#!/usr/bin/env bash
set -euo pipefail

# 在 proxy-ng 节点上执行的安装骨架。
# 该脚本只处理 nginx 基础安装和配置落位；DNS、证书签发、真实密钥分发仍由人工或运维系统完成。

if [[ "${EUID}" -ne 0 ]]; then
  echo "must run as root" >&2
  exit 1
fi

ENV_FILE="${1:-/etc/proxy-ng/proxy-ng.env}"
if [[ ! -f "${ENV_FILE}" ]]; then
  echo "env file not found: ${ENV_FILE}" >&2
  exit 1
fi

# shellcheck disable=SC1090
source "${ENV_FILE}"

required_vars=(
  PROXY_NG_DOMAIN
  PROXY_NG_NODE_NAME
  SUB2API_BACKEND_ORIGIN
  SUB2API_BACKEND_ORIGIN_HOST
  PROXY_NG_TOKEN_FILE
  TLS_CERT_PATH
  TLS_KEY_PATH
)

for name in "${required_vars[@]}"; do
  if [[ -z "${!name:-}" ]]; then
    echo "missing required env: ${name}" >&2
    exit 1
  fi
done

apt-get update
apt-get install -y nginx openssl ca-certificates curl

install -d -m 0755 /etc/proxy-ng
install -d -m 0700 /etc/nginx/proxy-ng

if [[ ! -f "${PROXY_NG_TOKEN_FILE}" ]]; then
  echo "token file not found: ${PROXY_NG_TOKEN_FILE}" >&2
  echo "create it as root-only, for example: set \\$proxy_ng_expected_token \"<token>\";" >&2
  exit 1
fi
chmod 600 "${PROXY_NG_TOKEN_FILE}"
chown root:root "${PROXY_NG_TOKEN_FILE}"

TEMPLATE_PATH="${PROXY_NG_TEMPLATE_PATH:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/nginx/proxy-node.conf.template}"
if [[ ! -f "${TEMPLATE_PATH}" ]]; then
  echo "template not found: ${TEMPLATE_PATH}" >&2
  exit 1
fi

sed \
  -e "s|{{DOMAIN}}|${PROXY_NG_DOMAIN}|g" \
  -e "s|{{NODE_NAME}}|${PROXY_NG_NODE_NAME}|g" \
  -e "s|{{BACKEND_ORIGIN}}|${SUB2API_BACKEND_ORIGIN}|g" \
  -e "s|{{BACKEND_ORIGIN_HOST}}|${SUB2API_BACKEND_ORIGIN_HOST}|g" \
  -e "s|{{PROXY_NG_TOKEN_FILE}}|${PROXY_NG_TOKEN_FILE}|g" \
  -e "s|{{TLS_CERT_PATH}}|${TLS_CERT_PATH}|g" \
  -e "s|{{TLS_KEY_PATH}}|${TLS_KEY_PATH}|g" \
  "${TEMPLATE_PATH}" > /etc/nginx/nginx.conf

nginx -t
systemctl enable --now nginx
systemctl reload nginx

echo "proxy-ng node installed: ${PROXY_NG_NODE_NAME} (${PROXY_NG_DOMAIN})"