log  logs/error.log;
error_log  logs/error.log  notice;
error_log  logs/error.log  info;

pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

include stream.conf;

http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '\$remote_addr - \$remote_user [\$time_local] "\$request" '
    #                  '\$status \$body_bytes_sent "\$http_referer" '
    #                  '"\$http_user_agent" "\$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    gzip  on;
    client_max_body_size  20m;
    server_tokens off;

    include ${CONFD_DIR}/*.conf;
}
EOF

# 5.2 写入 stream.conf (SNI 分流逻辑)
cat > "${NGINX_CONF_DIR}/stream.conf" <<EOF
stream {
    map \$ssl_preread_server_name \$backend_name {
        proxy.pabo.me    xray_direct;
        warp.pabo.me     xray_warp;
        default          nginx_web;
    }

    upstream xray_direct {
        server 127.0.0.1:19001;
    }

    upstream xray_warp {
        server 127.0.0.1:19002;
    }

    upstream nginx_web {
        server 127.0.0.1:4443;
    }

    server {
        listen 443 reuseport;
        listen [::]:443 reuseport;

        ssl_preread on;
        proxy_pass \$backend_name;
        proxy_protocol on;
    }
}
EOF

# 5.3 写入 default.conf (Web 站点配置)
# 注意：由于 stream 模块开启了 proxy_protocol，这里的内部监听必须加上 proxy_protocol 关键字，否则连接会断开
cat > "${CONFD_DIR}/default.conf" <<EOF
server {
    #listen 80 default_server;
    #listen [::]:80 default_server;
    listen 443 quic reuseport default_server;
    listen [::]:443 quic reuseport default_server;
    listen      127.0.0.1:4443 ssl default_server proxy_protocol;
    
    http2 on;
    ssl_protocols TLSv1.3 TLSv1.2;
    ssl_certificate      ${CONFD_DIR}/server.crt;
    ssl_certificate_key  ${CONFD_DIR}/server.key;

    set_real_ip_from 127.0.0.1;
    real_ip_header proxy_protocol;

    server_name _;
    return 410;
}
EOF

# 5.4 写入 fallback.conf (回落站点配置)
# 注意：由于 stream 模块开启了 proxy_protocol，这里的内部监听必须加上 proxy_protocol 关键字，否则连接会断开
cat > "${CONFD_DIR}/fallback.conf" <<EOF
server {
    listen      127.0.0.1:19000 proxy_protocol;
    
    http2 on;
    ssl_protocols TLSv1.3 TLSv1.2;
    ssl_certificate      /usr/local/etc/xray/cert.crt;
    ssl_certificate_key  /usr/local/etc/xray/cert.key;

    set_real_ip_from 127.0.0.1;
    real_ip_header proxy_protocol;

    server_name *.pabo.me;

    location / {
        return 404;
    }
}
EOF

echo "=== [6/8] 创建 Systemd 服务文件 ==="
cat > /etc/systemd/system/openresty.service <<EOF
[Unit]
Description=The NGINX HTTP and reverse proxy server with lua
After=syslog.target network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target

[Service]
Type=forking
ExecStartPre=${INSTALL_PREFIX}/bin/openresty -t
ExecStart=${INSTALL_PREFIX}/bin/openresty
ExecReload=${INSTALL_PREFIX}/bin/openresty -s reload
ExecStop=/bin/kill -s QUIT \$MAINPID
PrivateTmp=true

[Install]
WantedBy=multi-user.target
EOF

# 重载 systemd
systemctl daemon-reload

echo "=== [7/8] 清理与启动 ==="
# 清理构建文件
cd ~
rm -rf "${WORK_DIR}"
echo "清理了临时目录: ${WORK_DIR}"

# 检查配置
echo "正在检查配置语法..."
${INSTALL_PREFIX}/bin/openresty -t

# 启动服务
echo "启动 OpenResty..."
systemctl enable openresty
systemctl restart openresty

echo "=== [8/8] 全部完成 ==="
systemctl status openresty --no-pager

if [ ! -f /usr/bin/warp ]; then
    echo "安装 warp"
    curl -fL --retry 5 -o /usr/bin/warp "https://gitlab.com/fscarmen/warp/-/raw/main/menu.sh"
    chmod +x /usr/bin/warp
else
    echo "warp 已存在，跳过安装"
fi