#!/usr/bin/env bash
# =============================================================================
# Squid Manager - 一键部署脚本
# =============================================================================
# 功能：
#   1. 安装系统依赖 (squid, python3, pip, gcc 等)
#   2. 创建 Python 虚拟环境并安装 pip 依赖
#   3. 初始化数据库 & 默认管理员
#   4. 生成 gunicorn + systemd 服务文件并启动
#   5. 配置 squid (放行 localnet + 基本安全设置)
#
# 用法：
#   bash deploy.sh              # 全自动部署 (默认 /opt/squid-manager)
#   INSTALL_DIR=/opt/sm bash deploy.sh   # 自定义安装目录
#   bash deploy.sh --no-squid   # 不安装/配置 squid
#   bash deploy.sh --no-start   # 不启动服务 (仅生成文件)
# =============================================================================
set -euo pipefail

# ---- 配置 -------------------------------------------------------------------
INSTALL_DIR="${INSTALL_DIR:-/opt/squid-manager}"
SERVICE_NAME="${SERVICE_NAME:-squid-manager}"
GUNICORN_HOST="${SQUIDMGR_HOST:-0.0.0.0}"
GUNICORN_PORT="${SQUIDMGR_PORT:-5200}"
GUNICORN_WORKERS="${SQUIDMGR_WORKERS:-2}"
ADMIN_USER="${ADMIN_USER:-admin}"
ADMIN_PASS="${ADMIN_PASS:-admin123}"

INSTALL_SQUID=true
START_SERVICE=true
SKIP_EXISTING=false  # 若服务已存在是否跳过

for arg in "$@"; do
    case "$arg" in
        --no-squid)   INSTALL_SQUID=false ;;
        --no-start)   START_SERVICE=false ;;
        --skip-existing) SKIP_EXISTING=true ;;
        -h|--help)
            sed -n '2,20p' "$0"
            exit 0
            ;;
        *)
            echo "未知参数: $arg" >&2; exit 1 ;;
    esac
done

# ---- 工具函数 ---------------------------------------------------------------
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
info()  { echo -e "${GREEN}[INFO]${NC} $*"; }
warn()  { echo -e "${YELLOW}[WARN]${NC} $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }

_generate_minimal_squid_conf() {
    # 生成一份最小可用的 Squid 5.x 配置
    local out="$1"
    cat > "$out" << 'SQUIDEOF'
# Minimal Squid 5.x configuration — generated by Squid Manager deploy.sh
# 可通过 Web UI (/config/raw) 继续编辑和扩展。

http_port 3128
icp_port 3130

# Cache
cache_mem 256 MB
maximum_object_size 4096 KB
cache_dir ufs /var/spool/squid 100 16 256

# ACLs
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10
acl Safe_ports port 80 443 21 70 210 1025-65535
acl SSL_ports port 443 563
acl CONNECT method CONNECT

# Refresh patterns
refresh_pattern ^ftp:       1440    20%     10080
refresh_pattern ^gopher:    1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .           0       20%     4320

# Access rules
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow localnet
http_access deny all

# Logging
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log

# Misc
coredump_dir /var/spool/squid
visible_hostname squid-manager
SQUIDEOF
}

must_run_as_root() {
    if [[ $EUID -ne 0 ]]; then
        error "此脚本必须以 root 运行 (sudo $0)"
        exit 1
    fi
}

detect_os() {
    if [[ -f /etc/os-release ]]; then
        . /etc/os-release
        OS_ID="$ID"
        OS_VER="$VERSION_ID"
    elif command -v apt-get &>/dev/null; then
        OS_ID="debian"
    elif command -v yum &>/dev/null; then
        OS_ID="centos"
    else
        error "无法识别操作系统"
        exit 1
    fi
    info "操作系统: $OS_ID $OS_VER"
}

pkg_install() {
    info "安装系统包: $*"
    case "$OS_ID" in
        debian|ubuntu)
            export DEBIAN_FRONTEND=noninteractive
            apt-get update -qq
            apt-get install -y -qq "$@"
            ;;
        centos|rhel|rocky|almalinux|ol)
            yum install -y -q "$@"
            ;;
        *)
            error "不支持的包管理器: $OS_ID"
            exit 1
            ;;
    esac
}

# ---- 1. 前置检查 ------------------------------------------------------------
must_run_as_root
detect_os

info "安装目录: $INSTALL_DIR"
info "服务名:   $SERVICE_NAME"
info "监听:     $GUNICORN_HOST:$GUNICORN_PORT"

# ---- 2. 安装系统依赖 --------------------------------------------------------
SYS_PACKAGES=(
    python3 python3-pip python3-venv python3-dev
    gcc libffi-dev libssl-dev
    curl
)

if $INSTALL_SQUID; then
    SYS_PACKAGES+=(squid squidclient)
fi

pkg_install "${SYS_PACKAGES[@]}"

# 确保 python3 / pip3 可用
PYTHON_BIN="$(command -v python3)"
PIP_BIN="$(command -v pip3 || command -v pip)"
info "Python: $PYTHON_BIN"
info "Pip:    $PIP_BIN"

# ---- 3. 部署项目文件 --------------------------------------------------------
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

if [[ "$SCRIPT_DIR" != "$INSTALL_DIR" ]]; then
    if [[ -d "$INSTALL_DIR" ]] && $SKIP_EXISTING; then
        warn "安装目录已存在且 --skip-existing，跳过文件复制"
    else
        info "复制项目文件到 $INSTALL_DIR"
        mkdir -p "$INSTALL_DIR"
        # 复制源码（排除 .git / instance / backups 等运行时目录）
        rsync -a --delete \
            --exclude='.git/' \
            --exclude='__pycache__/' \
            --exclude='*.pyc' \
            --exclude='instance/*.db' \
            --exclude='backups/' \
            --exclude='uploads/' \
            --exclude='ssl_certs/*.pem' \
            --exclude='.env' \
            "$SCRIPT_DIR/" "$INSTALL_DIR/"
    fi
fi

cd "$INSTALL_DIR"

# 确保运行时目录存在
mkdir -p instance backups uploads ssl_certs
chmod 700 instance ssl_certs

# ---- 4. 创建虚拟环境 + 安装 pip 依赖 ----------------------------------------
VENV_DIR="$INSTALL_DIR/.venv"

if [[ -d "$VENV_DIR" ]] && $SKIP_EXISTING; then
    warn "虚拟环境已存在且 --skip-existing，跳过依赖安装"
else
    info "创建 Python 虚拟环境: $VENV_DIR"
    $PYTHON_BIN -m venv "$VENV_DIR"

    info "升级 pip + 安装 Python 依赖"
    "$VENV_DIR/bin/pip" install --upgrade pip setuptools wheel
    "$VENV_DIR/bin/pip" install -r requirements.txt
fi

PYTHON="$VENV_DIR/bin/python"
GUNICORN="$VENV_DIR/bin/gunicorn"

# ---- 5. 生成 .env 配置 ------------------------------------------------------
ENV_FILE="$INSTALL_DIR/.env"
if [[ ! -f "$ENV_FILE" ]] || ! $SKIP_EXISTING; then
    info "生成 .env 配置文件"
    SECRET_KEY="$($PYTHON -c "import secrets; print(secrets.token_urlsafe(48))")"
    cat > "$ENV_FILE" <<EOF
# Squid Manager - 自动生成于 $(date -Iseconds)
SECRET_KEY=$SECRET_KEY
SQUIDMGR_HOST=$GUNICORN_HOST
SQUIDMGR_PORT=$GUNICORN_PORT
SQUIDMGR_WORKERS=$GUNICORN_WORKERS
SQUIDMGR_TIMEOUT=120
EOF
    chmod 600 "$ENV_FILE"
fi

# ---- 6. 初始化数据库 & 默认管理员 ------------------------------------------
info "初始化数据库"
$PYTHON -c "
import os, sys
os.environ.setdefault('SECRET_KEY', 'deploy-init')
sys.path.insert(0, '$INSTALL_DIR')
from wsgi import app, db
from app import User
with app.app_context():
    db.create_all()
    # 种子管理员
    u = User.query.filter_by(username='$ADMIN_USER').first()
    if u is None:
        u = User(username='$ADMIN_USER', role='admin')
        u.set_password('$ADMIN_PASS')
        db.session.add(u)
        db.session.commit()
        print(f'[init] 创建管理员: $ADMIN_USER / $ADMIN_PASS')
    else:
        u.set_password('$ADMIN_PASS')
        db.session.commit()
        print(f'[init] 管理员密码已更新: $ADMIN_USER')
"

# ---- 7. 配置 Squid (如果需要) ----------------------------------------------
if $INSTALL_SQUID; then
    SQUID_CONF="/etc/squid/squid.conf"

    # 如果现有配置无法通过语法校验（升级后废弃指令等），用最小可用配置兜底
    if [[ -f "$SQUID_CONF" ]]; then
        if ! squid -k parse -f "$SQUID_CONF" &>/dev/null; then
            warn "现有 squid.conf 语法校验失败，备份后用最小可用配置替换"
            cp "$SQUID_CONF" "${SQUID_CONF}.broken.$(date +%s)"
            _generate_minimal_squid_conf "$SQUID_CONF"
        fi
    else
        info "squid.conf 不存在，生成最小可用配置"
        mkdir -p "$(dirname "$SQUID_CONF")"
        _generate_minimal_squid_conf "$SQUID_CONF"
    fi

    if [[ -f "$SQUID_CONF" ]]; then
        info "配置 Squid"

        # 备份原始配置
        if [[ ! -f "${SQUID_CONF}.orig" ]]; then
            cp "$SQUID_CONF" "${SQUID_CONF}.orig"
            info "已备份原始配置到 ${SQUID_CONF}.orig"
        fi

        # 放行内网 (localnet)
        # 1) 确保 localnet ACL 存在
        if grep -qE '^acl[[:space:]]+localnet' "$SQUID_CONF"; then
            info "localnet ACL 已存在"
        else
            _localnet_def="acl localnet src 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10"
            # 找到第一个 http_access 行之前插入
            if grep -n '^http_access' "$SQUID_CONF" | head -1 | cut -d: -f1 >/dev/null; then
                _insert_line=$(grep -n '^http_access' "$SQUID_CONF" | head -1 | cut -d: -f1)
                sed -i "${_insert_line}i${_localnet_def}" "$SQUID_CONF"
            else
                echo "$_localnet_def" >> "$SQUID_CONF"
            fi
            info "已添加 localnet ACL 定义"
        fi

        # 2) 确保 http_access allow localnet 在 deny all 之前
        if grep -q '^http_access allow localnet' "$SQUID_CONF"; then
            info "http_access allow localnet 已存在"
        else
            if grep -q '^http_access deny all' "$SQUID_CONF"; then
                sed -i '/^http_access deny all/i http_access allow localnet' "$SQUID_CONF"
            else
                echo "http_access allow localnet" >> "$SQUID_CONF"
                echo "http_access deny all" >> "$SQUID_CONF"
            fi
            info "已添加 http_access allow localnet"
        fi

        # 3) 处理注释掉的老配置
        if grep -q '^# http_access allow localnet' "$SQUID_CONF"; then
            sed -i 's/^# http_access allow localnet/http_access allow localnet/' "$SQUID_CONF"
        fi

        # visible_hostname
        if ! grep -q '^visible_hostname' "$SQUID_CONF"; then
            echo "visible_hostname $(hostname -f 2>/dev/null || hostname)" >> "$SQUID_CONF"
        fi

        # 语法校验
        if squid -k parse -f "$SQUID_CONF" &>/dev/null; then
            info "Squid 配置语法校验通过"
        else
            warn "Squid 配置语法校验有警告，请检查 squid -k parse 输出"
            squid -k parse -f "$SQUID_CONF" 2>&1 | tail -10
        fi

        # 初始化缓存目录 (首次启动需要 squid -z)
        if [[ ! -d /var/spool/squid/00 ]]; then
            info "初始化 Squid 缓存目录"
            squid -z 2>/dev/null || true
            chown -R proxy:proxy /var/spool/squid 2>/dev/null || true
        fi

        # 启动 squid 服务
        if command -v systemctl &>/dev/null; then
            systemctl enable --now squid 2>/dev/null || {
                warn "squid 服务启动失败，请手动检查 (systemctl status squid)"
            }
            if systemctl is-active --quiet squid; then
                info "Squid 服务运行正常 ✓"
            fi
        fi
    else
        warn "未生成 squid.conf，跳过 squid 配置"
    fi
fi

# ---- 8. 生成 systemd 服务文件 ----------------------------------------------
SERVICE_FILE="/etc/systemd/system/${SERVICE_NAME}.service"

info "生成 systemd 服务文件: $SERVICE_FILE"
cat > "$SERVICE_FILE" <<EOF
[Unit]
Description=Squid Web Manager
After=network.target squid.service
Wants=squid.service

[Service]
Type=simple
User=root
Group=root
WorkingDirectory=$INSTALL_DIR
EnvironmentFile=$INSTALL_DIR/.env
ExecStart=$GUNICORN -c gunicorn_config.py wsgi:app
ExecReload=/bin/kill -s HUP \$MAINPID
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
# 安全加固
NoNewPrivileges=yes
ProtectSystem=full
ProtectHome=true
ReadWritePaths=$INSTALL_DIR /etc/squid /var/log/squid /var/spool/squid /run
PrivateTmp=yes

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable "$SERVICE_NAME"
info "systemd 服务已注册并设为开机自启"

# ---- 9. 启动服务 ------------------------------------------------------------
if $START_SERVICE; then
    info "启动 $SERVICE_NAME 服务"
    systemctl restart "$SERVICE_NAME"
    sleep 2

    if systemctl is-active --quiet "$SERVICE_NAME"; then
        info "$SERVICE_NAME 服务运行正常 ✓"
    else
        error "$SERVICE_NAME 服务启动失败！"
        echo "---------- journalctl 最后 30 行 ----------"
        journalctl -u "$SERVICE_NAME" --no-pager -n 30
        exit 1
    fi

    # 健康检查
    if curl -sf -o /dev/null "http://127.0.0.1:${GUNICORN_PORT}/login"; then
        info "HTTP 健康检查通过 ✓ (http://127.0.0.1:${GUNICORN_PORT}/login)"
    else
        warn "HTTP 健康检查失败，请检查防火墙或端口配置"
    fi
fi

# ---- 10. 输出汇总 -----------------------------------------------------------
echo ""
echo "================================================================"
echo "  Squid Manager 部署完成！"
echo "================================================================"
echo "  Web UI:     http://<服务器IP>:${GUNICORN_PORT}"
echo "  账号:       ${ADMIN_USER} / ${ADMIN_PASS}"
echo "  安装目录:   ${INSTALL_DIR}"
echo "  服务名:     ${SERVICE_NAME}"
echo "  配置文件:   ${INSTALL_DIR}/.env"
echo ""
echo "  常用命令:"
echo "    systemctl status $SERVICE_NAME    # 查看状态"
echo "    systemctl restart $SERVICE_NAME   # 重启服务"
echo "    journalctl -u $SERVICE_NAME -f    # 实时日志"
echo ""
echo "  ⚠️  请立即登录后修改默认密码！"
echo "================================================================"