#!/usr/bin/env bash
[ -n "${BASH_VERSION:-}" ] || exec bash "$0" "$@"
set -Eeuo pipefail
umask 077
ID=__ID__
ROOT=/etc/hy2-panel-relay
[ "$(id -u)" -eq 0 ] && [ -d /run/systemd/system ] || { echo '需要 root 和 systemd Linux。'; exit 1; }
if [ -d "$ROOT" ] || [ -e /etc/systemd/system/hy2-panel-relay.service ]; then
  [ "$(cat "$ROOT/host-id" 2>/dev/null || true)" = "$ID" ] || { echo '已有其他中转安装，停止以避免覆盖。'; exit 1; }
fi
case "$(uname -m)" in
  x86_64) ARCH=x86_64; SHA=b1cc335547bea8bb2a88178bef12ec7f2363e36200e7ea1d4e1e67627929bf65;;
  aarch64|arm64) ARCH=aarch64; SHA=f4c0318dd86854da483dcb7645b4f39cae2cc3f91c688fef969d53220b949488;;
  *) echo '支持 x86_64 / ARM64。'; exit 1;;
esac
if command -v apt-get >/dev/null; then apt-get update; DEBIAN_FRONTEND=noninteractive apt-get install -y curl ca-certificates python3 tar
elif command -v dnf >/dev/null; then dnf install -y curl ca-certificates python3 tar
else echo '需要 Debian/Ubuntu 或 dnf 发行版。'; exit 1; fi
WORK=$(mktemp -d)
trap 'rm -rf "$WORK"' EXIT
curl -fsSL --retry 3 --connect-timeout 20 --max-time 300 "https://github.com/zhboner/realm/releases/download/v2.9.6/realm-$ARCH-unknown-linux-musl.tar.gz" -o "$WORK/realm.tar.gz"
printf '%s  %s\n' "$SHA" "$WORK/realm.tar.gz" | sha256sum -c -
tar -xzf "$WORK/realm.tar.gz" -C "$WORK" realm
systemctl stop hy2-panel-relay-agent.service hy2-panel-relay.service 2>/dev/null || true
install -d -m 700 "$ROOT" /usr/local/lib/hy2-panel-relay
printf '%s' "$ID" > "$ROOT/host-id"
printf '%s' __PAYLOAD__ | base64 -d > "$WORK/payload.json"
python3 - "$WORK/payload.json" <<'PY'
import json,sys
from pathlib import Path
p=json.load(open(sys.argv[1]))
Path('/etc/hy2-panel-relay/agent.json').write_text(json.dumps(p['credentials']))
Path('/usr/local/lib/hy2-panel-relay/agent.py').write_text(p['source'])
PY
install -m 755 "$WORK/realm" /usr/local/lib/hy2-panel-relay/realm
cat > /etc/systemd/system/hy2-panel-relay.service <<'UNIT'
[Unit]
Description=HY2 Panel Realm relay
After=network-online.target
[Service]
ExecStart=/usr/local/lib/hy2-panel-relay/realm -c /etc/hy2-panel-relay/config.json
Restart=on-failure
RestartSec=3
LimitNOFILE=1048576
NoNewPrivileges=true
ProtectHome=true
ProtectSystem=strict
PrivateTmp=true
UNIT
cat > /etc/systemd/system/hy2-panel-relay-agent.service <<'UNIT'
[Unit]
Description=HY2 Panel relay management agent
After=network-online.target
Wants=network-online.target
[Service]
ExecStart=/usr/bin/python3 /usr/local/lib/hy2-panel-relay/agent.py
ExecStopPost=/bin/systemctl stop hy2-panel-relay.service
Restart=always
RestartSec=5
NoNewPrivileges=true
ProtectHome=true
ProtectSystem=strict
ReadWritePaths=/etc/hy2-panel-relay
PrivateTmp=true
[Install]
WantedBy=multi-user.target
UNIT
systemctl daemon-reload
systemctl enable --now hy2-panel-relay-agent.service
echo '中转管理程序已启动，请在面板配置线路并确认状态。无需开放公网管理端口。'