#!/usr/bin/env bash
# print-clients.sh —— 生成两条客户端导入串,写入 ./secrets/clients.txt。
# 注意:含口令/密钥,【不打印到 stdout】以免进入 CI 日志;手动 `ssh ec2 cat` 取用。
set -euo pipefail
cd "$(dirname "$0")/.."   # -> deploy/

# shellcheck disable=SC1091
source ./secrets/pangolin.env

# 公网 IP:优先 IMDSv2,可用 PANGOLIN_PUBLIC_IP 覆盖
HOST="${PANGOLIN_PUBLIC_IP:-}"
if [[ -z "$HOST" ]]; then
  TOKEN="$(curl -s -X PUT 'http://169.254.169.254/latest/api/token' -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' || true)"
  HOST="$(curl -s -H "X-aws-ec2-metadata-token: ${TOKEN}" http://169.254.169.254/latest/meta-data/public-ipv4 || true)"
fi
[[ -z "$HOST" ]] && HOST="YOUR_SERVER_IP"

REALITY_LINK="vless://${UUID}@${HOST}:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=www.apple.com&fp=chrome&pbk=${REALITY_PUBLIC_KEY}&sid=${REALITY_SHORT_ID}&type=tcp#pangolin-reality"
HY2_LINK="hysteria2://${HY2_PASSWORD}@${HOST}:443?insecure=1&sni=www.bing.com#pangolin-hy2"

OUT="./secrets/clients.txt"
umask 177
cat > "$OUT" <<EOF
# pangolin Phase-0 客户端导入信息  (生成于 $(date -u +%FT%TZ))
# 含敏感信息,勿外泄。

[REALITY / VLESS+Vision]  —— 平时主线
${REALITY_LINK}

[Hysteria2]  —— 晚高峰加速线(自签证书,客户端需允许不安全/insecure)
${HY2_LINK}

字段速查:
  server       = ${HOST}
  REALITY sni  = www.apple.com   port=443/tcp   flow=xtls-rprx-vision
  REALITY pbk  = ${REALITY_PUBLIC_KEY}
  REALITY sid  = ${REALITY_SHORT_ID}
  uuid         = ${UUID}
  Hy2 sni      = www.bing.com    port=443/udp   insecure=1
EOF
echo "[print-clients] 已写入 ${OUT}(用 'ssh ec2 cat /opt/pangolin/secrets/clients.txt' 取用)"