#!/bin/bash
# ============================================================
#  VPS 一键优化脚本
#  适用: Debian 12 + VLESS + WS + TLS + Cloudflare CDN
#  功能: BBR / 内核参数 / 文件描述符 / Nginx / CF IP 白名单
# ============================================================

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
CYAN='\033[0;36m'
BOLD='\033[1m'
NC='\033[0m'

info()    { echo -e "${CYAN}[INFO]${NC}  $1"; }
success() { echo -e "${GREEN}[OK]${NC}    $1"; }
warning() { echo -e "${YELLOW}[!]${NC}     $1"; }
error()   { echo -e "${RED}[ERR]${NC}   $1"; exit 1; }
step()    {
    echo -e "\n${BOLD}${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
    echo -e "${BOLD}${YELLOW}  $1${NC}"
    echo -e "${BOLD}${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
}

RESULTS=()
add_result() { RESULTS+=("$1"); }

check_root() {
    [[ $EUID -eq 0 ]] || error "请使用 root 用户运行: sudo bash vps_optimize.sh"
}

check_debian() {
    [[ -f /etc/debian_version ]] || error "此脚本仅支持 Debian / Ubuntu 系统"
    info "系统: $(lsb_release -d 2>/dev/null | cut -f2 || echo Debian)"
    info "内核: $(uname -r)"
}

print_banner() {
    clear
    echo -e "${CYAN}"
    echo "╔══════════════════════════════════════════════════════╗"
    echo "║       VPS 一键优化脚本                               ║"
    echo "║       VLESS + WS + TLS + Cloudflare CDN             ║"
    echo "╚══════════════════════════════════════════════════════╝"
    echo -e "${NC}"
}

# ── 默认值 ────────────────────────────────────────────────────
NGINX_PORT="2053"
WS_PATH="/stickrouter"
DOMAIN=""

detect_and_collect() {
    step "🔍 检测现有配置"

    local nginx_conf=""
    if [[ -d /etc/nginx/sites-enabled ]]; then
        nginx_conf=$(grep -rl "proxy_pass" /etc/nginx/sites-enabled/ 2>/dev/null | head -1 || true)
    fi

    if [[ -n "$nginx_conf" ]]; then
        local dp dd dpath
        dp=$(grep -E 'listen\s+[0-9]+\s+ssl' "$nginx_conf" 2>/dev/null | grep -oE '[0-9]{2,5}' | head -1 || true)
        dd=$(grep 'server_name' "$nginx_conf" 2>/dev/null | awk '{print $2}' | tr -d ';' | head -1 || true)
        dpath=$(grep -E 'location\s+/' "$nginx_conf" 2>/dev/null | awk '{print $2}' | head -1 || true)
        [[ -n "$dp"    ]] && NGINX_PORT="$dp"
        [[ -n "$dd"    ]] && DOMAIN="$dd"
        [[ -n "$dpath" ]] && WS_PATH="$dpath"
        info "从 nginx 配置读取到:"
        info "  端口: $NGINX_PORT  路径: $WS_PATH  域名: ${DOMAIN:-未检测到}"
    else
        if ! command -v nginx &>/dev/null; then
            warning "nginx 尚未安装 —— Nginx 优化步骤将跳过"
            warning "建议先运行 vless-ws-tls-setup.sh，部署完再跑本脚本"
            warning "本次将完成: BBR / 内核参数 / 文件描述符 / 时间同步"
        else
            warning "nginx 已安装但无反代配置，Nginx 优化将跳过"
        fi
    fi

    step "⚙️  配置参数确认"
    local input

    read -rp "  Nginx 对外端口  [当前: ${NGINX_PORT}，回车确认]: " input
    [[ -n "$input" ]] && NGINX_PORT="$input"

    read -rp "  WS 路径         [当前: ${WS_PATH}，回车确认]: " input
    [[ -n "$input" ]] && WS_PATH="$input"

    read -rp "  域名            [当前: ${DOMAIN:-空}，回车确认]: " input
    [[ -n "$input" ]] && DOMAIN="$input"

    echo ""
    echo -e "  ${BOLD}最终配置:${NC}"
    echo -e "    端口: ${GREEN}${NGINX_PORT}${NC}   路径: ${GREEN}${WS_PATH}${NC}   域名: ${GREEN}${DOMAIN:-未填}${NC}"
    echo ""
    read -rp "  按 Enter 开始优化，输入 n 重新填写: " input
    [[ "${input:-y}" =~ ^[Nn]$ ]] && detect_and_collect
}

optimize_bbr() {
    step "🚀 BBR 拥塞控制"
    local current
    current=$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null || echo "unknown")
    info "当前拥塞算法: $current"

    modprobe tcp_bbr 2>/dev/null || true

    if ! sysctl net.ipv4.tcp_available_congestion_control 2>/dev/null | grep -q bbr; then
        warning "内核不支持 BBR，跳过"
        add_result "❌ BBR: 内核不支持"
        return
    fi

    cat > /etc/sysctl.d/99-bbr.conf << 'EOF'
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
EOF
    sysctl -p /etc/sysctl.d/99-bbr.conf >/dev/null 2>&1 || true

    local after
    after=$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null || echo "unknown")
    if [[ "$after" == "bbr" ]]; then
        success "BBR 已启用 ✓"
        add_result "✅ BBR: 已启用"
    else
        warning "BBR 配置已写入，重启后生效"
        add_result "⚠️  BBR: 重启后生效"
    fi
}

optimize_sysctl() {
    step "🔧 内核网络参数调优"

    cat > /etc/sysctl.d/99-vps-optimize.conf << 'EOF'
# 缓冲区（WebSocket 长连接）
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864
net.ipv4.tcp_rmem = 4096 87380 67108864
net.ipv4.tcp_wmem = 4096 65536 67108864
net.core.netdev_max_backlog = 250000
# 连接队列
net.core.somaxconn = 32768
net.ipv4.tcp_max_syn_backlog = 16384
# TIME_WAIT
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_max_tw_buckets = 5000
# WebSocket 保活
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_keepalive_probes = 3
# 其他
net.ipv4.tcp_fastopen = 3
net.ipv4.tcp_mtu_probing = 1
net.ipv4.ip_local_port_range = 10000 65535
EOF
    sysctl -p /etc/sysctl.d/99-vps-optimize.conf >/dev/null 2>&1 && \
        success "内核参数写入完成" || warning "部分参数应用失败"
    add_result "✅ 内核参数: 已优化"
}

optimize_nofile() {
    step "📁 文件描述符"

    cat > /etc/security/limits.d/99-nofile.conf << 'EOF'
* soft nofile 65535
* hard nofile 65535
root soft nofile 65535
root hard nofile 65535
EOF
    success "limits.d 写入完成"

    for svc in sing-box nginx xray; do
        if systemctl list-unit-files 2>/dev/null | grep -q "^${svc}.service"; then
            local d="/etc/systemd/system/${svc}.service.d"
            mkdir -p "$d"
            printf '[Service]\nLimitNOFILE=65535\n' > "${d}/limits.conf"
            success "systemd override: ${svc}"
        fi
    done

    systemctl daemon-reload 2>/dev/null || true
    ulimit -n 65535 2>/dev/null || true
    add_result "✅ 文件描述符: 65535"
}

optimize_nginx() {
    step "🌐 Nginx 配置优化"

    if ! command -v nginx &>/dev/null; then
        warning "nginx 未安装，跳过"
        add_result "⏭️  Nginx: 未安装，已跳过"
        return
    fi

    local nginx_conf
    nginx_conf=$(grep -rl "proxy_pass" /etc/nginx/sites-available/ 2>/dev/null | head -1 || true)

    if [[ -z "$nginx_conf" ]]; then
        warning "未找到反代站点配置，跳过"
        add_result "⏭️  Nginx: 无反代配置，已跳过"
        return
    fi

    info "目标配置: $nginx_conf"
    local backup="${nginx_conf}.bak.$(date +%Y%m%d%H%M%S)"
    cp "$nginx_conf" "$backup"
    info "已备份: $backup"

    sed -i 's/worker_processes\s\+[0-9]\+/worker_processes auto/' /etc/nginx/nginx.conf 2>/dev/null || true
    sed -i '/events\s*{/,/}/{s/worker_connections\s\+[0-9]\+/worker_connections 65535/}' /etc/nginx/nginx.conf 2>/dev/null || true


    # Python 精确修改站点配置
    python3 - "$nginx_conf" "$WS_PATH" << 'PYEOF'
import sys, re
conf_path, ws_path = sys.argv[1], sys.argv[2]
with open(conf_path) as f:
    content = f.read()

content = re.sub(r'ssl_protocols\s+[^;]+;', 'ssl_protocols TLSv1.2 TLSv1.3;', content)
content = re.sub(r'ssl_ciphers\s+[^;]+;',
    'ssl_ciphers TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;', content)
content = re.sub(r'ssl_prefer_server_ciphers\s+\w+;', 'ssl_prefer_server_ciphers off;', content)
for pat, rep in [
    (r'ssl_session_cache\s+[^;]+;',   'ssl_session_cache shared:SSL:20m;'),
    (r'ssl_session_timeout\s+[^;]+;', 'ssl_session_timeout 1d;'),
]:
    content = re.sub(pat, rep, content)
if 'ssl_session_tickets' not in content:
    content = re.sub(r'(ssl_session_timeout\s+[^;]+;)',
        r'\1\n    ssl_session_tickets off;\n    ssl_buffer_size 4k;', content)

def patch_ws(m):
    b = m.group(0)
    for pat, rep in [
        (r'proxy_read_timeout\s+[^;]+;',    'proxy_read_timeout 600s;'),
        (r'proxy_send_timeout\s+[^;]+;',    'proxy_send_timeout 600s;'),
        (r'proxy_connect_timeout\s+[^;]+;', 'proxy_connect_timeout 10s;'),
    ]:
        b = re.sub(pat, rep, b) if re.search(pat, b) else \
            b.replace('proxy_buffering off;', 'proxy_buffering off;\n        ' + rep)
    if 'tcp_nodelay' not in b:
        b = b.replace('proxy_buffering off;', 'proxy_buffering off;\n        tcp_nodelay on;')
    return b

content = re.sub(r'location\s+' + re.escape(ws_path) + r'\s*\{[^}]+\}',
    patch_ws, content, flags=re.DOTALL)
with open(conf_path, 'w') as f:
    f.write(content)
print("  站点配置更新完成")
PYEOF

    if nginx -t 2>/dev/null; then
        systemctl reload nginx
        success "Nginx 优化完成并重载"
        add_result "✅ Nginx: 已优化并重载"
    else
        warning "配置测试失败，正在回滚..."
        cp "$backup" "$nginx_conf"
        systemctl reload nginx 2>/dev/null || true
        add_result "❌ Nginx: 优化失败已回滚"
    fi
}

optimize_proxy_service() {
    step "⚡ 代理服务重启"
    local found=0
    for svc in sing-box xray; do
        if systemctl is-active --quiet "$svc" 2>/dev/null; then
            systemctl restart "$svc" && \
                success "$svc 重启完成（fd override 已生效）" && \
                add_result "✅ ${svc}: 已重启"
            found=1
        fi
    done
    [[ $found -eq 0 ]] && warning "未检测到运行中的 sing-box / xray（部署后自动生效）"
}

optimize_time() {
    step "🕐 时间同步"
    if systemctl is-active --quiet systemd-timesyncd 2>/dev/null; then
        timedatectl set-ntp true 2>/dev/null || true
        success "systemd-timesyncd 运行中"
        add_result "✅ 时间同步: 正常"
    elif command -v ntpd &>/dev/null; then
        success "ntpd 运行中"
        add_result "✅ 时间同步: ntpd"
    else
        apt-get install -y -qq systemd-timesyncd 2>/dev/null || true
        timedatectl set-ntp true 2>/dev/null || true
        success "systemd-timesyncd 已安装"
        add_result "✅ 时间同步: 已安装"
    fi
    info "当前时间: $(date '+%Y-%m-%d %H:%M:%S %Z')"
}

# ============================================================
# 全面健康检测
# ============================================================
health_check() {
    step "🔬 全面健康检测"

    local pass=0 fail=0 warn=0
    local check_results=()

    _pass() { check_results+=("${GREEN}  ✔ PASS${NC}  $1"); (( pass++ )); }
    _fail() { check_results+=("${RED}  ✘ FAIL${NC}  $1"); (( fail++ )); }
    _warn() { check_results+=("${YELLOW}  ⚠ WARN${NC}  $1"); (( warn++ )); }

    # ── 1. BBR ───────────────────────────────────────────────
    local bbr_algo
    bbr_algo=$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null)
    local bbr_qdisc
    bbr_qdisc=$(sysctl -n net.core.default_qdisc 2>/dev/null)
    if [[ "$bbr_algo" == "bbr" && "$bbr_qdisc" == "fq" ]]; then
        _pass "BBR: 拥塞算法=$bbr_algo  队列=$bbr_qdisc"
    elif [[ "$bbr_algo" == "bbr" ]]; then
        _warn "BBR: 算法已启用但队列未设为 fq（当前: $bbr_qdisc）"
    else
        _fail "BBR: 未启用（当前: $bbr_algo），重启后生效"
    fi

    # ── 2. 内核参数 ──────────────────────────────────────────
    local rmem
    rmem=$(sysctl -n net.core.rmem_max 2>/dev/null)
    if [[ "$rmem" -ge 67108864 ]] 2>/dev/null; then
        _pass "内核参数: 缓冲区已优化 (rmem_max=$rmem)"
    else
        _fail "内核参数: 缓冲区未优化 (rmem_max=$rmem)"
    fi

    # ── 3. 文件描述符 ────────────────────────────────────────
    local nofile
    nofile=$(ulimit -n)
    if [[ "$nofile" -ge 65535 ]] 2>/dev/null; then
        _pass "文件描述符: $nofile"
    else
        _warn "文件描述符: $nofile（建议 65535，重启后生效）"
    fi

    # ── 4. Nginx ─────────────────────────────────────────────
    if systemctl is-active --quiet nginx 2>/dev/null; then
        if nginx -t 2>/dev/null; then
            _pass "Nginx: 运行中，配置正常"
        else
            _warn "Nginx: 运行中但配置有警告"
        fi
    else
        _fail "Nginx: 未运行"
    fi

    # ── 5. Nginx 端口监听 ────────────────────────────────────
    if ss -tlnp 2>/dev/null | grep -q ":${NGINX_PORT}"; then
        _pass "端口监听: ${NGINX_PORT} 正常"
    else
        _fail "端口监听: ${NGINX_PORT} 未监听"
    fi

    # ── 6. Nginx → sing-box 转发 ─────────────────────────────
    local ws_test
    ws_test=$(curl -s -o /dev/null -w "%{http_code}" --max-time 3         -H "Upgrade: websocket" -H "Connection: Upgrade"         "http://127.0.0.1:10000${WS_PATH}" 2>/dev/null || echo "000")
    if [[ "$ws_test" == "400" ]]; then
        _pass "WS转发: nginx → sing-box 链路正常（400=握手头缺失属正常）"
    elif [[ "$ws_test" == "000" ]]; then
        _fail "WS转发: sing-box 无响应，请检查 sing-box 是否运行"
    else
        _warn "WS转发: 返回 HTTP $ws_test（非预期，请检查配置）"
    fi

    # ── 7. sing-box / xray ───────────────────────────────────
    local proxy_running=0
    for svc in sing-box xray; do
        if systemctl is-active --quiet "$svc" 2>/dev/null; then
            _pass "${svc}: 运行中"
            proxy_running=1
        fi
    done
    [[ $proxy_running -eq 0 ]] && _fail "代理服务: sing-box / xray 均未运行"

    # ── 8. 时间同步 ──────────────────────────────────────────
    local time_diff
    time_diff=$(chronyc tracking 2>/dev/null | grep "System time" | awk "{print \$4}" || true)
    if systemctl is-active --quiet systemd-timesyncd 2>/dev/null ||        systemctl is-active --quiet chrony 2>/dev/null ||        systemctl is-active --quiet ntp 2>/dev/null; then
        _pass "时间同步: 正常 ($(date "+%Y-%m-%d %H:%M:%S %Z"))"
    else
        _warn "时间同步: 服务未运行，TLS 可能受影响"
    fi

    # ── 9. 证书有效期 ───────────────────────────────────────
    local cert_file
    cert_file=$(grep -R "ssl_certificate " /etc/nginx/sites-enabled/ 2>/dev/null \
        | grep -v "key" | head -1 | awk '{print $NF}' | tr -d ";")
    # 处理软链接（letsencrypt 使用软链接）
    [[ -L "$cert_file" ]] && cert_file=$(readlink -f "$cert_file")
    if [[ -f "$cert_file" ]]; then
        local expiry days_left
        expiry=$(openssl x509 -enddate -noout -in "$cert_file" 2>/dev/null | cut -d= -f2)
        days_left=$(( ( $(date -d "$expiry" +%s 2>/dev/null || echo 0) - $(date +%s) ) / 86400 ))
        if [[ $days_left -gt 30 ]]; then
            _pass "TLS 证书: 有效期剩余 ${days_left} 天"
        elif [[ $days_left -gt 0 ]]; then
            _warn "TLS 证书: 即将到期（剩余 ${days_left} 天），请尽快续期"
        else
            _fail "TLS 证书: 已过期！"
        fi
    else
        _warn "TLS 证书: 未找到证书文件"
    fi

    # ── 输出检测结果 ─────────────────────────────────────────
    echo ""
    for r in "${check_results[@]}"; do
        echo -e "$r"
    done

    # ── 总评 ─────────────────────────────────────────────────
    echo ""
    echo -e "  ${BOLD}${BLUE}$(printf '─%.0s' {1..48})${NC}"
    local total=$(( pass + fail + warn ))
    echo -e "  检测项目: ${total}  ${GREEN}通过: ${pass}${NC}  ${RED}失败: ${fail}${NC}  ${YELLOW}警告: ${warn}${NC}"

    if [[ $fail -eq 0 && $warn -eq 0 ]]; then
        echo -e "  ${GREEN}${BOLD}总体评价: 优秀 🎉 所有检测项目通过${NC}"
    elif [[ $fail -eq 0 ]]; then
        echo -e "  ${YELLOW}${BOLD}总体评价: 良好 ✓ 有 ${warn} 项警告需关注${NC}"
    else
        echo -e "  ${RED}${BOLD}总体评价: 异常 ✘ 有 ${fail} 项失败需处理${NC}"
    fi
    echo -e "  ${BOLD}${BLUE}$(printf '─%.0s' {1..48})${NC}"
}

print_report() {
    step "📋 优化完成报告"
    echo ""
    for r in "${RESULTS[@]}"; do echo -e "  $r"; done

    echo ""
    echo -e "  ${BOLD}内核验证:${NC}"
    echo -e "    拥塞算法 : ${GREEN}$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null)${NC}"
    echo -e "    队列算法 : ${GREEN}$(sysctl -n net.core.default_qdisc 2>/dev/null)${NC}"
    echo -e "    文件描述符: ${GREEN}$(ulimit -n)${NC}"

    echo ""
    echo -e "  ${CYAN}Nginx 备份: /etc/nginx/sites-available/*.bak.*${NC}"
    echo ""
    echo -e "  ${YELLOW}${BOLD}建议执行 reboot 使全部内核参数生效${NC}"
    echo ""
}

main() {
    check_root
    print_banner
    check_debian
    detect_and_collect
    optimize_bbr
    optimize_sysctl
    optimize_nofile
    optimize_nginx
    optimize_proxy_service
    optimize_time
    print_report
    health_check
}

main