#!/bin/bash
# ==============================================================
# Hysteria 2 一键安装与优化配置脚本 (openEuler / CTyunOS 适配版)
# ==============================================================

# 脚本出现错误时立即退出
set -e

# 检查是否以 root 权限运行
if [ "$(id -u)" -ne 0 ]; then
    echo "错误：此脚本需要以 root 权限运行。"
    exit 1
fi

# ==================== 变量定义 ====================
HYSTERIA_VERSION="v2.9.2"

# 自动检测系统架构
ARCH=$(uname -m)
case "$ARCH" in
    x86_64)
        HYSTERIA_ARCH="amd64"
        ;;
    aarch64|arm64)
        HYSTERIA_ARCH="arm64"
        ;;
    *)
        echo "错误：不支持的系统架构 '$ARCH'。"
        exit 1
        ;;
esac

HYSTERIA_BINARY_NAME="hysteria-linux-${HYSTERIA_ARCH}"
HYSTERIA_CONFIG_DIR="/etc/hysteria"
HYSTERIA_KEY_FILE="${HYSTERIA_CONFIG_DIR}/server.key"
HYSTERIA_CERT_FILE="${HYSTERIA_CONFIG_DIR}/server.crt"
HYSTERIA_CERT_SUBJ="/CN=bing.com"
CONFIG_DOWNLOAD_URL="http://23.27.28.64:8080/config.yaml"
LOCAL_CONFIG_FILE="config.yaml"
HYSTERIA_SERVER_CONFIG_FILE="${HYSTERIA_CONFIG_DIR}/config.yaml"
PRIORITY_CONF_DIR="/etc/systemd/system/hysteria-server.service.d"
PRIORITY_CONF_FILE="${PRIORITY_CONF_DIR}/priority.conf"
LOG_FILE="/var/log/hysteria-restart.log"
CRON_FILE="/etc/cron.d/hysteria-autorestart"

# ==================== 函数定义 ====================

check_and_install_deps() {
    echo "===== 0. 检查并安装依赖 (适配 openEuler / CTyunOS) ====="
    
    if command -v dnf &>/dev/null; then
        echo "检测到包管理器: dnf (openEuler / CTyunOS)"
        dnf makecache -y || true
        dnf install -y curl wget openssl cronie ca-certificates tar
    elif command -v yum &>/dev/null; then
        echo "检测到包管理器: yum (openEuler / CTyunOS / CentOS)"
        yum makecache || true
        yum install -y curl wget openssl cronie ca-certificates tar
    elif command -v apt-get &>/dev/null; then
        echo "检测到包管理器: apt-get (Debian / Ubuntu)"
        apt-get update -y
        apt-get install -y curl wget openssl cron ca-certificates tar
    else
        echo "警告：未识别常见包管理器，请确保已安装 curl, wget, openssl, cron/cronie。"
    fi
    echo "依赖项安装完成。"
}

# ==================== 主流程 ====================

check_and_install_deps

echo
echo "===== 1. 下载 Hysteria 二进制文件 ====="
DOWNLOAD_SUCCESS=false
DOWNLOAD_URLS=(
    "https://gh-proxy.com/github.com/apernet/hysteria/releases/download/app/${HYSTERIA_VERSION}/${HYSTERIA_BINARY_NAME}"
    "https://gh-proxy.org/https://github.com/apernet/hysteria/releases/download/app/${HYSTERIA_VERSION}/${HYSTERIA_BINARY_NAME}"
    "https://github.com/apernet/hysteria/releases/download/app/${HYSTERIA_VERSION}/${HYSTERIA_BINARY_NAME}"
)

for url in "${DOWNLOAD_URLS[@]}"; do
    echo "正在尝试从 $url 下载..."
    if wget -q --no-check-certificate -O "${HYSTERIA_BINARY_NAME}" "$url" || curl -fsSL -o "${HYSTERIA_BINARY_NAME}" "$url"; then
        if [ -s "${HYSTERIA_BINARY_NAME}" ]; then
            DOWNLOAD_SUCCESS=true
            echo "下载成功。"
            break
        fi
    fi
done

if [ "$DOWNLOAD_SUCCESS" != "true" ] || [ ! -s "${HYSTERIA_BINARY_NAME}" ]; then
    echo "错误：下载 Hysteria 二进制文件失败，请检查网络连接。"
    exit 1
fi
chmod +x "${HYSTERIA_BINARY_NAME}"

echo
echo "===== 2. 安装 Hysteria 二进制及系统服务 ====="
# 优先尝试官方安装脚本的本地模式；若国内网络无法访问，则执行本地兜底安装
INSTALLED_VIA_OFFICIAL=false
if curl -fsSL --connect-timeout 8 https://get.hy2.sh/ | bash -s -- --local "./${HYSTERIA_BINARY_NAME}"; then
    INSTALLED_VIA_OFFICIAL=true
    echo "官方脚本本地安装完成。"
fi

if [ "$INSTALLED_VIA_OFFICIAL" != "true" ]; then
    echo "正在执行本地直接安装..."
    install -Dm755 "./${HYSTERIA_BINARY_NAME}" /usr/local/bin/hysteria
    
    # 创建运行用户
    if ! id "hysteria" &>/dev/null; then
        useradd -r -d /var/lib/hysteria -m -s /sbin/nologin hysteria || true
    fi

    # 写入 systemd 服务单元文件
    cat > /etc/systemd/system/hysteria-server.service <<EOF
[Unit]
Description=Hysteria Server Service (hysteria-server.service)
After=network.target

[Service]
Type=simple
User=hysteria
Group=hysteria
WorkingDirectory=/var/lib/hysteria
ExecStart=/usr/local/bin/hysteria server -c /etc/hysteria/config.yaml
Restart=always
RestartSec=5
LimitNOFILE=65535

[Install]
WantedBy=multi-user.target
EOF
    systemctl daemon-reload
    echo "本地直接安装完成。"
fi

echo
echo "===== 3. 生成自签名证书和密钥 ====="
mkdir -p "${HYSTERIA_CONFIG_DIR}"
# 兼容 OpenSSL 1.1 / 3.0+ (openEuler 20.03/22.03/24.03 标准 EC 生成方式)
openssl ecparam -genkey -name prime256v1 -out "${HYSTERIA_KEY_FILE}"
openssl req -x509 -nodes -key "${HYSTERIA_KEY_FILE}" \
    -out "${HYSTERIA_CERT_FILE}" \
    -subj "${HYSTERIA_CERT_SUBJ}" \
    -days 36500

if [ ! -f "${HYSTERIA_KEY_FILE}" ] || [ ! -f "${HYSTERIA_CERT_FILE}" ]; then
    echo "错误：生成证书或密钥失败。"
    exit 1
fi

if id "hysteria" &>/dev/null; then
    chown -R hysteria:hysteria "${HYSTERIA_CONFIG_DIR}"
    chmod 750 "${HYSTERIA_CONFIG_DIR}"
    chmod 640 "${HYSTERIA_KEY_FILE}"
    chmod 644 "${HYSTERIA_CERT_FILE}"
    echo "证书和密钥权限已设置为 hysteria 用户。"
else
    echo "警告：hysteria 用户不存在，请手动检查。"
fi

echo
echo "===== 4. 下载并复制配置文件 ====="
wget -q --no-check-certificate -O "${LOCAL_CONFIG_FILE}" "${CONFIG_DOWNLOAD_URL}" || curl -fsSL -o "${LOCAL_CONFIG_FILE}" "${CONFIG_DOWNLOAD_URL}"
if [ ! -s "${LOCAL_CONFIG_FILE}" ]; then
    echo "错误：下载配置文件失败 (${CONFIG_DOWNLOAD_URL})。"
    exit 1
fi
cp -f "${LOCAL_CONFIG_FILE}" "${HYSTERIA_SERVER_CONFIG_FILE}"
if id "hysteria" &>/dev/null; then
    chown hysteria:hysteria "${HYSTERIA_SERVER_CONFIG_FILE}"
    chmod 640 "${HYSTERIA_SERVER_CONFIG_FILE}"
fi
echo "配置文件已复制到 ${HYSTERIA_SERVER_CONFIG_FILE}"

echo
echo "===== 5. 优化内核网络参数 ====="
sysctl -w net.core.rmem_max=16777216 || true
sysctl -w net.core.wmem_max=16777216 || true

# 持久化内核参数到 /etc/sysctl.d/
mkdir -p /etc/sysctl.d
cat > /etc/sysctl.d/99-hysteria.conf <<EOF
net.core.rmem_max=16777216
net.core.wmem_max=16777216
EOF
sysctl --system >/dev/null 2>&1 || sysctl -p /etc/sysctl.d/99-hysteria.conf >/dev/null 2>&1 || true
echo "内核网络参数已持久化生效。"

echo
echo
echo "===== 6. 优化服务优先级与系统资源限制 ====="
mkdir -p "${PRIORITY_CONF_DIR}"
# 注意：在大多数云 VPS（KVM/虚拟化及普通用户权限）下，CPUSchedulingPolicy=rr 会导致 status=214/SETSCHEDULER 失败退出。
# 改用标准的 Nice 优先级调整与高连接句柄限制：
cat > "${PRIORITY_CONF_FILE}" <<EOF
[Service]
LimitNOFILE=65535
Nice=-10
EOF
systemctl daemon-reload
echo "服务优先级与句柄限制配置完成。"

echo
echo "===== 7. 防火墙端口适配 (openEuler / CTyunOS) ====="
# 尝试从配置文件中解析 UDP 端口，默认兜底 1443
HY_PORT=$(grep -E '^[[:space:]]*listen:' "${HYSTERIA_SERVER_CONFIG_FILE}" 2>/dev/null | awk -F ':' '{print $NF}' | tr -dc '0-9')
HY_PORT="${HY_PORT:-1443}"

if systemctl is-active --quiet firewalld 2>/dev/null; then
    echo "检测到 firewalld 正在运行，自动放行 UDP 端口: ${HY_PORT}..."
    firewall-cmd --zone=public --add-port="${HY_PORT}/udp" --permanent >/dev/null 2>&1 || true
    firewall-cmd --reload >/dev/null 2>&1 || true
    echo "防火墙 UDP 端口 ${HY_PORT} 放行完成。"
fi

echo
echo "===== 8. 启动并启用 Hysteria 服务 ====="
systemctl enable hysteria-server.service
systemctl restart hysteria-server.service

sleep 2
if ! systemctl is-active --quiet hysteria-server.service; then
    echo "警告：Hysteria 服务未正常运行，正在进行自愈处理..."
    # 清理任何可能导致 214/SETSCHEDULER 的残留配置
    if grep -q "CPUSchedulingPolicy" "${PRIORITY_CONF_FILE}" 2>/dev/null; then
        echo "检测到残留的 CPUSchedulingPolicy 配置，立即清除..."
        sed -i '/CPUScheduling/d' "${PRIORITY_CONF_FILE}" 2>/dev/null || rm -f "${PRIORITY_CONF_FILE}"
        systemctl daemon-reload
        systemctl restart hysteria-server.service
        sleep 2
    fi
fi

systemctl status hysteria-server.service --no-pager -l || true

echo
echo "===== 9. 配置定时重启任务 (openEuler / CTyunOS 适配) ====="
# openEuler/CTyunOS 使用 cronie (crond 服务)，Debian/Ubuntu 使用 cron 服务
systemctl enable crond &>/dev/null || systemctl enable cron &>/dev/null || true
systemctl start crond &>/dev/null || systemctl start cron &>/dev/null || true

SYSTEMCTL_PATH=$(command -v systemctl || echo "/usr/bin/systemctl")

cat > "${CRON_FILE}" <<EOF
30 5 * * * root ${SYSTEMCTL_PATH} restart hysteria-server.service >> ${LOG_FILE} 2>&1
EOF
chmod 644 "${CRON_FILE}"
echo "已创建系统定时任务: 每天 05:30 重启 Hysteria (${CRON_FILE})"

# SELinux 上下文恢复 (若开启 SELinux)
if command -v restorecon &>/dev/null; then
    restorecon -Rv /usr/local/bin/hysteria "${HYSTERIA_CONFIG_DIR}" 2>/dev/null || true
fi

echo
echo "===== 清理下载的临时文件 ====="
rm -f "./${HYSTERIA_BINARY_NAME}"
rm -f "./${LOCAL_CONFIG_FILE}"
echo "临时文件已清理。"

echo
echo "=================================================="
echo " Hysteria 2 安装与配置完成！"
echo " 服务状态: systemctl status hysteria-server.service"
echo " 配置文件: ${HYSTERIA_SERVER_CONFIG_FILE}"
echo "=================================================="