#!/bin/bash

echo "========== FRP服务端部署脚本 =========="
echo "公网域名: v4-vpn.lizhiyun.top"
echo "服务器内网IP: 10.0.0.93"
echo "======================================"

# 1. 更换yum源
echo "步骤1: 更换yum源到阿里云..."
cd /etc/yum.repos.d/
mkdir -p backup
mv *.repo backup/ 2>/dev/null || true

# 下载阿里云yum源
if curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo; then
    echo "yum源更换成功"
else
    echo "警告: yum源下载失败，使用备份恢复"
    cp backup/*.repo /etc/yum.repos.d/ 2>/dev/null || true
fi

# 清理并重建缓存
yum clean all
yum makecache -y

# 安装必要工具
echo "安装必要工具..."
yum install -y wget tar vim net-tools firewalld

# 2. 下载和安装FRP（使用指定下载地址）
echo "步骤2: 下载和安装FRP..."
cd /tmp

FRP_PACKAGE="frp_0.52.3_linux_amd64.tar.gz"
DOWNLOAD_URL="https://download.lizhiyun.top/${FRP_PACKAGE}"

echo "从 ${DOWNLOAD_URL} 下载FRP..."
if wget --timeout=30 --tries=3 "${DOWNLOAD_URL}"; then
    echo "下载成功"
else
    echo "错误: FRP下载失败，请检查网络"
    exit 1
fi

# 解压
tar -zxvf "$FRP_PACKAGE"

# 创建安装目录
sudo mkdir -p /usr/local/frp
sudo cp -r frp_0.52.3_linux_amd64/* /usr/local/frp/

# 3. 配置FRP服务端
echo "步骤3: 配置FRP服务端..."
cat > /tmp/frps.toml << 'EOF'
bindPort = 7000
auth.token = "1qaz@WSX"

# 仪表板配置
webServer.addr = "0.0.0.0"
webServer.port = 7500
webServer.user = "admin"
webServer.password = "g!&xB?vKDY?ZTe8"

# 日志配置
log.to = "/var/log/frp/frps.log"
log.level = "info"
log.maxDays = 3

# 传输配置
transport.tcpMux = true
transport.maxPoolCount = 50

# 端口范围限制（与端口映射一致）
allowPorts = [
    { start = 6000, end = 6999 }
]
EOF

sudo mv /tmp/frps.toml /usr/local/frp/frps.toml

# 创建日志目录
echo "设置目录权限..."
sudo mkdir -p /var/log/frp
sudo chown -R nobody:nobody /var/log/frp
sudo chmod 755 /var/log/frp

# 创建日志文件
sudo touch /var/log/frp/frps.log
sudo chown nobody:nobody /var/log/frp/frps.log
sudo chmod 644 /var/log/frp/frps.log

# 设置FRP目录权限
sudo chown -R nobody:nobody /usr/local/frp
sudo chmod 755 /usr/local/frp
sudo chmod 755 /usr/local/frp/frps

# 4. 创建systemd服务
echo "步骤4: 创建systemd服务..."
cat > /tmp/frps.service << 'EOF'
[Unit]
Description=Frp Server Service
After=network.target
Wants=network.target

[Service]
Type=simple
User=nobody
Group=nobody
Restart=on-failure
RestartSec=5s
WorkingDirectory=/usr/local/frp
ExecStart=/usr/local/frp/frps -c /usr/local/frp/frps.toml
LimitNOFILE=1048576

# 设置日志目录权限
PermissionsStartOnly=true
ExecStartPre=/bin/mkdir -p /var/log/frp
ExecStartPre=/bin/chown nobody:nobody /var/log/frp
ExecStartPre=/bin/chmod 755 /var/log/frp

StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

sudo mv /tmp/frps.service /etc/systemd/system/frps.service

# 5. 配置防火墙（TCP+UDP）
echo "步骤5: 配置防火墙..."
sudo systemctl enable firewalld --now

# 开放TCP端口
PORTS_TCP=("7000/tcp" "7500/tcp" "80/tcp" "443/tcp")
for port in "${PORTS_TCP[@]}"; do
    echo "开放TCP端口: $port"
    sudo firewall-cmd --permanent --add-port=$port
done

# 开放UDP端口
PORTS_UDP=("7000/udp" "7500/udp")
for port in "${PORTS_UDP[@]}"; do
    echo "开放UDP端口: $port"
    sudo firewall-cmd --permanent --add-port=$port
done

# 开放转发端口范围（TCP和UDP）
sudo firewall-cmd --permanent --add-port=6000-6999/tcp
sudo firewall-cmd --permanent --add-port=6000-6999/udp

sudo firewall-cmd --reload

echo "当前开放的端口:"
sudo firewall-cmd --list-ports

# 6. 启动FRP服务
echo "步骤6: 启动FRP服务..."
sudo systemctl daemon-reload
sudo systemctl enable frps
sudo systemctl start frps

# 7. 验证服务
echo "步骤7: 验证服务运行状态..."
sleep 2

echo "检查服务状态:"
sudo systemctl status frps --no-pager -l

echo -e "\n检查端口监听:"
sudo netstat -tlnup | grep -E "(7000|7500)" || ss -tlnup | grep -E "(7000|7500)"

echo -e "\n检查日志:"
sudo journalctl -u frps -n 20 --no-pager

# 8. 显示访问信息
echo -e "\n========== 部署完成 =========="
echo "公网域名: v4-vpn.lizhiyun.top"
echo "服务器内网IP: 10.0.0.93"
echo "FRP服务端口: 7000 (TCP+UDP)"
echo "管理面板地址: http://v4-vpn.lizhiyun.top:7500"
echo "管理面板用户名: admin"
echo "管理面板密码: g!&xB?vKDY?ZTe8"
echo "认证Token: 1qaz@WSX"
echo "转发端口范围: 6000-6999 (TCP+UDP)"
echo "======================================"
echo -e "\n使用以下命令查看日志:"
echo "sudo journalctl -u frps -f"
echo -e "\n重启服务:"
echo "sudo systemctl restart frps"

# 9. 显示端口映射验证信息
echo -e "\n========== 端口映射验证 =========="
echo "请确保路由器端口映射配置如下:"
echo "1. FRP服务器端口: 10.0.0.93:7000 -> 公网:7000 (tcp+udp)"
echo "2. FRP管理面板: 10.0.0.93:7500 -> 公网:7500 (tcp+udp)"
echo "3. FRP转发端口: 10.0.0.93:6000-6999 -> 公网:6000-6999 (tcp+udp)"
echo "4. HTTP服务(可选): 10.0.0.93:80 -> 公网:80 (tcp)"
echo "5. HTTPS服务(可选): 10.0.0.93:443 -> 公网:443 (tcp)"
echo "======================================"

# 10. 测试连接
echo -e "\n========== 测试连接 =========="
echo "测试FRP服务连接:"
echo "telnet v4-vpn.lizhiyun.top 7000"
echo -e "\n访问管理面板:"
echo "浏览器打开: http://v4-vpn.lizhiyun.top:7500"
echo "用户名: admin"
echo "密码: g!&xB?vKDY?ZTe8"