#!/bin/bash
# ============================================================
# kangle + easypanel 一键部署（CentOS 7 x64）
#
# 用法:
#   bash install.sh --check    仅做环境检查，不安装（安全）
#   bash install.sh            全新安装
#   bash install.sh --force    已有 kangle 时覆盖安装（会先备份）
#
# 状态: kangle 安装/模板部署/加固 已在生产机验证；
#       PHP 编译与 MySQL 安装尚未端到端验证（见 docs/一键部署方案.md）
# ============================================================
set -uo pipefail

KANGLE_VER="${KANGLE_VER:-3.5.21.16}"
FILE_SRC="http://file.kangle.cccyun.cn/file"
PREFIX=/vhs/kangle
REPO="$(cd "$(dirname "$0")" && pwd)"
MODE="${1:-}"

red() { printf "\033[31m%s\033[0m\n" "$*"; }
grn() { printf "\033[32m%s\033[0m\n" "$*"; }
ylw() { printf "\033[33m%s\033[0m\n" "$*"; }
step() { echo; grn "==== $* ===="; }

need_root() { [ "$(id -u)" = "0" ] || { red "请用 root 运行"; exit 1; }; }

check_env() {
  step "环境检查"
  need_root
  [ -f /etc/redhat-release ] || { red "仅支持 CentOS/RHEL"; exit 1; }
  [ "$(arch)" = "x86_64" ] || { red "仅支持 x86_64"; exit 1; }
  REL=$(rpm -q --qf '%{VERSION}' centos-release | cut -d. -f1)
  [ "$REL" -ge 9 ] 2>/dev/null && { red "不支持 CentOS 9+"; exit 1; }
  grn "系统: $(cat /etc/redhat-release)"
  grn "内存: $(free -m | awk '/Mem:/{print $2}')MB, 磁盘可用: $(df -h / | tail -1 | awk '{print $4}')"

  echo "-- 端口占用 --"
  for p in 80 443 3311 3312; do
    if ss -lnt 2>/dev/null | grep ":$p " >/dev/null; then ylw "端口 $p 已占用"; else echo "端口 $p 空闲"; fi
  done

  echo "-- 安装源 --"
  URL="$FILE_SRC/completed/kangle-ent-$KANGLE_VER-$REL-x64.tar.gz"
  CODE=$(curl -s -o /dev/null -m 15 -w '%{http_code}' "$URL")
  [ "$CODE" = "200" ] && grn "kangle 包可用" || red "kangle 包不可达 (HTTP $CODE)"
  echo "  URL: $URL"

  if [ -x "$PREFIX/bin/kangle" ]; then
    ylw "已安装: $("$PREFIX/bin/kangle" -v 2>/dev/null | head -1)"
    [ "$MODE" = "--force" ] || ylw "覆盖安装请加 --force"
  fi
}

install_deps() {
  step "安装依赖"
  yum -y install wget curl tar gzip unzip vim net-tools lsof \
    gcc gcc-c++ make autoconf automake libtool bison cmake3 \
    pcre-devel zlib-devel openssl-devel libxml2-devel sqlite-devel 2>&1 | tail -3
  grn "依赖完成"
}

install_kangle() {
  step "安装 kangle $KANGLE_VER"
  if [ -x "$PREFIX/bin/kangle" ] && [ "$MODE" != "--force" ]; then
    ylw "已存在 kangle，跳过（如需覆盖用 --force）"; return 0
  fi
  [ -d "$PREFIX" ] && tar czf "/root/kangle_backup_$(date +%s).tar.gz" -C /vhs kangle 2>/dev/null
  TMP=$(mktemp -d)
  URL="$FILE_SRC/completed/kangle-ent-$KANGLE_VER-$REL-x64.tar.gz"
  wget -q "$URL" -O "$TMP/k.tar.gz" || { red "下载失败"; return 1; }
  tar xzf "$TMP/k.tar.gz" -C "$TMP"
  mkdir -p "$PREFIX"
  cp -a "$TMP"/kangle/. "$PREFIX"/
  chmod 700 "$PREFIX/etc" 2>/dev/null
  find "$TMP" -mindepth 1 -delete; rmdir "$TMP" 2>/dev/null
  grn "kangle 已释放到 $PREFIX"
}

deploy_template() {
  step "部署面板模板"
  if [ -d /vhs/kangle/nodewww/webftp/vhost ]; then
    bash "$REPO/deploy/apply-panel-template.sh"
  else
    ylw "未检测到 easypanel（nodewww/webftp），跳过模板部署"
  fi
}

harden() {
  step "PHP 加固"
  bash "$REPO/deploy/harden-php.sh" || ylw "加固未完成（可能尚未安装 PHP）"
}

start_kangle() {
  step "启动"
  [ -x "$PREFIX/bin/kangle" ] || { red "未找到 kangle"; return 1; }
  "$PREFIX/bin/kangle" || ylw "启动返回非 0，见 $PREFIX/var/server.log"
  sleep 2
  ss -lnt 2>/dev/null | grep -E ':(80|3311|3312) ' | head -3
}

check_env
[ "$MODE" = "--check" ] && { grn "仅检查，未做变更"; exit 0; }
install_deps && install_kangle && deploy_template && harden && start_kangle

echo
grn "================ 完成 ================"
cat <<'TIP'
后续（面板或单独脚本）：
  1. 安装 PHP 各版本到 /vhs/kangle/ext/
  2. 安装 MySQL + pure-ftpd
  3. 管理端 http://<IP>:3312/admin/   用户端 http://<IP>:3312/vhost/
TIP