#!/bin/bash
# ============================================================
# VLESS + Reality 直连一键部署脚本（固定配置版）
# 专为 Debian 系统优化，无需域名/证书/Nginx，无任何交互
# ============================================================

set -e

# 自检：去除 Windows CRLF 换行符
if grep -qP '\r' "$0" 2>/dev/null; then
    sed -i 's/\r//' "$0"
    exec bash "$0" "$@"
fi

# ============================================================
# 固定配置（不可交互修改）
# ============================================================
UUID="0ad7d003-8e79-4529-8b55-09610947c09b"
PORT="443"
SNI="www.apple.com"
PRIVATE_KEY="GChUVgk_xouCUW4Wg8l47wUNDFN2efIgOAcgLc5FH2A"
PUBLIC_KEY="YeWtGQDBCh6ewA8bL_hVhYO4Qc431m4SEXq5SptXG1A"
SHORT_ID="6b9fad38dff42e8e"

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
NC='\033[0m'

info()    { echo -e "${CYAN}[INFO]${NC} $1"; }
success() { echo -e "${GREEN}[OK]${NC} $1"; }
warning() { echo -e "${YELLOW}[!]${NC} $1"; }
error()   { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

# ============================================================
# 检查 root 权限
# ============================================================
check_root() {
    if [ "$EUID" -ne 0 ]; then
        error "请使用 root 用户运行此脚本"
    fi
}

# ============================================================
# 检查 Debian 系统
# ============================================================
check_debian() {
    if [ ! -f /etc/debian_version ]; then
        error "此脚本仅支持 Debian 系统"
    fi
    DEBIAN_VER=$(cat /etc/debian_version | cut -d. -f1)
    info "检测到 Debian 版本：$(cat /etc/debian_version)"
}

print_banner() {
    clear
    echo -e "${CYAN}"
    echo "======================================================"
    echo "    VLESS + Reality 直连一键部署脚本（固定配置版）"
    echo "======================================================"
    echo -e "${NC}"
}

# ============================================================
# 修复 APT 源（兼容 Debian 11/12）
# ============================================================
fix_apt_sources() {
    echo ""
    info "检查并修复 APT 源..."

    DEBIAN_VER=$(cat /etc/debian_version | cut -d. -f1)

    if [ "$DEBIAN_VER" = "11" ]; then
        warning "检测到 Debian 11，修复 backports 源..."
        sed -i 's|deb.debian.org/debian bullseye-backports|archive.debian.org/debian bullseye-backports|g' \
            /etc/apt/sources.list 2>/dev/null || true
        if ls /etc/apt/sources.list.d/*.list >/dev/null 2>&1; then
            sed -i '/bullseye-backports/s/^/#/' /etc/apt/sources.list.d/*.list 2>/dev/null || true
        fi
        success "Debian 11 源修复完成"
    elif [ "$DEBIAN_VER" = "12" ]; then
        success "Debian 12 源正常，无需修复"
    else
        info "Debian 版本：$DEBIAN_VER，跳过源修复"
    fi
}

# ============================================================
# 安装依赖
# ============================================================
install_deps() {
    echo ""
    echo -e "${CYAN}------------------------------------------------------${NC}"
    info "更新系统并安装依赖..."

    rm -f /var/lib/dpkg/lock-frontend
    rm -f /var/lib/apt/lists/lock

    apt-get update -qq
    apt-get install -y -qq \
        curl \
        wget \
        openssl

    success "依赖安装完成"
}

# ============================================================
# 安装 sing-box
# ============================================================
install_singbox() {
    echo ""
    echo -e "${CYAN}------------------------------------------------------${NC}"
    info "安装 sing-box..."

    if command -v sing-box >/dev/null 2>&1; then
        success "sing-box 已安装：$(sing-box version | head -1)"
        return
    fi

    ARCH=$(uname -m)
    case "$ARCH" in
        x86_64)  SB_ARCH="amd64" ;;
        aarch64) SB_ARCH="arm64" ;;
        armv7l)  SB_ARCH="armv7" ;;
        *)       SB_ARCH="amd64" ;;
    esac

    SB_VER=$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
        | grep '"tag_name"' | cut -d'"' -f4 | sed 's/^v//')

    if [ -z "$SB_VER" ]; then
        error "无法获取 sing-box 最新版本，请检查网络连接"
    fi

    info "下载 sing-box v${SB_VER} (${SB_ARCH})..."
    DEB_URL="https://github.com/SagerNet/sing-box/releases/download/v${SB_VER}/sing-box_${SB_VER}_linux_${SB_ARCH}.deb"
    TMP_DEB="/tmp/sing-box.deb"

    if ! curl -fsSL -o "$TMP_DEB" "$DEB_URL"; then
        error "sing-box 下载失败，请检查网络或手动安装"
    fi

    dpkg -i "$TMP_DEB"
    rm -f "$TMP_DEB"

    if command -v sing-box >/dev/null 2>&1; then
        success "sing-box 安装成功：$(sing-box version | head -1)"
    else
        error "sing-box 安装失败，请检查网络连接"
    fi
}

# ============================================================
# 配置 sing-box（使用固定配置）
# ============================================================
configure_singbox() {
    echo ""
    echo -e "${CYAN}------------------------------------------------------${NC}"
    info "配置 sing-box..."

    mkdir -p /etc/sing-box

    cat > /etc/sing-box/config.json << EOF
{
  "log": {
    "level": "error",
    "timestamp": true
  },
  "inbounds": [
    {
      "type": "vless",
      "tag": "vless-in",
      "listen": "::",
      "listen_port": ${PORT},
      "users": [
        {
          "uuid": "${UUID}",
          "flow": "xtls-rprx-vision"
        }
      ],
      "tls": {
        "enabled": true,
        "server_name": "${SNI}",
        "reality": {
          "enabled": true,
          "handshake": {
            "server": "${SNI}",
            "server_port": 443
          },
          "private_key": "${PRIVATE_KEY}",
          "short_id": [
            "${SHORT_ID}"
          ]
        }
      }
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    }
  ]
}
EOF

    success "sing-box 配置文件已生成：/etc/sing-box/config.json"

    info "校验配置文件..."
    if sing-box check -c /etc/sing-box/config.json; then
        success "配置文件校验通过"
    else
        error "配置文件校验失败，请检查 /etc/sing-box/config.json"
    fi
}

# ============================================================
# 启动 sing-box 服务
# ============================================================
start_singbox() {
    echo ""
    echo -e "${CYAN}------------------------------------------------------${NC}"
    info "启动 sing-box 服务..."

    systemctl enable sing-box >/dev/null 2>&1 || true
    systemctl restart sing-box

    sleep 2

    if systemctl is-active --quiet sing-box; then
        success "sing-box 启动成功 ✓"
    else
        error "sing-box 启动失败：$(systemctl status sing-box --no-pager | tail -10)"
    fi
}

# ============================================================
# 最终验证
# ============================================================
verify_services() {
    echo ""
    echo -e "${CYAN}------------------------------------------------------${NC}"
    info "验证服务状态..."

    if systemctl is-active --quiet sing-box; then
        success "sing-box 运行中 ✓"
    else
        warning "sing-box 未运行"
    fi

    if ss -tlnp | grep -q ":${PORT}"; then
        success "端口 ${PORT} 监听正常 ✓"
    else
        warning "端口 ${PORT} 未监听，请检查配置"
    fi
}

# ============================================================
# 打印最终结果
# ============================================================
print_result() {
    SERVER_IP=$(curl -s --max-time 5 https://api.ipify.org || curl -s --max-time 5 https://ifconfig.me || echo "你的服务器IP")

    VLESS_LINK="vless://${UUID}@${SERVER_IP}:${PORT}?encryption=none&flow=xtls-rprx-vision&security=reality&sni=${SNI}&fp=chrome&pbk=${PUBLIC_KEY}&sid=${SHORT_ID}&type=tcp&headerType=none#VLESS-Reality"

    echo ""
    echo -e "${GREEN}"
    echo "======================================================"
    echo "                  部署完成！"
    echo "======================================================"
    echo -e "${NC}"

    echo -e "${CYAN}------------------------------------------------------${NC}"
    echo -e "${GREEN}客户端配置参数：${NC}"
    echo ""
    echo "  协议：          VLESS"
    echo "  地址：          $SERVER_IP"
    echo "  端口：          $PORT"
    echo "  UUID：          $UUID"
    echo "  Flow：          xtls-rprx-vision"
    echo "  传输方式：      TCP"
    echo "  安全类型：      Reality"
    echo "  SNI：           $SNI"
    echo "  指纹：          chrome"
    echo "  Public Key：    $PUBLIC_KEY"
    echo "  Short ID：      $SHORT_ID"
    echo ""
    echo -e "${CYAN}------------------------------------------------------${NC}"
    echo -e "${YELLOW}VLESS 链接（可直接导入客户端）：${NC}"
    echo ""
    echo "$VLESS_LINK"
    echo ""
    echo -e "${CYAN}------------------------------------------------------${NC}"
    echo -e "${YELLOW}常用管理命令：${NC}"
    echo "  查看 sing-box 状态：  systemctl status sing-box"
    echo "  查看 sing-box 日志：  journalctl -u sing-box -f"
    echo "  重启 sing-box：       systemctl restart sing-box"
    echo "  配置文件位置：        /etc/sing-box/config.json"
    echo ""

    CONFIG_FILE="/root/vless-reality-config.txt"
    cat > "$CONFIG_FILE" << EOF
VLESS + Reality 直连配置（固定配置版）
生成时间：$(date)
系统：Debian $(cat /etc/debian_version)

服务器 IP：      $SERVER_IP
端口：          $PORT
UUID：          $UUID
Flow：          xtls-rprx-vision
传输方式：      TCP
安全类型：      Reality
SNI：           $SNI
指纹：          chrome
Public Key：    $PUBLIC_KEY
Private Key：   $PRIVATE_KEY
Short ID：      $SHORT_ID

VLESS 链接：
$VLESS_LINK

配置文件路径：
  sing-box:  /etc/sing-box/config.json
EOF
    success "配置已保存至 $CONFIG_FILE"
}

# ============================================================
# 主流程（全自动，无任何交互）
# ============================================================
main() {
    check_root
    print_banner
    check_debian
    fix_apt_sources
    install_deps
    install_singbox
    configure_singbox
    start_singbox
    verify_services
    print_result
}

main