#!/bin/bash

# =========================================================================
# OOB 集中管理网络 (Hub-Spoke) - 指挥中心统一部署脚本
# 生成 1 个服务端，100 份 ROS 独立脚本，1 个管理员 PC 客户端
# =========================================================================

# --- 核心变量设置 ---
WG_IFACE="wg-mgmt"
WG_PORT="443"
WG_SUBNET="10.99.0"

# ！！！ 请在此处填入你自定义的服务器私钥 ！！！
SERVER_PRI_KEY="MM5+YFr9qH/+1FQaGnmGnZw2i1cQCz2oB2Ab8epclnw="

# 配置生成数量
ROS_COUNT=100

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
CYAN='\033[0;36m'
PLAIN='\033[0m'

if [ "$(id -u)" -ne 0 ]; then
    echo -e "${RED}错误：必须以 root 权限运行此脚本。${PLAIN}"
    exit 1
fi

if [ "$SERVER_PRI_KEY" == "请在此处替换为你真实的服务器私钥_不要带引号" ] || [ -z "$SERVER_PRI_KEY" ]; then
    echo -e "${RED}错误：请先编辑本脚本，填入 SERVER_PRI_KEY！${PLAIN}"
    exit 1
fi

echo -e "${GREEN}=================================================${PLAIN}"
echo -e "${GREEN}  开始构建 OOB 管理中心与 100 份 ROS 配置文件... ${PLAIN}"
echo -e "${GREEN}=================================================${PLAIN}"

# 1. 安装依赖与获取网络信息
apt-get update
apt-get install -y wireguard qrencode iptables curl iproute2
PUBLIC_IP=$(curl -s ifconfig.me || curl -s 4.ipw.cn)
PUB_NIC=$(ip -4 route show default | grep -oP '(?<=dev )(\S+)' | head -1)

SERVER_PUB_KEY=$(echo "${SERVER_PRI_KEY}" | wg pubkey)
WG_CONFIG="/etc/wireguard/${WG_IFACE}.conf"
ROS_OUT_DIR="/root/ros_configs"

mkdir -p /etc/wireguard
mkdir -p "${ROS_OUT_DIR}"
chmod 700 /etc/wireguard

# 2. 生成服务端主配置头
cat > "${WG_CONFIG}" <<EOF
[Interface]
Address = ${WG_SUBNET}.1/24
ListenPort = ${WG_PORT}
PrivateKey = ${SERVER_PRI_KEY}
MTU = 1360

# 允许隧道内互通 (重要：让 Admin PC 能访问到 ROS)
PostUp = iptables -I FORWARD -i ${WG_IFACE} -j ACCEPT; iptables -I FORWARD -o ${WG_IFACE} -j ACCEPT; iptables -t nat -A POSTROUTING -o ${PUB_NIC} -j MASQUERADE
PostDown = iptables -D FORWARD -i ${WG_IFACE} -j ACCEPT; iptables -D FORWARD -o ${WG_IFACE} -j ACCEPT; iptables -t nat -D POSTROUTING -o ${PUB_NIC} -j MASQUERADE
EOF

echo -e "${YELLOW}正在批量生成 ${ROS_COUNT} 份 ROS 专属一键脚本，请稍候...${PLAIN}"

# 3. 循环 100 次，生成 ROS 节点与一键脚本
for i in $(seq 1 $ROS_COUNT); do
    # 格式化数字，如 001, 015, 100
    NUM=$(printf "%03d" $i)
    ROS_IP="${WG_SUBNET}.$((i+1))"  # IP 从 10.99.0.2 开始
    
    # 每个 ROS 生成独立的密钥体系
    ROS_PRI_KEY=$(wg genkey)
    ROS_PUB_KEY=$(echo "${ROS_PRI_KEY}" | wg pubkey)
    PSK=$(wg genpsk)

    # 追加 Peer 到 VPS 配置中
    cat >> "${WG_CONFIG}" <<EOF

# Peer: ROS-${NUM}
[Peer]
PublicKey = ${ROS_PUB_KEY}
PresharedKey = ${PSK}
AllowedIPs = ${ROS_IP}/32
EOF

    # === 生成对应的 ROS 终端一键粘贴脚本 ===
    ROS_SCRIPT_FILE="${ROS_OUT_DIR}/ros_${NUM}_ip_${ROS_IP}.txt"
    cat > "${ROS_SCRIPT_FILE}" <<EOF
# ==============================================================
# ROS 设备标识: ROS-${NUM}
# 管理网分配 IP: ${ROS_IP}
# 请在全新的或已配置好公网接入的 ROS 终端中整体粘贴执行
# ==============================================================

/interface wireguard
add name=wg-mgmt private-key="${ROS_PRI_KEY}" listen-port=13220 mtu=1360 comment="OOB Management"

/interface wireguard peers
add interface=wg-mgmt public-key="${SERVER_PUB_KEY}" preshared-key="${PSK}" endpoint-address="${PUBLIC_IP}" endpoint-port=${WG_PORT} allowed-address=10.99.0.0/24 persistent-keepalive=25 comment="Hub VPS"

/ip address
add address=${ROS_IP}/24 interface=wg-mgmt comment="OOB Mgmt IP"

/ip firewall filter
add chain=input action=accept src-address=10.99.0.0/24 in-interface=wg-mgmt place-before=[/ip firewall filter find comment~"Drop WAN input"] comment="Allow OOB Management via WG"


/ip firewall mangle
add chain=forward action=change-mss new-mss=clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn out-interface=wg-mgmt comment="MSS Clamp wg-mgmt"
EOF
done

# 4. 生成管理员笔记本 (Admin PC) 的专属客户端
ADMIN_IP="${WG_SUBNET}.254"
ADMIN_PRI_KEY=$(wg genkey)
ADMIN_PUB_KEY=$(echo "${ADMIN_PRI_KEY}" | wg pubkey)
ADMIN_PSK=$(wg genpsk)
ADMIN_CONF="/root/admin_pc.conf"

cat >> "${WG_CONFIG}" <<EOF

# Peer: Admin-PC (Your Laptop)
[Peer]
PublicKey = ${ADMIN_PUB_KEY}
PresharedKey = ${ADMIN_PSK}
AllowedIPs = ${ADMIN_IP}/32
EOF

# 生成分离隧道 (Split Tunneling) 的电脑端配置
cat > "${ADMIN_CONF}" <<EOF
[Interface]
PrivateKey = ${ADMIN_PRI_KEY}
Address = ${ADMIN_IP}/24
# 无需配置 DNS，不影响本地正常上网

[Peer]
PublicKey = ${SERVER_PUB_KEY}
Endpoint = ${PUBLIC_IP}:${WG_PORT}
PresharedKey = ${ADMIN_PSK}
# 极客精髓：只将访问管理网 (10.99.0.x) 的流量送入隧道！
AllowedIPs = 10.99.0.0/24
PersistentKeepalive = 25
EOF

# 5. 启动服务
sed -i '/net.ipv4.ip_forward/d' /etc/sysctl.conf
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p > /dev/null

systemctl enable wg-quick@${WG_IFACE}
systemctl restart wg-quick@${WG_IFACE}

echo -e "${GREEN}=================================================${PLAIN}"
echo -e " ✅ 管理中心部署完毕！"
echo -e " 📂 100 份 ROS 独立一键脚本已存放于： ${YELLOW}/root/ros_configs/${PLAIN}"
echo -e " 💻 你的笔记本(Admin)专属配置文件： ${YELLOW}${ADMIN_CONF}${PLAIN}"
echo -e "================================================="
echo -e "使用方法："
echo -e "1. 用 SFTP 或 cat 命令将 admin_pc.conf 导入你电脑的 WireGuard 客户端并连接。"
echo -e "2. 以后有新的 ROS 需要上线，只需去 /root/ros_configs/ 里按顺序挑一个文本，粘贴进 ROS 终端。"
echo -e "3. 粘贴后，在电脑的 WinBox 填入该文本里的 IP (例如 10.99.0.2)，即可直连管理！"