#!/usr/bin/env bash
# print-clients.sh —— 生成 pangolin 自有线路(本台仅 Hy2)的导入串,写 ./secrets/clients.txt。
# 含口令,不打印到 stdout(避免进 CI 日志)。REALITY 仍由 Marzban 提供,不在此列。
set -euo pipefail
cd "$(dirname "$0")/.."   # -> deploy/

# shellcheck disable=SC1091
source ./secrets/pangolin.env

HOST="${PANGOLIN_PUBLIC_IP:-}"
if [[ -z "$HOST" ]]; then
  TOKEN="$(curl -s -X PUT 'http://169.254.169.254/latest/api/token' -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' || true)"
  HOST="$(curl -s -H "X-aws-ec2-metadata-token: ${TOKEN}" http://169.254.169.254/latest/meta-data/public-ipv4 || true)"
fi
[[ -z "$HOST" ]] && HOST="YOUR_SERVER_IP"

HY2_LINK="hysteria2://${HY2_PASSWORD}@${HOST}:443?insecure=1&sni=www.bing.com#pangolin-hy2"

OUT="./secrets/clients.txt"
umask 177
cat > "$OUT" <<EOF
# pangolin 自有线路导入信息(生成于 $(date -u +%FT%TZ))。含敏感信息,勿外泄。

[Hysteria2]  —— 晚高峰加速线(自签证书,客户端需允许 insecure)
${HY2_LINK}

  server = ${HOST}   port = 443/udp   sni = www.bing.com   insecure = 1

# 注:REALITY 主线仍由 Marzban 管理(SNI=www.cloudflare.com),不在此文件。
EOF
echo "[print-clients] 已写入 ${OUT}(ssh ec2 cat ~/pangolin/secrets/clients.txt 取用)"