#!/bin/bash

# Tailscale DERP 服务器一键安装脚本 (支持自签名IP证书)
# 本脚本适用于 Ubuntu/Debian 系统

set -e

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# 日志函数
log_info() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

log_warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# 检查是否为root用户
check_root() {
    if [[ $EUID -ne 0 ]]; then
        log_error "此脚本需要以root权限运行"
        exit 1
    fi
}

# 检查系统类型
check_system() {
    if [[ ! -f /etc/os-release ]]; then
        log_error "无法检测系统类型"
        exit 1
    fi
    
    source /etc/os-release
    case $ID in
        ubuntu|debian)
            PACKAGE_MANAGER="apt"
            ;;
        centos|rhel|fedora)
            PACKAGE_MANAGER="yum"
            ;;
        *)
            log_error "不支持的系统类型: $ID"
            exit 1
            ;;
    esac
    
    log_info "检测到系统: $PRETTY_NAME"
}

# 安装依赖
install_dependencies() {
    log_info "安装依赖包..."
    
    case $PACKAGE_MANAGER in
        apt)
            apt update
            apt install -y curl wget git build-essential openssl nginx
            ;;
        yum)
            yum update -y
            yum install -y curl wget git gcc make openssl nginx
            ;;
    esac
    
    log_info "依赖包安装完成"
}

# 启用BBR优化
enable_bbr() {
    log_info "启用BBR网络优化..."
    
    # 检查内核版本
    KERNEL_VERSION=$(uname -r | cut -d. -f1-2)
    KERNEL_MAJOR=$(echo $KERNEL_VERSION | cut -d. -f1)
    KERNEL_MINOR=$(echo $KERNEL_VERSION | cut -d. -f2)
    
    if [[ $KERNEL_MAJOR -lt 4 ]] || [[ $KERNEL_MAJOR -eq 4 && $KERNEL_MINOR -lt 9 ]]; then
        log_warn "内核版本过低 ($KERNEL_VERSION)，BBR需要4.9+版本"
        return
    fi
    
    # 检查BBR是否已启用
    if sysctl net.ipv4.tcp_congestion_control | grep -q bbr; then
        log_info "BBR已经启用"
        return
    fi
    
    # 备份原始配置
    cp /etc/sysctl.conf /etc/sysctl.conf.backup.$(date +%Y%m%d_%H%M%S)
    
    # 添加BBR配置
    cat >> /etc/sysctl.conf << EOF

# BBR网络优化配置
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# 其他网络优化参数
net.ipv4.tcp_rmem = 8192 262144 536870912
net.ipv4.tcp_wmem = 4096 16384 536870912
net.core.rmem_max = 536870912
net.core.wmem_max = 536870912
net.core.netdev_max_backlog = 30000
net.ipv4.tcp_slow_start_after_idle = 0
EOF
    
    # 应用配置
    sysctl -p
    
    # 验证BBR是否启用成功
    if sysctl net.ipv4.tcp_congestion_control | grep -q bbr; then
        log_info "BBR启用成功"
    else
        log_error "BBR启用失败"
    fi
    
    # 显示当前拥塞控制算法
    log_info "当前拥塞控制算法: $(sysctl -n net.ipv4.tcp_congestion_control)"
}

# 安装Go环境
install_go() {
    log_info "安装Go环境..."
    
    # 检查Go是否已安装
    if command -v go &> /dev/null; then
        log_info "Go已经安装，版本: $(go version)"
        # 设置Go代理
        export GOPROXY=https://goproxy.cn,direct
        echo 'export GOPROXY=https://goproxy.cn,direct' >> /etc/profile
        return
    fi
    
    # 下载并安装Go
    GO_VERSION="1.23.3"
    wget https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz
    tar -zxvf go${GO_VERSION}.linux-amd64.tar.gz
    rm go${GO_VERSION}.linux-amd64.tar.gz
    
    # 移动到正确位置
    mv go /usr/local/
    
    # 设置环境变量
    export PATH=$PATH:/usr/local/go/bin
    echo 'export PATH=$PATH:/usr/local/go/bin' >> /etc/profile
    
    # 设置Go代理
    export GOPROXY=https://goproxy.cn,direct
    echo 'export GOPROXY=https://goproxy.cn,direct' >> /etc/profile
    
    log_info "Go环境安装完成"
}

# 编译DERP服务器
compile_derp() {
    log_info "编译DERP服务器..."
    
    # 创建工作目录
    mkdir -p /home/derp
    cd /home/derp
    
    # 设置Go代理
    export GOPROXY=https://goproxy.cn,direct
    
    # 直接从源码构建derper二进制文件
    log_info "从源码构建derper二进制文件..."
    /usr/local/go/bin/go install tailscale.com/cmd/derper@main
    
    # 查找编译后的二进制文件
    GOPATH=$(go env GOPATH)
    if [[ -z "$GOPATH" ]]; then
        GOPATH="$HOME/go"
    fi
    
    # 复制到工作目录
    if [[ -f "$GOPATH/bin/derper" ]]; then
        cp "$GOPATH/bin/derper" /home/derp/
    else
        log_error "未找到编译后的derper二进制文件"
        exit 1
    fi
    
    # 验证编译结果
    if [[ ! -f /home/derp/derper ]]; then
        log_error "DERP服务器编译失败"
        exit 1
    fi
    
    log_info "DERP服务器编译完成"
}

# 配置用户提供的证书
configure_user_cert() {
    log_info "配置用户提供的证书..."
    
    # 获取服务器IP地址
    read -p "请输入服务器IP地址: " SERVER_IP
    
    if [[ -z "$SERVER_IP" ]]; then
        log_error "IP地址不能为空"
        exit 1
    fi
    
    # 获取证书文件路径
    read -p "请输入证书文件路径 (.crt/.pem文件): " CERT_PATH
    
    if [[ -z "$CERT_PATH" ]]; then
        log_error "证书文件路径不能为空"
        exit 1
    fi
    
    if [[ ! -f "$CERT_PATH" ]]; then
        log_error "证书文件不存在: $CERT_PATH"
        exit 1
    fi
    
    # 获取私钥文件路径
    read -p "请输入私钥文件路径 (.key文件): " KEY_PATH
    
    if [[ -z "$KEY_PATH" ]]; then
        log_error "私钥文件路径不能为空"
        exit 1
    fi
    
    if [[ ! -f "$KEY_PATH" ]]; then
        log_error "私钥文件不存在: $KEY_PATH"
        exit 1
    fi
    
    # 创建证书目录
    mkdir -p /etc/derper/certs
    
    # 复制证书文件
    cp "$CERT_PATH" /etc/derper/certs/server.crt
    cp "$KEY_PATH" /etc/derper/certs/server.key
    
    # 设置证书权限
    chmod 600 /etc/derper/certs/server.key
    chmod 644 /etc/derper/certs/server.crt
    
    # 验证证书
    if ! openssl x509 -in /etc/derper/certs/server.crt -noout -text > /dev/null 2>&1; then
        log_error "证书文件格式无效"
        exit 1
    fi
    
    # 验证私钥
    if ! openssl rsa -in /etc/derper/certs/server.key -check -noout > /dev/null 2>&1; then
        log_error "私钥文件格式无效"
        exit 1
    fi
    
    # 计算证书哈希
    CERT_HASH=$(openssl x509 -in /etc/derper/certs/server.crt -noout -fingerprint -sha256 | cut -d= -f2 | tr -d : | tr '[:upper:]' '[:lower:]')
    
    log_info "证书配置完成"
    log_info "证书SHA256哈希: $CERT_HASH"
    
    # 保存配置信息
    echo "SERVER_IP=$SERVER_IP" > /etc/derper/config
    echo "CERT_HASH=$CERT_HASH" >> /etc/derper/config
    echo "CERT_PATH=$CERT_PATH" >> /etc/derper/config
    echo "KEY_PATH=$KEY_PATH" >> /etc/derper/config
}

# 安装Tailscale客户端
install_tailscale() {
    log_info "安装Tailscale客户端..."
    
    # 使用xEdge镜像安装Tailscale (国内优化)
    log_info "使用xEdge镜像安装Tailscale..."
    curl -fsSL https://ts-mirror.xedge.cc/install.sh | sh
    
    # 如果xEdge镜像失败，回退到官方安装
    if ! command -v tailscale &> /dev/null; then
        log_warn "xEdge镜像安装失败，尝试官方镜像..."
        curl -fsSL https://tailscale.com/install.sh | sh
    fi
    
    log_info "Tailscale客户端安装完成"
    log_warn "请运行 'tailscale up' 来连接到您的Tailnet网络"
}

# 创建systemd服务
create_systemd_service() {
    log_info "创建systemd服务..."
    
    # 读取配置
    source /etc/derper/config
    
    # 显示运行模式选择
    echo "请选择DERP服务器运行模式："
    echo "1. 直接使用自签名证书的HTTPS模式 (推荐)"
    echo "2. Nginx反向代理模式"
    echo "3. 自定义配置"
    read -p "请输入选择 (1-3): " DERP_MODE
    
    case $DERP_MODE in
        1)
            # 直接HTTPS模式，使用自签名证书
            DERP_CMD="/home/derp/derper -hostname $SERVER_IP -certmode manual -certdir /etc/derper/certs -a :443 -http-port 80 -stun-port 3478 -verify-clients"
            ;;
        2)
            # Nginx反向代理模式
            DERP_CMD="/home/derp/derper -hostname $SERVER_IP -a :8080 -stun-port 3478 -verify-clients"
            ;;
        3)
            # 自定义配置
            read -p "请输入自定义命令参数: " CUSTOM_ARGS
            DERP_CMD="/home/derp/derper -hostname $SERVER_IP $CUSTOM_ARGS"
            ;;
        *)
            log_warn "无效选择，使用默认配置"
            DERP_CMD="/home/derp/derper -hostname $SERVER_IP -a :8080 -stun-port 3478 -verify-clients"
            ;;
    esac
    
    cat > /etc/systemd/system/derper.service << EOF
[Unit]
Description=Tailscale DERP Server
After=network.target

[Service]
Type=simple
User=root
WorkingDirectory=/home/derp
ExecStart=$DERP_CMD
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
    
    # 保存运行模式到配置文件
    echo "DERP_MODE=$DERP_MODE" >> /etc/derper/config
    echo "DERP_CMD='$DERP_CMD'" >> /etc/derper/config
    
    # 重载systemd并启动服务
    systemctl daemon-reload
    systemctl enable derper
    
    log_info "systemd服务创建完成"
}

# 配置Nginx反向代理
configure_nginx() {
    # 读取配置
    source /etc/derper/config
    
    # 只有在Nginx反向代理模式下才配置Nginx
    if [[ "$DERP_MODE" != "2" ]]; then
        log_info "跳过Nginx配置（不需要反向代理）"
        return
    fi
    
    log_info "配置Nginx反向代理..."
    
    # 创建Nginx配置
    cat > /etc/nginx/sites-available/derper << EOF
server {
    listen 80;
    server_name $SERVER_IP;
    
    location /derp {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        
        # WebSocket支持
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

server {
    listen 443 ssl;
    server_name $SERVER_IP;
    
    ssl_certificate /etc/derper/certs/server.crt;
    ssl_certificate_key /etc/derper/certs/server.key;
    
    location /derp {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        
        # WebSocket支持
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}
EOF
    
    # 启用站点
    ln -sf /etc/nginx/sites-available/derper /etc/nginx/sites-enabled/
    
    # 测试配置并重启Nginx
    nginx -t && systemctl restart nginx
    
    log_info "Nginx配置完成"
}

# 生成官方Tailscale配置信息
generate_tailscale_config() {
    log_info "生成官方Tailscale配置信息..."
    
    # 读取配置
    source /etc/derper/config
    
    # 创建配置信息文件
    mkdir -p /etc/derper
    
    # 生成官方Tailscale ACL配置示例
    # 读取运行模式
    DERP_PORT=443
    if [[ "$DERP_MODE" == "2" ]]; then
        DERP_PORT=443  # Nginx反向代理会处理HTTPS
    fi
    cat > /etc/derper/tailscale_acl.json << EOF
{
  "derpMap": {
    "Regions": {
      "900": {
        "RegionID": 900,
        "RegionCode": "custom",
        "RegionName": "Custom DERP Server",
        "Nodes": [
          {
            "Name": "derp-$SERVER_IP",
            "RegionID": 900,
            "HostName": "$SERVER_IP",
            "IPv4": "$SERVER_IP",
            "CertName": "sha256:$CERT_HASH",
            "DERPPort": $DERP_PORT,
            "STUNPort": 3478
          }
        ]
      }
    }
  }
}
EOF
    
    log_info "官方Tailscale配置信息已生成: /etc/derper/tailscale_acl.json"
}

# 启动服务
start_services() {
    log_info "启动服务..."
    
    # 启动DERP服务
    systemctl start derper
    
    # 检查服务状态
    if systemctl is-active --quiet derper; then
        log_info "DERP服务启动成功"
    else
        log_error "DERP服务启动失败"
        systemctl status derper
        exit 1
    fi
    
    # 只有在Nginx反向代理模式下才启动Nginx
    if [[ "$DERP_MODE" == "2" ]]; then
        systemctl enable nginx
        systemctl start nginx
        log_info "Nginx服务启动完成"
    fi
    
    log_info "所有服务启动完成"
}

# 显示配置信息
show_config_info() {
    log_info "安装完成！"
    
    # 读取配置
    source /etc/derper/config
    
    echo
    echo "================================="
    echo "DERP服务器配置信息"
    echo "================================="
    echo "服务器IP: $SERVER_IP"
    echo "证书SHA256: $CERT_HASH"
    echo "运行模式: $DERP_MODE"
    
    case $DERP_MODE in
        1)
            echo "访问方式: 直接HTTPS访问"
            echo "DERP端口: 443 (HTTPS)"
            echo "HTTP端口: 80 (自动跳转到HTTPS)"
            echo "STUN端口: 3478"
            ;;
        2)
            echo "访问方式: Nginx反向代理"
            echo "DERP端口: 443 (HTTPS, 通过Nginx)"
            echo "内部端口: 8080 (HTTP)"
            echo "STUN端口: 3478"
            ;;
        3)
            echo "访问方式: 自定义配置"
            echo "命令参数: $DERP_CMD"
            ;;
    esac
    
    echo "配置文件: /etc/derper/tailscale_acl.json"
    echo
    echo "服务管理命令:"
    echo "  启动: systemctl start derper"
    echo "  停止: systemctl stop derper"
    echo "  重启: systemctl restart derper"
    echo "  状态: systemctl status derper"
    echo
    echo "测试连接:"
    echo "  curl https://$SERVER_IP/derp"
    echo
    echo "官方Tailscale配置:"
    echo "  配置文件: /etc/derper/tailscale_acl.json"
    echo "  在Tailscale Admin Console中添加自定DERP服务器"
    echo "  访问: https://login.tailscale.com/admin/dns"
    echo
    echo "重要提示:"
    echo "  1. 请确保防火墙开放443端口"
    echo "  2. 运行 'tailscale up' 连接到Tailnet"
    echo "  3. 在Tailscale Admin Console中添加DERP服务器"
    echo "  4. 使用自签名证书需要在ACL中指定证书哈希"
    echo "================================="
}

# 主函数
main() {
    log_info "开始安装Tailscale DERP服务器..."
    
    check_root
    check_system
    install_dependencies
    enable_bbr
    install_go
    compile_derp
    configure_user_cert
    install_tailscale
    create_systemd_service
    configure_nginx
    generate_tailscale_config
    start_services
    show_config_info
    
    log_info "安装完成！"
}

# 运行主函数
main "$@"