#!/bin/bash
# ============================================================
#  VPS 优化一键清理脚本
#  还原 vps_optimize.sh 所做的所有修改
# ============================================================

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
CYAN='\033[0;36m'
BOLD='\033[1m'
NC='\033[0m'

info()    { echo -e "${CYAN}[INFO]${NC}  $1"; }
success() { echo -e "${GREEN}[OK]${NC}    $1"; }
warning() { echo -e "${YELLOW}[!]${NC}     $1"; }
error()   { echo -e "${RED}[ERR]${NC}   $1"; exit 1; }
step()    {
    echo -e "\n${BOLD}${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
    echo -e "${BOLD}${YELLOW}  $1${NC}"
    echo -e "${BOLD}${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
}

RESULTS=()
add_result() { RESULTS+=("$1"); }

check_root() {
    [[ $EUID -eq 0 ]] || error "请使用 root 用户运行"
}

print_banner() {
    clear
    echo -e "${RED}"
    echo "╔══════════════════════════════════════════════════════╗"
    echo "║       VPS 优化一键清理脚本                           ║"
    echo "║       还原 vps_optimize.sh 所做的所有修改            ║"
    echo "╚══════════════════════════════════════════════════════╝"
    echo -e "${NC}"
    echo -e "  ${YELLOW}${BOLD}警告: 此操作将还原所有优化配置，请确认后继续${NC}"
    echo ""
    read -rp "  确认清理? 输入 yes 继续，其他任意键退出: " confirm
    [[ "$confirm" == "yes" ]] || { echo "已取消"; exit 0; }
}

# ============================================================
# 1. 清理 BBR 和内核参数
# ============================================================
clean_sysctl() {
    step "🔧 清理内核参数"

    local files=(
        "/etc/sysctl.d/99-bbr.conf"
        "/etc/sysctl.d/99-vps-optimize.conf"
    )

    for f in "${files[@]}"; do
        if [[ -f "$f" ]]; then
            rm -f "$f"
            success "已删除: $f"
        else
            info "不存在，跳过: $f"
        fi
    done

    # 重新加载 sysctl（恢复系统默认）
    sysctl --system >/dev/null 2>&1 || true

    local current
    current=$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null || echo "unknown")
    info "当前拥塞算法: $current（已恢复系统默认）"

    add_result "✅ 内核参数: 已清理，重启后完全生效"
}

# ============================================================
# 2. 清理文件描述符
# ============================================================
clean_nofile() {
    step "📁 清理文件描述符"

    local f="/etc/security/limits.d/99-nofile.conf"
    if [[ -f "$f" ]]; then
        rm -f "$f"
        success "已删除: $f"
    else
        info "不存在，跳过: $f"
    fi

    # 清理 systemd override
    for svc in sing-box nginx xray; do
        local d="/etc/systemd/system/${svc}.service.d/limits.conf"
        if [[ -f "$d" ]]; then
            rm -f "$d"
            # 如果目录空了也删掉
            rmdir "/etc/systemd/system/${svc}.service.d" 2>/dev/null || true
            success "已删除 systemd override: ${svc}"
        fi
    done

    systemctl daemon-reload 2>/dev/null || true
    add_result "✅ 文件描述符: 已恢复系统默认"
}

# ============================================================
# 3. 清理 Nginx 相关
# ============================================================
clean_nginx() {
    step "🌐 清理 Nginx 配置"

    # 删除全局 snippet（如果残留）
    if [[ -f /etc/nginx/conf.d/99-optimize.conf ]]; then
        rm -f /etc/nginx/conf.d/99-optimize.conf
        success "已删除: /etc/nginx/conf.d/99-optimize.conf"
    else
        info "99-optimize.conf 不存在，跳过"
    fi

    # 还原 nginx 站点配置（从备份恢复）
    local nginx_conf
    nginx_conf=$(grep -rl "proxy_pass" /etc/nginx/sites-available/ 2>/dev/null | head -1 || true)

    if [[ -n "$nginx_conf" ]]; then
        # 找最新的备份
        local latest_bak
        latest_bak=$(ls -t "${nginx_conf}".bak.* 2>/dev/null | head -1 || true)

        if [[ -n "$latest_bak" ]]; then
            cp "$latest_bak" "$nginx_conf"
            success "已从备份还原: $latest_bak → $nginx_conf"

            # 删除所有备份
            rm -f "${nginx_conf}".bak.* 2>/dev/null || true
            success "已清理备份文件"
        else
            warning "未找到备份文件，nginx 站点配置未还原"
            warning "如需还原请手动处理: $nginx_conf"
        fi

        # 还原 nginx.conf worker 参数
        sed -i 's/worker_processes auto/worker_processes 1/' \
            /etc/nginx/nginx.conf 2>/dev/null || true
        sed -i '/events\s*{/,/}/{s/worker_connections 65535/worker_connections 768/}' \
            /etc/nginx/nginx.conf 2>/dev/null || true
        info "nginx.conf worker 参数已还原"
    else
        info "未找到反代配置，跳过"
    fi

    # 重启 nginx
    if command -v nginx &>/dev/null; then
        if nginx -t 2>/dev/null; then
            systemctl restart nginx 2>/dev/null || true
            success "nginx 已重启"
        else
            warning "nginx 配置测试失败，请手动检查"
        fi
    fi

    add_result "✅ Nginx: 已清理并重启"
}

# ============================================================
# 4. 清理 CF 白名单 / ufw 规则
# ============================================================
clean_ufw() {
    step "🛡️  清理 Cloudflare IP 白名单"

    if ! command -v ufw &>/dev/null; then
        info "ufw 未安装，跳过"
        add_result "⏭️  ufw: 未安装，跳过"
        return
    fi

    if ! ufw status 2>/dev/null | grep -q "Status: active"; then
        info "ufw 未启用，跳过"
        add_result "⏭️  ufw: 未启用，跳过"
        return
    fi

    # 删除所有 CF 相关规则
    info "删除 CF IP 白名单规则..."
    local deleted=0
    while true; do
        local num
        num=$(ufw status numbered 2>/dev/null | grep 'CF\|deny-direct' \
            | grep -oE '^\s*\[[0-9]+\]' | tr -d '[] ' | sort -rn | head -1 || true)
        [[ -z "$num" ]] && break
        ufw --force delete "$num" >/dev/null 2>&1 && (( deleted++ )) || break
    done

    success "已删除 ${deleted} 条 CF/deny-direct 规则"

    # 删除自动更新任务
    if [[ -f /etc/cron.d/update-cf-whitelist ]]; then
        rm -f /etc/cron.d/update-cf-whitelist
        success "已删除 cron 自动更新任务"
    fi

    if [[ -f /usr/local/bin/update-cf-whitelist.sh ]]; then
        rm -f /usr/local/bin/update-cf-whitelist.sh
        success "已删除更新脚本: /usr/local/bin/update-cf-whitelist.sh"
    fi

    ufw reload >/dev/null 2>&1 || true
    add_result "✅ CF 白名单: 已清理 ${deleted} 条规则"
}

# ============================================================
# 5. 清理 nexttrace（可选）
# ============================================================
clean_nexttrace() {
    step "🔍 清理 nexttrace（可选）"

    read -rp "  是否同时删除 nexttrace？(y/N): " input
    input="${input:-n}"

    if [[ "$input" =~ ^[Yy]$ ]]; then
        if [[ -f /usr/local/bin/nexttrace ]]; then
            rm -f /usr/local/bin/nexttrace
            success "已删除 nexttrace"
            add_result "✅ nexttrace: 已删除"
        else
            info "nexttrace 不存在，跳过"
            add_result "⏭️  nexttrace: 不存在"
        fi
    else
        info "跳过 nexttrace"
        add_result "⏭️  nexttrace: 保留"
    fi
}

# ============================================================
# 6. 最终报告
# ============================================================
print_report() {
    step "📋 清理完成报告"

    echo ""
    for r in "${RESULTS[@]}"; do echo -e "  $r"; done

    echo ""
    echo -e "  ${BOLD}当前服务状态:${NC}"
    for svc in nginx sing-box xray; do
        if systemctl list-unit-files 2>/dev/null | grep -q "^${svc}.service"; then
            if systemctl is-active --quiet "$svc" 2>/dev/null; then
                echo -e "    ${GREEN}✔${NC} ${svc} 运行中"
            else
                echo -e "    ${RED}✘${NC} ${svc} 未运行"
            fi
        fi
    done

    echo ""
    echo -e "  ${BOLD}内核验证:${NC}"
    echo -e "    拥塞算法 : ${GREEN}$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null)${NC}"
    echo -e "    队列算法 : ${GREEN}$(sysctl -n net.core.default_qdisc 2>/dev/null)${NC}"

    echo ""
    echo -e "  ${BOLD}ufw 状态:${NC}"
    ufw status 2>/dev/null | grep -v "^$" | sed 's/^/    /' | head -10 || true

    echo ""
    echo -e "  ${YELLOW}${BOLD}建议执行 reboot 使内核参数完全还原${NC}"
    echo ""
}

# ============================================================
# 主流程
# ============================================================
main() {
    check_root
    print_banner
    clean_sysctl
    clean_nofile
    clean_nginx
    clean_ufw
    clean_nexttrace
    print_report
}

main