#!/bin/bash
set -euo pipefail

# ======================================
#               配 置 区
# ======================================

# ① GitHub API（使用 ghproxy 加速）
GITHUB_API_LATEST="https://api.github.com/repos/shadowsocks/shadowsocks-rust/releases/latest"

# ② Shadowsocks-rust 下载基础 URL（通过 ghproxy 加速）
DOWNLOAD_BASE_URL="https://gh-proxy.com/https://github.com/shadowsocks/shadowsocks-rust/releases/download"

# ③ 默认版本（API 失败时使用）
DEFAULT_VER="v1.23.5"

# ④ 固定端口与密码
SS_PORT=1445
SS_PASSWORD="QwjJSc3QqDiNZV17K2MqFQ=="
SS_METHOD="chacha20-ietf-poly1305"

# ======================================
#               样式（勿改）
# ======================================
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
PLAIN='\033[0m'


# ======================================
#            基础检查
# ======================================
if [ "$(id -u)" -ne 0 ]; then
    echo -e "${RED}必须使用 root 运行${PLAIN}"
    exit 1
fi

echo -e "${GREEN}============================================= ${PLAIN}"
echo -e "${GREEN} Shadowsocks-Rust 一键安装脚本（ghproxy 加速版） ${PLAIN}"
echo -e "${GREEN}============================================= ${PLAIN}"

echo -e "${YELLOW}[1/7] 更新系统并安装依赖…${PLAIN}"
apt update -y
apt install -y wget curl tar xz-utils jq openssl qrencode


# ======================================
#            检测架构
# ======================================
echo -e "${YELLOW}[2/7] 检测系统架构…${PLAIN}"

UNAME_ARCH=$(uname -m)
case "$UNAME_ARCH" in
    x86_64) ARCH="x86_64-unknown-linux-gnu" ;;
    aarch64|arm64) ARCH="aarch64-unknown-linux-gnu" ;;
    *)
        echo -e "${RED}不支持的系统架构：${UNAME_ARCH}${PLAIN}"
        exit 1
        ;;
esac

echo -e "架构：${GREEN}${UNAME_ARCH} -> ${ARCH}${PLAIN}"


# ======================================
#        获取最新版本（ghproxy 代理）
# ======================================
echo -e "${YELLOW}[3/7] 获取 Shadowsocks-rust 最新版本…${PLAIN}"
echo -e "API：${GREEN}${GITHUB_API_LATEST}${PLAIN}"

LATEST_VER=$(curl -s "${GITHUB_API_LATEST}" | jq -r .tag_name || true)

if [ -z "$LATEST_VER" ] || [ "$LATEST_VER" = "null" ]; then
    echo -e "${RED}获取失败，使用默认版本 ${DEFAULT_VER}${PLAIN}"
    LATEST_VER="${DEFAULT_VER}"
fi

echo -e "版本：${GREEN}${LATEST_VER}${PLAIN}"

DOWNLOAD_URL="${DOWNLOAD_BASE_URL}/${LATEST_VER}/shadowsocks-${LATEST_VER}.${ARCH}.tar.xz"
echo -e "下载 URL：${YELLOW}${DOWNLOAD_URL}${PLAIN}"


# ======================================
#        下载并安装 shadowsocks-rust
# ======================================
TMP_DIR=$(mktemp -d)

echo "下载中…"
wget -O "${TMP_DIR}/ss-rust.tar.xz" "${DOWNLOAD_URL}"

echo "解压…"
tar -xf "${TMP_DIR}/ss-rust.tar.xz" -C "${TMP_DIR}"

for bin in ssserver sslocal ssurl; do
    if [ -f "${TMP_DIR}/${bin}" ]; then
        mv "${TMP_DIR}/${bin}" /usr/local/bin/
        chmod +x "/usr/local/bin/${bin}"
    fi
done

rm -rf "${TMP_DIR}"

if ! command -v ssserver >/dev/null; then
    echo -e "${RED}安装失败：未找到 ssserver${PLAIN}"
    exit 1
fi

echo -e "${GREEN}Shadowsocks-rust 安装成功${PLAIN}"


# ======================================
#           写入配置文件
# ======================================
echo -e "${YELLOW}[4/7] 写入配置文件…${PLAIN}"

mkdir -p /etc/shadowsocks-rust

cat > /etc/shadowsocks-rust/config.json <<EOF
{
    "server": "0.0.0.0",
    "server_port": ${SS_PORT},
    "password": "${SS_PASSWORD}",
    "method": "${SS_METHOD}",
    "timeout": 300,
    "mode": "tcp_and_udp",
    "fast_open": true
}
EOF

echo -e "配置文件：${GREEN}/etc/shadowsocks-rust/config.json${PLAIN}"


# ======================================
#             Systemd 服务
# ======================================
echo -e "${YELLOW}[5/7] 写入 Systemd 服务…${PLAIN}"

cat > /etc/systemd/system/shadowsocks-rust.service <<EOF
[Unit]
Description=Shadowsocks-Rust Server
After=network.target

[Service]
Type=simple
User=root
LimitNOFILE=65535
ExecStart=/usr/local/bin/ssserver -c /etc/shadowsocks-rust/config.json
Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable shadowsocks-rust
systemctl restart shadowsocks-rust


# ======================================
#                BBR
# ======================================
echo -e "${YELLOW}[6/7] 检测 BBR…${PLAIN}"

if sysctl net.ipv4.tcp_available_congestion_control | grep -q "bbr"; then
    read -rp "内核支持 BBR，是否启用？[Y/n] " REPLY
    if [[ "$REPLY" =~ ^[Yy]$ || -z "$REPLY" ]]; then
        cat > /etc/sysctl.d/99-ss-bbr.conf <<EOF
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
EOF
        sysctl --system >/dev/null
        echo -e "${GREEN}BBR 已启用${PLAIN}"
    fi
else
    echo -e "${YELLOW}内核不支持 BBR${PLAIN}"
fi


# ======================================
#          输出连接信息
# ======================================
echo -e "${YELLOW}[7/7] 生成 ss:// 连接…${PLAIN}"

PUBLIC_IP=$(curl -s https://api.ipify.org || echo "your_server_ip")

BASE64_STR=$(echo -n "${SS_METHOD}:${SS_PASSWORD}" | base64 -w 0)
SS_URL="ss://${BASE64_STR}@${PUBLIC_IP}:${SS_PORT}#SS-Rust-1445"

echo -e "${GREEN}=============================================${PLAIN}"
echo -e "服务器 IP ： ${GREEN}${PUBLIC_IP}${PLAIN}"
echo -e "端口 Port ： ${GREEN}${SS_PORT}${PLAIN}"
echo -e "密码 Pass ： ${GREEN}${SS_PASSWORD}${PLAIN}"
echo -e "加密方式   ： ${GREEN}${SS_METHOD}${PLAIN}"
echo
echo -e "导入链接："
echo -e "${GREEN}${SS_URL}${PLAIN}"
echo
echo -e "二维码："
qrencode -t ansiutf8 "${SS_URL}" || echo "二维码生成失败"
echo -e "${GREEN}=============================================${PLAIN}"

echo -e "配置文件： /etc/shadowsocks-rust/config.json"
echo -e "服务管理： systemctl status shadowsocks-rust"
echo -e "重启服务： systemctl restart shadowsocks-rust"