#!/bin/bash

# --- 变量配置 ---
WG_IFACE="wg0"
WG_PORT="1447"
WG_SUBNET="10.100.0" # 子网前缀
WG_CONFIG="/etc/wireguard/${WG_IFACE}.conf"

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
CYAN='\033[0;36m'
PLAIN='\033[0m'

# 1. 检查 Root 权限
if [ "$(id -u)" -ne 0 ]; then
    echo -e "${RED}错误：必须以 root 权限运行此脚本。${PLAIN}"
    exit 1
fi

# ================= 功能 1：安装 WireGuard =================
install_wg() {
    echo -e "${GREEN}=============================================${PLAIN}"
    echo -e "${GREEN}      开始安装 WireGuard 服务端...           ${PLAIN}"
    echo -e "${GREEN}=============================================${PLAIN}"

    echo -e "${YELLOW}[1/7] 更新系统并安装依赖...${PLAIN}"
    apt-get update
    apt-get install -y wireguard qrencode iptables curl iproute2 openresolv

    echo -e "${YELLOW}[2/7] 检测网络配置...${PLAIN}"
    PUBLIC_IP=$(curl -s ifconfig.me)
    if [ -z "$PUBLIC_IP" ]; then
        PUBLIC_IP=$(curl -s 4.ipw.cn)
    fi
    if [ -z "$PUBLIC_IP" ]; then
        echo -e "${RED}错误：无法获取公网 IP，请检查网络连接。${PLAIN}"
        exit 1
    fi

    # 获取默认出网网卡
    PUB_NIC=$(ip -4 route show default | grep -oP '(?<=dev )(\S+)' | head -1)
    if [ -z "$PUB_NIC" ]; then
        echo -e "${RED}错误：无法检测到默认网卡。${PLAIN}"
        exit 1
    fi
    echo -e "公网 IP: ${GREEN}${PUBLIC_IP}${PLAIN}"
    echo -e "主网卡: ${GREEN}${PUB_NIC}${PLAIN}"

    echo -e "${YELLOW}[3/7] 生成服务器端密钥...${PLAIN}"
    mkdir -p /etc/wireguard
    chmod 700 /etc/wireguard
    SERVER_PRI_KEY=$(wg genkey)

    echo -e "${YELLOW}[4/7] 写入服务器配置 (${WG_CONFIG})...${PLAIN}"
    cat > "${WG_CONFIG}" <<EOF
[Interface]
# 服务器内网 IP
Address = ${WG_SUBNET}.1/24
# 监听端口
ListenPort = ${WG_PORT}
# 服务器私钥
PrivateKey = ${SERVER_PRI_KEY}

MTU = 1360

# 启动后加载防火墙规则 (防Docker冲突优化版：使用 -I 插在最前，允许双向FORWARD)
PostUp = iptables -I FORWARD -i ${WG_IFACE} -j ACCEPT; iptables -I FORWARD -o ${WG_IFACE} -j ACCEPT; iptables -t nat -A POSTROUTING -o ${PUB_NIC} -j MASQUERADE
# 关闭后清理防火墙规则
PostDown = iptables -D FORWARD -i ${WG_IFACE} -j ACCEPT; iptables -D FORWARD -o ${WG_IFACE} -j ACCEPT; iptables -t nat -D POSTROUTING -o ${PUB_NIC} -j MASQUERADE
EOF
    chmod 600 "${WG_CONFIG}"

    echo -e "${YELLOW}[5/7] 开启内核 IPv4 转发...${PLAIN}"
    sed -i '/net.ipv4.ip_forward/d' /etc/sysctl.conf
    echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
    sysctl -p > /dev/null

    echo -e "${YELLOW}[6/7] 启动 WireGuard 服务...${PLAIN}"
    systemctl enable wg-quick@${WG_IFACE}
    systemctl restart wg-quick@${WG_IFACE}

    if systemctl is-active --quiet wg-quick@${WG_IFACE}; then
        echo -e "${GREEN}WireGuard 服务端安装并启动成功！${PLAIN}"
    else
        echo -e "${RED}WireGuard 服务启动失败，请检查日志 (journalctl -xe)。${PLAIN}"
        exit 1
    fi

    # 自动生成第一个客户端
    echo -e "${YELLOW}[7/7] 正在生成第一个客户端...${PLAIN}"
    add_client "client_1"
}

# ================= 功能 2：添加客户端 =================
add_client() {
    if [ ! -f "${WG_CONFIG}" ]; then
        echo -e "${RED}错误：未找到配置文件 ${WG_CONFIG}，请先执行安装步骤！${PLAIN}"
        exit 1
    fi

    # 如果没有传递参数，则询问客户端名称
    if [ -z "$1" ]; then
        read -p "请输入新客户端名称 (如 phone, pc, mac): " CLIENT_NAME
        if [ -z "$CLIENT_NAME" ]; then
            echo -e "${RED}名称不能为空！${PLAIN}"
            exit 1
        fi
    else
        CLIENT_NAME="$1"
    fi

    CLIENT_CONFIG_FILE="${HOME}/wg_${CLIENT_NAME}.conf"
    if [ -f "${CLIENT_CONFIG_FILE}" ]; then
        echo -e "${RED}错误：客户端配置文件 ${CLIENT_CONFIG_FILE} 已存在，请换一个名称！${PLAIN}"
        exit 1
    fi

    # 自动计算下一个可用的 IP
    # 提取 wg0.conf 中所有 AllowedIPs 的最后一位数字，找到最大值并加 1
    LAST_IP=$(grep AllowedIPs "${WG_CONFIG}" | awk -F '[./]' '{print $4}' | sort -n | tail -1)
    if [ -z "$LAST_IP" ]; then
        NEXT_IP=2 # 如果没有找到任何客户端，从 2 开始
    else
        NEXT_IP=$((LAST_IP + 1))
    fi

    if [ "$NEXT_IP" -gt 254 ]; then
        echo -e "${RED}错误：子网 IP 已满，无法添加更多客户端！${PLAIN}"
        exit 1
    fi

    CLIENT_IP="${WG_SUBNET}.${NEXT_IP}"

    # 获取服务器信息
    SERVER_PRI_KEY=$(grep PrivateKey "${WG_CONFIG}" | awk '{print $3}')
    SERVER_PUB_KEY=$(echo "${SERVER_PRI_KEY}" | wg pubkey)
    PUBLIC_IP=$(curl -s ifconfig.me)
    if [ -z "$PUBLIC_IP" ]; then PUBLIC_IP=$(curl -s 4.ipw.cn); fi

    # 生成客户端密钥
    CLIENT_PRI_KEY=$(wg genkey)
    CLIENT_PUB_KEY=$(echo "${CLIENT_PRI_KEY}" | wg pubkey)
    PRE_SHARED_KEY=$(wg genpsk)

    echo -e "${YELLOW}正在为 ${CYAN}${CLIENT_NAME}${YELLOW} 分配 IP: ${CYAN}${CLIENT_IP}${PLAIN} ..."

    # 追加到服务器配置
    cat >> "${WG_CONFIG}" <<EOF

# Client: ${CLIENT_NAME}
[Peer]
PublicKey = ${CLIENT_PUB_KEY}
PresharedKey = ${PRE_SHARED_KEY}
AllowedIPs = ${CLIENT_IP}/32
EOF

    # 生成客户端配置文件
    cat > "${CLIENT_CONFIG_FILE}" <<EOF
[Interface]
# 客户端私钥
PrivateKey = ${CLIENT_PRI_KEY}
# 客户端内网 IP
Address = ${CLIENT_IP}/24
# 推荐 DNS
DNS = 8.8.8.8, 1.1.1.1

[Peer]
# 服务器公钥
PublicKey = ${SERVER_PUB_KEY}
# 服务器地址:端口
Endpoint = ${PUBLIC_IP}:${WG_PORT}
# 预共享密钥
PresharedKey = ${PRE_SHARED_KEY}
# 全局代理
AllowedIPs = 0.0.0.0/0, ::/0
# 保持连接心跳
PersistentKeepalive = 25
EOF

    # 重启服务使配置生效
    systemctl restart wg-quick@${WG_IFACE}

    echo -e "${GREEN}=============================================${PLAIN}"
    echo -e "客户端 ${CYAN}${CLIENT_NAME}${PLAIN} 添加成功！"
    echo -e "配置文件已保存至: ${YELLOW}${CLIENT_CONFIG_FILE}${PLAIN}"
    echo -e "${GREEN}=============================================${PLAIN}"
    echo -e "请使用 WireGuard 手机 App 扫描下方二维码："
    echo ""

    # 显示二维码
    qrencode -t ansiutf8 < "${CLIENT_CONFIG_FILE}"

    echo ""
    echo -e "${GREEN}如需下载到电脑，请使用 SFTP 下载此文件：${CLIENT_CONFIG_FILE}${PLAIN}"
}

# ================= 交互菜单 =================
echo -e "${CYAN}=============================================${PLAIN}"
echo -e "${CYAN}      WireGuard 极简管理脚本 (Debian)        ${PLAIN}"
echo -e "${CYAN}=============================================${PLAIN}"
echo -e "  ${GREEN}1.${PLAIN} 安装 WireGuard (首次运行)"
echo -e "  ${GREEN}2.${PLAIN} 添加新客户端 (增加手机/电脑等设备)"
echo -e "  ${GREEN}3.${PLAIN} 退出脚本"
echo -e "${CYAN}=============================================${PLAIN}"
read -p "请输入数字 [1-3]: " MENU_CHOICE

case $MENU_CHOICE in
    1)
        install_wg
        ;;
    2)
        add_client
        ;;
    3)
        exit 0
        ;;
    *)
        echo -e "${RED}输入错误，请输入 1、2 或 3。${PLAIN}"
        exit 1
        ;;
esac