#!/usr/bin/env bash
# ==============================================================================
# 模块：系统架构识别、依赖安装与安全防火墙配置
# ==============================================================================

# 识别系统架构
detect_arch() {
    local raw_arch
    raw_arch=$(uname -m)
    case "${raw_arch}" in
        x86_64|amd64)
            echo "amd64"
            ;;
        aarch64|arm64)
            echo "arm64"
            ;;
        armv7*|armv8l)
            echo "armv7"
            ;;
        *)
            log_error "暂不支持的 CPU 架构: ${raw_arch}"
            return 1
            ;;
    esac
}

# 识别系统包管理器并安装基础依赖
install_dependencies() {
    log_info "检查并安装必要系统工具 (curl, tar, jq, openssl, ca-certificates)..."

    local pkgs=("curl" "tar" "jq" "openssl" "ca-certificates")

    if command -v apt-get >/dev/null 2>&1; then
        apt-get update -y >/dev/null 2>&1
        apt-get install -y "${pkgs[@]}" >/dev/null 2>&1
    elif command -v dnf >/dev/null 2>&1; then
        dnf install -y "${pkgs[@]}" >/dev/null 2>&1
    elif command -v yum >/dev/null 2>&1; then
        yum install -y "${pkgs[@]}" >/dev/null 2>&1
    elif command -v apk >/dev/null 2>&1; then
        apk update >/dev/null 2>&1
        apk add --no-cache "${pkgs[@]}" >/dev/null 2>&1
    else
        log_warn "未识别的包管理器，请手动确保安装了: ${pkgs[*]}"
    fi

    # 验证关键工具安装结果
    for cmd in curl tar jq openssl; do
        if ! command -v "$cmd" >/dev/null 2>&1; then
            log_error "关键依赖工具 [${cmd}] 安装失败，请检查网络或系统源设置！"
            return 1
        fi
    done

    log_success "系统基础依赖检测通过！"
    return 0
}

# 获取公网 IP（具备多节点故障自动切换机制）
get_public_ip() {
    local ip=""
    local apis=(
        "https://api.ipify.org"
        "https://icanhazip.com"
        "https://ifconfig.me/ip"
        "https://checkip.amazonaws.com"
    )

    for api in "${apis[@]}"; do
        ip=$(curl -s4m 4 "$api" 2>/dev/null | tr -d '[:space:]')
        if [[ -n "$ip" && "$ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "$ip"
            return 0
        fi
    done

    # 尝试获取 IPv6 (如果仅有 IPv6)
    ip=$(curl -s6m 4 "https://api64.ipify.org" 2>/dev/null | tr -d '[:space:]')
    if [[ -n "$ip" ]]; then
        echo "$ip"
        return 0
    fi

    echo "127.0.0.1"
}

# 安全配置防火墙：精准仅开放代理端口，杜绝关闭防火墙或全盘清空规则
open_firewall_port() {
    local port="$1"
    local protocol="${2:-tcp}"
    [[ -z "$port" ]] && return 0

    log_info "正在配置防火墙放行端口: ${port}/${protocol}..."

    # 1. 检测 UFW
    if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qw "active"; then
        ufw allow "${port}/${protocol}" comment "sing-box" >/dev/null 2>&1
        log_success "UFW 已放行端口 ${port}/${protocol}"
        return 0
    fi

    # 2. 检测 Firewalld
    if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld 2>/dev/null; then
        firewall-cmd --permanent --add-port="${port}/${protocol}" >/dev/null 2>&1
        firewall-cmd --reload >/dev/null 2>&1
        log_success "Firewalld 已放行端口 ${port}/${protocol}"
        return 0
    fi

    # 3. iptables 兜底安全追加（不重置现有规则链）
    if command -v iptables >/dev/null 2>&1; then
        if ! iptables -C INPUT -p "${protocol}" --dport "${port}" -j ACCEPT 2>/dev/null; then
            iptables -I INPUT -p "${protocol}" --dport "${port}" -j ACCEPT 2>/dev/null
            log_success "iptables 已安全追加放行规则: ${port}/${protocol}"
        fi
    fi
}

# 卸载或更换端口时安全移除端口规则
close_firewall_port() {
    local port="$1"
    local protocol="${2:-tcp}"
    [[ -z "$port" ]] && return 0

    log_info "正在清理防火墙放行规则: ${port}/${protocol}..."

    if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qw "active"; then
        ufw delete allow "${port}/${protocol}" >/dev/null 2>&1 || true
    fi

    if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld 2>/dev/null; then
        firewall-cmd --permanent --remove-port="${port}/${protocol}" >/dev/null 2>&1 || true
        firewall-cmd --reload >/dev/null 2>&1 || true
    fi

    if command -v iptables >/dev/null 2>&1; then
        iptables -D INPUT -p "${protocol}" --dport "${port}" -j ACCEPT 2>/dev/null || true
    fi
}