#!/usr/bin/env bash
set -Eeuo pipefail

BASE_URL="https://files.shenqianqian.com"

BIN_URL="${BASE_URL}/n1/latest/n1agent-linux-arm64"
BIN_SHA_URL="${BASE_URL}/n1/latest/n1agent-linux-arm64.sha256"

CA_URL="${BASE_URL}/common/ca.crt"
CA_SHA_URL="${BASE_URL}/common/ca.crt.sha256"

INSTALL_BIN="/usr/local/bin/n1agent"
CONFIG_DIR="/etc/btcproxy-agent"
CONFIG_FILE="${CONFIG_DIR}/config.yaml"
ENV_FILE="${CONFIG_DIR}/agent.env"
CA_FILE="${CONFIG_DIR}/ca.crt"
STATE_DIR="/var/lib/btcproxy-agent"
SERVICE_FILE="/etc/systemd/system/n1agent.service"

TMP_DIR="$(mktemp -d)"

cleanup() {
    rm -rf "${TMP_DIR}"
}
trap cleanup EXIT

die() {
    echo
    echo "ERROR: $*" >&2
    exit 1
}

echo
echo "========================================"
echo " BTCProxy N1 商用版安装程序"
echo "========================================"
echo

# ------------------------------------------------------------
# 1. 基础检查
# ------------------------------------------------------------

if [ "$(id -u)" -ne 0 ]; then
    die "请使用 root 用户运行安装程序。"
fi

ARCH="$(uname -m)"

case "${ARCH}" in
    aarch64|arm64)
        ;;
    *)
        die "当前架构为 ${ARCH}，本安装包只支持 ARM64 N1。"
        ;;
esac

# 防止把“新安装脚本”误用到已经运行的 N1
if [ -e "${INSTALL_BIN}" ] || \
   [ -e "${CONFIG_FILE}" ] || \
   [ -e "${SERVICE_FILE}" ]; then

    echo "检测到这台机器已经存在 N1 安装："
    [ -e "${INSTALL_BIN}" ] && echo "  ${INSTALL_BIN}"
    [ -e "${CONFIG_FILE}" ] && echo "  ${CONFIG_FILE}"
    [ -e "${SERVICE_FILE}" ] && echo "  ${SERVICE_FILE}"

    echo
    die "为防止覆盖生产配置，本脚本只允许全新安装。升级请使用 upgrade-n1.sh。"
fi

# ------------------------------------------------------------
# 2. 输入敏感参数
# ------------------------------------------------------------

echo "请输入 N1 使用的 Tunnel Token。"
echo "输入内容不会显示在屏幕上。"
echo

read -r -s -p "BTCPROXY_TUNNEL_TOKEN: " TUNNEL_TOKEN </dev/tty
echo

if [ -z "${TUNNEL_TOKEN}" ]; then
    die "Tunnel Token 不能为空。"
fi

echo
echo "请输入 N1 Web 管理密码。"
echo "输入内容不会显示在屏幕上。"
echo

read -r -s -p "BTCPROXY_WEB_PASSWORD: " WEB_PASSWORD </dev/tty
echo

if [ -z "${WEB_PASSWORD}" ]; then
    die "Web Password 不能为空。"
fi

echo
read -r -s -p "请再次输入 Web Password: " WEB_PASSWORD_CONFIRM </dev/tty
echo

if [ "${WEB_PASSWORD}" != "${WEB_PASSWORD_CONFIRM}" ]; then
    die "两次输入的 Web Password 不一致。"
fi

unset WEB_PASSWORD_CONFIRM

# ------------------------------------------------------------
# 3. 安装系统依赖
# ------------------------------------------------------------

echo
echo "[1/8] 安装系统依赖..."

export DEBIAN_FRONTEND=noninteractive

apt-get update

apt-get install -y \
    curl \
    ca-certificates \
    network-manager \
    iproute2 \
    argon2

# ------------------------------------------------------------
# 4. 下载正式 N1 程序
# ------------------------------------------------------------

echo
echo "[2/8] 下载 N1 Agent..."

cd "${TMP_DIR}"

curl -fL \
    --retry 3 \
    --connect-timeout 15 \
    -o n1agent-linux-arm64 \
    "${BIN_URL}"

curl -fL \
    --retry 3 \
    --connect-timeout 15 \
    -o n1agent-linux-arm64.sha256 \
    "${BIN_SHA_URL}"

echo
echo "校验 N1 Agent SHA256..."

sha256sum -c n1agent-linux-arm64.sha256 \
    || die "N1 Agent SHA256 校验失败。"

# ------------------------------------------------------------
# 5. 下载 CA
# ------------------------------------------------------------

echo
echo "[3/8] 下载 CA 证书..."

curl -fL \
    --retry 3 \
    --connect-timeout 15 \
    -o ca.crt \
    "${CA_URL}"

curl -fL \
    --retry 3 \
    --connect-timeout 15 \
    -o ca.crt.sha256 \
    "${CA_SHA_URL}"

echo
echo "校验 CA SHA256..."

sha256sum -c ca.crt.sha256 \
    || die "CA SHA256 校验失败。"

# ------------------------------------------------------------
# 6. 创建目录并安装文件
# ------------------------------------------------------------

echo
echo "[4/8] 安装文件..."

install -d -m 0755 "${CONFIG_DIR}"
install -d -m 0755 "${STATE_DIR}"

install -m 0755 \
    "${TMP_DIR}/n1agent-linux-arm64" \
    "${INSTALL_BIN}"

install -m 0644 \
    "${TMP_DIR}/ca.crt" \
    "${CA_FILE}"

# ------------------------------------------------------------
# 7. 生成唯一 Client ID
# ------------------------------------------------------------

if [ -s /etc/machine-id ]; then
    MACHINE_ID="$(tr -d '\n' < /etc/machine-id)"
else
    MACHINE_ID="$(hostname)"
fi

SHORT_ID="$(printf '%s' "${MACHINE_ID}" | sha256sum | cut -c1-8)"
CLIENT_ID="site-${SHORT_ID}-n1"

# ------------------------------------------------------------
# 8. 创建默认配置
# ------------------------------------------------------------

echo
echo "[5/8] 创建默认 N1 配置..."

cat > "${CONFIG_FILE}" <<EOF
listen:
  address: "0.0.0.0:13666"

servers:
  - id: "vps-a"
    host: "vps-a.invalid"
    port: 443
    weight: 1
    enabled: true
    draining: false

  - id: "vps-b"
    host: "vps-b.invalid"
    port: 443
    weight: 1
    enabled: false
    draining: false

  - id: "vps-c"
    host: "vps-c.invalid"
    port: 443
    weight: 1
    enabled: false
    draining: false

web:
  enabled: true
  address: "0.0.0.0:8088"

tls:
  min_version: "1.3"
  ca_file: "/etc/btcproxy-agent/ca.crt"

auth:
  client_id: "${CLIENT_ID}"
  token: "\${BTCPROXY_TUNNEL_TOKEN}"

timeouts:
  dial: "5s"
  tls_handshake: "5s"
  auth: "5s"
  keepalive: "30s"
EOF

chmod 0644 "${CONFIG_FILE}"

# ------------------------------------------------------------
# 9. 创建 agent.env
# ------------------------------------------------------------

echo
echo "[6/8] 创建安全环境变量..."

escape_env_value() {
    printf '%s' "$1" | sed \
        -e 's/\\/\\\\/g' \
        -e 's/"/\\"/g'
}

SAFE_TUNNEL_TOKEN="$(escape_env_value "${TUNNEL_TOKEN}")"
SAFE_WEB_PASSWORD="$(escape_env_value "${WEB_PASSWORD}")"

umask 077

cat > "${ENV_FILE}" <<EOF
BTCPROXY_TUNNEL_TOKEN="${SAFE_TUNNEL_TOKEN}"
BTCPROXY_WEB_PASSWORD="${SAFE_WEB_PASSWORD}"
EOF

chmod 0600 "${ENV_FILE}"

unset TUNNEL_TOKEN
unset WEB_PASSWORD
unset SAFE_TUNNEL_TOKEN
unset SAFE_WEB_PASSWORD

# ------------------------------------------------------------
# 10. 创建 systemd 服务
# ------------------------------------------------------------

echo
echo "[7/8] 创建 systemd 服务..."

cat > "${SERVICE_FILE}" <<'EOF'
[Unit]
Description=BTCProxy N1 Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
EnvironmentFile=/etc/btcproxy-agent/agent.env
ExecStart=/usr/local/bin/n1agent -config /etc/btcproxy-agent/config.yaml

Restart=always
RestartSec=3

LimitNOFILE=65535

[Install]
WantedBy=multi-user.target
EOF

chmod 0644 "${SERVICE_FILE}"

systemctl daemon-reload

# ------------------------------------------------------------
# 11. 确保 NetworkManager / nmcli 可用
# ------------------------------------------------------------

echo
echo "[8/8] 检查 NetworkManager..."

systemctl enable NetworkManager >/dev/null 2>&1 || true

if ! systemctl is-active --quiet NetworkManager; then
    echo
    echo "NetworkManager 当前未运行。"
    echo "正在启动 NetworkManager..."

    systemctl start NetworkManager || \
        die "NetworkManager 启动失败。"
fi

command -v nmcli >/dev/null 2>&1 \
    || die "没有找到 nmcli。"

# ------------------------------------------------------------
# 12. 启动 N1
# ------------------------------------------------------------

systemctl enable n1agent >/dev/null
systemctl start n1agent

sleep 2

if ! systemctl is-active --quiet n1agent; then
    echo
    echo "N1 Agent 启动失败。最近日志："
    journalctl -u n1agent -n 50 --no-pager
    die "N1 Agent 未成功启动。"
fi

# ------------------------------------------------------------
# 13. 最终检查
# ------------------------------------------------------------

echo
echo "检查监听端口..."

ss -lntp | grep -E ':(13666|8088)[[:space:]]' || true

LAN_IP="$(
    ip -4 route get 1.1.1.1 2>/dev/null \
    | awk '{for(i=1;i<=NF;i++) if($i=="src") {print $(i+1); exit}}'
)"

echo
echo "========================================"
echo " N1 安装成功"
echo "========================================"
echo
echo "程序：      ${INSTALL_BIN}"
echo "配置：      ${CONFIG_FILE}"
echo "环境变量：  ${ENV_FILE}"
echo "CA：        ${CA_FILE}"
echo "服务：      n1agent"
echo
echo "Miner Port: 13666"
echo "Web Port:   8088"
echo "Client ID:  ${CLIENT_ID}"
echo

if [ -n "${LAN_IP}" ]; then
    echo "管理页面："
    echo "http://${LAN_IP}:8088/"
else
    echo "管理页面："
    echo "http://N1的局域网IP:8088/"
fi

echo
echo "下一步："
echo "1. 浏览器进入 N1 Web 页面"
echo "2. 设置 Site / Client ID"
echo "3. 设置 VPS 域名和端口"
echo "4. 在 Web 的网络设置中修改 IP / 网关 / DNS"
echo
echo "注意："
echo "网络参数保存后，N1 的 IP 可能立即变化。"
echo "届时请使用新的 IP 地址重新访问 Web 页面。"
echo
echo "安装完成。"