#!/usr/bin/env bash
#
# Автоустановка: VLESS+XHTTP+Reality (443) + VLESS+TCP+Vision+Reality (8443) + Hysteria2 (443/udp)
# Ubuntu 22.04/24.04, запускать от root: sudo bash install.sh
#
set -euo pipefail

# ========================= НАСТРОЙКИ (отредактируйте перед запуском) =========================
DOMAIN=""                          # ваш домен, нужен для сертификата (letsencrypt), напр. example.com
DEST_XHTTP="addons.mozilla.org"    # dest-домен для XHTTP-Reality инбаунда
DEST_TCP="www.lovelive-anime.jp"   # dest-домен для TCP-Vision-Reality инбаунда (должен ОТЛИЧАТЬСЯ от первого)
HYSTERIA_MASQ_URL="https://www.bing.com"  # сайт-прикрытие для Hysteria2 masquerade
TELEGRAM_BOT_TOKEN=""              # опционально: для алертов мониторинга
TELEGRAM_CHAT_ID=""                # опционально
# ==============================================================================================

if [[ $EUID -ne 0 ]]; then
  echo "Запускать от root: sudo bash install.sh"
  exit 1
fi

if [[ -z "$DOMAIN" ]]; then
  echo "Укажите DOMAIN в начале скрипта (нужен для TLS-сертификата Hysteria2/Trojan)."
  exit 1
fi

WORKDIR="/opt/vpn-setup"
mkdir -p "$WORKDIR"
cd "$WORKDIR"

echo "== 1/9: Обновление системы и зависимости =="
apt-get update -y
apt-get install -y curl wget unzip jq openssl uuid-runtime certbot socat cron

echo "== 2/9: Установка Xray-core =="
bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
XRAY_BIN="/usr/local/bin/xray"

echo "== 3/9: Установка Hysteria2 =="
bash <(curl -fsSL https://get.hy2.sh/)

echo "== 4/9: Получение TLS-сертификата (для Hysteria2) =="
systemctl stop nginx 2>/dev/null || true
if [[ ! -f "/etc/letsencrypt/live/${DOMAIN}/fullchain.pem" ]]; then
  certbot certonly --standalone --non-interactive --agree-tos -m "admin@${DOMAIN}" -d "${DOMAIN}"
fi
CERT_PATH="/etc/letsencrypt/live/${DOMAIN}/fullchain.pem"
KEY_PATH="/etc/letsencrypt/live/${DOMAIN}/privkey.pem"

echo "== 5/9: Генерация ключей, UUID, паролей =="
UUID1=$(uuidgen)
UUID2=$(uuidgen)
REALITY_KEYS=$($XRAY_BIN x25519)
PRIVATE_KEY=$(echo "$REALITY_KEYS" | grep -i "Private" | awk '{print $NF}')
PUBLIC_KEY=$(echo "$REALITY_KEYS" | grep -i "Public" | awk '{print $NF}')
SHORT_ID1=$(openssl rand -hex 8)
SHORT_ID2=$(openssl rand -hex 8)
XHTTP_PATH="/$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 16)/"
HYSTERIA_PASSWORD=$(openssl rand -hex 16)
HYSTERIA_OBFS_PASSWORD=$(openssl rand -hex 16)

echo "== 6/9: Конфигурация Xray (2 инбаунда) =="
mkdir -p /usr/local/etc/xray
cat > /usr/local/etc/xray/config.json <<EOF
{
  "log": { "loglevel": "warning" },
  "inbounds": [
    {
      "tag": "vless-xhttp-reality",
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [{"id": "${UUID1}", "flow": "", "email": "primary"}],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "reality",
        "xhttpSettings": {
          "host": "${DEST_XHTTP}",
          "path": "${XHTTP_PATH}",
          "mode": "stream-up",
          "scMaxEachPostBytes": "500000-1000000",
          "scMinPostsIntervalMs": "30-100",
          "scMaxBufferedPosts": 30,
          "extra": {
            "xPaddingBytes": "100-1000",
            "xmux": {
              "maxConcurrency": "16-32",
              "hMaxRequestTimes": "600-900",
              "hMaxReusableSecs": "1800-3600"
            }
          }
        },
        "realitySettings": {
          "show": false,
          "dest": "${DEST_XHTTP}:443",
          "serverNames": ["${DEST_XHTTP}"],
          "privateKey": "${PRIVATE_KEY}",
          "shortIds": ["${SHORT_ID1}"],
          "fingerprint": "chrome",
          "alpn": ["h2"],
          "spiderX": "/"
        }
      },
      "sniffing": { "enabled": true, "destOverride": ["http", "tls"] }
    },
    {
      "tag": "vless-tcp-vision-reality",
      "listen": "0.0.0.0",
      "port": 8443,
      "protocol": "vless",
      "settings": {
        "clients": [{"id": "${UUID2}", "flow": "xtls-rprx-vision", "email": "backup"}],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "${DEST_TCP}:443",
          "serverNames": ["${DEST_TCP}"],
          "privateKey": "${PRIVATE_KEY}",
          "shortIds": ["${SHORT_ID2}"],
          "fingerprint": "chrome",
          "spiderX": "/"
        }
      },
      "sniffing": { "enabled": true, "destOverride": ["http", "tls"] }
    }
  ],
  "outbounds": [
    { "protocol": "freedom", "tag": "direct" },
    { "protocol": "blackhole", "tag": "block" }
  ]
}
EOF

echo "== 7/9: Конфигурация Hysteria2 (443/udp) =="
mkdir -p /etc/hysteria
cat > /etc/hysteria/config.yaml <<EOF
listen: :443

tls:
  cert: ${CERT_PATH}
  key: ${KEY_PATH}
  alpn:
    - h3

obfs:
  type: salamander
  salamander:
    password: ${HYSTERIA_OBFS_PASSWORD}

auth:
  type: password
  password: ${HYSTERIA_PASSWORD}

masquerade:
  type: proxy
  proxy:
    url: ${HYSTERIA_MASQ_URL}
    rewriteHost: true
  listenHTTP: :80
  listenHTTPS: :443
  forceHTTPS: true

bandwidth:
  up: 50 mbps
  down: 100 mbps

udpIdleTimeout: 60s
EOF

echo "== 8/9: Запуск сервисов =="
systemctl enable xray hysteria-server
systemctl restart xray
systemctl restart hysteria-server

echo "== 9/9: Открытие портов (ufw, если установлен) =="
if command -v ufw &> /dev/null; then
  ufw allow 443/tcp
  ufw allow 443/udp
  ufw allow 8443/tcp
  ufw allow 22/tcp
fi

# Сохраняем все параметры для монитора и вывода клиенту
cat > "$WORKDIR/params.env" <<EOF
DOMAIN=${DOMAIN}
SERVER_IP=$(curl -s https://api.ipify.org)
UUID1=${UUID1}
UUID2=${UUID2}
PUBLIC_KEY=${PUBLIC_KEY}
SHORT_ID1=${SHORT_ID1}
SHORT_ID2=${SHORT_ID2}
XHTTP_PATH=${XHTTP_PATH}
DEST_XHTTP=${DEST_XHTTP}
DEST_TCP=${DEST_TCP}
HYSTERIA_PASSWORD=${HYSTERIA_PASSWORD}
HYSTERIA_OBFS_PASSWORD=${HYSTERIA_OBFS_PASSWORD}
TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
TELEGRAM_CHAT_ID=${TELEGRAM_CHAT_ID}
EOF
chmod 600 "$WORKDIR/params.env"

SERVER_IP=$(curl -s https://api.ipify.org)

echo ""
echo "=================================================================================="
echo " УСТАНОВКА ЗАВЕРШЕНА"
echo "=================================================================================="
echo ""
echo "--- 1) VLESS + XHTTP + Reality (основной, порт 443) ---"
echo "vless://${UUID1}@${SERVER_IP}:443?type=xhttp&path=${XHTTP_PATH}&host=${DEST_XHTTP}&security=reality&pbk=${PUBLIC_KEY}&fp=chrome&sni=${DEST_XHTTP}&sid=${SHORT_ID1}&mode=stream-up#VLESS-XHTTP-Primary"
echo ""
echo "--- 2) VLESS + TCP + Vision + Reality (резерв, порт 8443) ---"
echo "vless://${UUID2}@${SERVER_IP}:8443?type=tcp&security=reality&pbk=${PUBLIC_KEY}&fp=chrome&sni=${DEST_TCP}&sid=${SHORT_ID2}&flow=xtls-rprx-vision#VLESS-TCP-Backup"
echo ""
echo "--- 3) Hysteria2 (резерв, порт 443/udp) ---"
echo "hysteria2://${HYSTERIA_PASSWORD}@${SERVER_IP}:443?obfs=salamander&obfs-password=${HYSTERIA_OBFS_PASSWORD}&sni=${DOMAIN}&insecure=0#Hysteria2-Backup"
echo ""
echo "Все параметры сохранены в: $WORKDIR/params.env"
echo "=================================================================================="