#!/bin/bash
#
# Shadowsocks 2022 (shadowsocks-rust) 一键部署脚本
# 加密方式: 2022-blake3-chacha20-poly1305
# 适用系统: Debian 10/11/12/13 (x86_64 / aarch64)
#
# 用法: bash setup_ss2022.sh
#

set -e

# ========== 基本配置（按需修改） ==========
SS_PORT="10888"
SS_PASSWORD="0j4WwerVcCpZ4qVvmG3pC+8Z3JuNnFwWJnTGE6JcGko="
SS_METHOD="2022-blake3-chacha20-poly1305"
INSTALL_DIR="/usr/local/bin"
CONFIG_DIR="/etc/shadowsocks"
CONFIG_FILE="${CONFIG_DIR}/config.json"
SERVICE_FILE="/etc/systemd/system/shadowsocks.service"
# ==========================================

if [[ $EUID -ne 0 ]]; then
    echo "错误：请使用 root 权限运行此脚本 (sudo bash setup_ss2022.sh)"
    exit 1
fi

echo ">>> [1/7] 检测系统架构..."
ARCH=$(uname -m)
case "$ARCH" in
    x86_64)
        SS_ARCH="x86_64-unknown-linux-musl"
        ;;
    aarch64|arm64)
        SS_ARCH="aarch64-unknown-linux-musl"
        ;;
    *)
        echo "错误：不支持的架构 $ARCH"
        exit 1
        ;;
esac
echo "    架构: $ARCH -> $SS_ARCH"

echo ">>> [2/7] 安装依赖..."
apt update -y
apt install -y curl wget tar xz-utils

echo ">>> [3/7] 获取 shadowsocks-rust 最新版本号..."
LATEST_TAG=$(curl -s https://api.github.com/repos/shadowsocks/shadowsocks-rust/releases/latest | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
if [ -z "$LATEST_TAG" ]; then
    echo "错误：无法获取最新版本号，请检查网络（是否需要科学上网/是否被限速墙）"
    exit 1
fi
echo "    最新版本: $LATEST_TAG"

DOWNLOAD_URL="https://github.com/shadowsocks/shadowsocks-rust/releases/download/${LATEST_TAG}/shadowsocks-${LATEST_TAG}.${SS_ARCH}.tar.xz"
echo "    下载地址: $DOWNLOAD_URL"

echo ">>> [4/7] 下载并安装 ssserver..."
TMP_DIR=$(mktemp -d)
cd "$TMP_DIR"
curl -L -o ss.tar.xz "$DOWNLOAD_URL"
tar -xf ss.tar.xz
install -m 755 ssserver "${INSTALL_DIR}/ssserver"
# 顺带装上 sslocal / ssmanager / ssurl，方便以后调试
[ -f sslocal ] && install -m 755 sslocal "${INSTALL_DIR}/sslocal"
[ -f ssmanager ] && install -m 755 ssmanager "${INSTALL_DIR}/ssmanager"
[ -f ssurl ] && install -m 755 ssurl "${INSTALL_DIR}/ssurl"
cd /
rm -rf "$TMP_DIR"
echo "    ssserver 已安装到 ${INSTALL_DIR}/ssserver"
"${INSTALL_DIR}/ssserver" --version

echo ">>> [5/7] 生成配置文件..."
mkdir -p "$CONFIG_DIR"
cat > "$CONFIG_FILE" <<EOF
{
    "server": "0.0.0.0",
    "server_port": ${SS_PORT},
    "password": "${SS_PASSWORD}",
    "method": "${SS_METHOD}",
    "mode": "tcp_and_udp",
    "fast_open": true,
    "timeout": 300
}
EOF
echo "    配置文件已写入: $CONFIG_FILE"

echo ">>> [6/7] 创建 systemd 服务..."
cat > "$SERVICE_FILE" <<EOF
[Unit]
Description=Shadowsocks-rust Server Service (2022 edition)
After=network.target

[Service]
Type=simple
User=root
LimitNOFILE=51200
ExecStart=${INSTALL_DIR}/ssserver -c ${CONFIG_FILE}
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable shadowsocks
systemctl restart shadowsocks

echo ">>> [7/7] 配置防火墙（如已启用 ufw）..."
if command -v ufw >/dev/null 2>&1; then
    ufw allow ${SS_PORT}/tcp >/dev/null 2>&1 || true
    ufw allow ${SS_PORT}/udp >/dev/null 2>&1 || true
    echo "    已放行 TCP/UDP ${SS_PORT} 端口（ufw）"
else
    echo "    未检测到 ufw，请确认云服务商安全组/防火墙已放行 TCP+UDP ${SS_PORT} 端口"
fi

sleep 1
echo ""
echo "================= 部署完成 ================="
systemctl status shadowsocks --no-pager -l | head -n 10
echo "=============================================="
echo ""
echo "服务器地址   : $(curl -s -4 ifconfig.me 2>/dev/null || echo '获取失败，请手动查看服务器公网IP')"
echo "端口         : ${SS_PORT}"
echo "密码         : ${SS_PASSWORD}"
echo "加密方式     : ${SS_METHOD}"
echo ""
echo "常用命令："
echo "  查看状态: systemctl status shadowsocks"
echo "  查看日志: journalctl -u shadowsocks -f"
echo "  重启服务: systemctl restart shadowsocks"
echo "  停止服务: systemctl stop shadowsocks"
echo "=============================================="