#!/usr/bin/env bash
# deploy.sh —— 在 EC2 上幂等编排 pangolin 数据面。
# 由 CI(NAS runner via ssh)调用,也可手动 `ssh ec2 'cd /opt/pangolin && ./scripts/deploy.sh'`。
#
# 步骤:生成密钥 -> 渲染配置 -> docker-compose up -> (幂等)加 nginx 路由 -> 健康检查 -> 输出客户端信息
# 全程不触碰 marzban/blog/jiu;唯一特权动作是 sudo 调用受限的 nginx-apply 脚本。
set -euo pipefail
cd "$(dirname "$0")/.."   # -> deploy/

COMPOSE="docker-compose -p pangolin"
NGINX_APPLY="/usr/local/sbin/pangolin-nginx-apply.sh"

echo "==> [1/5] 生成/复用密钥与证书"
./scripts/gen-secrets.sh

echo "==> [2/5] 渲染配置(模板 -> config.json)"
# shellcheck disable=SC1091
source ./secrets/pangolin.env
render() {  # render <tmpl> <out>
  sed -e "s|__UUID__|${UUID}|g" \
      -e "s|__REALITY_PRIVATE_KEY__|${REALITY_PRIVATE_KEY}|g" \
      -e "s|__REALITY_SHORT_ID__|${REALITY_SHORT_ID}|g" \
      -e "s|__HY2_PASSWORD__|${HY2_PASSWORD}|g" \
      "$1" > "$2"
}
render ./xray/config.tmpl.json    ./xray/config.json
render ./singbox/config.tmpl.json ./singbox/config.json

echo "==> [3/5] 拉起容器(docker-compose up -d)"
$COMPOSE pull --quiet || true
$COMPOSE up -d
$COMPOSE ps

echo "==> [4/5] nginx SNI 路由(幂等)"
if grep -qF "127.0.0.1:11443" /etc/nginx/stream.conf 2>/dev/null; then
  echo "    路由已存在,跳过"
elif [[ -x "$NGINX_APPLY" ]]; then
  sudo "$NGINX_APPLY"
else
  echo "    !! 未找到 $NGINX_APPLY(需先执行一次性 root 前置 setup/root-setup.sh)" >&2
  exit 1
fi

echo "==> [5/5] 健康检查"
ok=1
# REALITY:经宿主 nginx 用 www.apple.com 做 TLS 握手应成功
if echo | timeout 10 openssl s_client -connect 127.0.0.1:443 -servername www.apple.com >/dev/null 2>&1; then
  echo "    [REALITY] 443/www.apple.com 握手 OK"
else
  echo "    [REALITY] 握手失败"; ok=0
fi
# Hy2:UDP 443 应有 sing-box 在监听
if ss -uln 2>/dev/null | grep -q ":443 "; then
  echo "    [Hy2] UDP 443 监听 OK"
else
  echo "    [Hy2] UDP 443 未监听"; ok=0
fi

./scripts/print-clients.sh

[[ "$ok" == "1" ]] && echo "==> 部署完成 ✅" || { echo "==> 健康检查未通过 ❌"; exit 1; }