#!/bin/bash
set -euo pipefail

# 依赖检测函数
check_dep() {
    if ! command -v "$1" &>/dev/null; then
        echo "错误：未安装 $1，请先执行 apt update && apt install $1 -y"
        exit 1
    fi
}
check_dep curl
check_dep tar
check_dep wget
check_dep setcap

########################## 交互式输入区 ##########################
echo "==================== Caddy 一键部署工具 ===================="
read -p "请输入反向代理域名（例：xui.isrv.cn）: " DOMAIN
read -p "请输入本地代理端口（例：36512）: " LOCAL_PORT
read -p "HTTP端口(默认80，直接回车使用默认): " HTTP_PORT
read -p "HTTPS端口(默认443，直接回车使用默认): " HTTPS_PORT

# 空值赋默认
HTTP_PORT=${HTTP_PORT:-80}
HTTPS_PORT=${HTTPS_PORT:-443}
###########################################################################

echo -e "\n===== 1. 创建所需目录 ====="
mkdir -p /etc/caddy /etc/ssl /srv/dav /srv/caddy-share

echo "===== 2. 下载证书压缩包并解压至 /etc/ssl ====="
wget --timeout=10 -O /tmp/isrv.cn.tar.gz https://files.isrv.cn/isrv.cn.tar.gz
tar -zxf /tmp/isrv.cn.tar.gz -C /etc/ssl/
rm -f /tmp/isrv.cn.tar.gz

echo "===== 3. 下载自定义 Caddy 二进制到 /usr/bin ====="
wget --timeout=10 -O /usr/bin/caddy https://files.isrv.cn/caddy
chmod +x /usr/bin/caddy

echo "===== 4. 赋予绑定80/443低端口权限 ====="
setcap 'cap_net_bind_service=+ep' /usr/bin/caddy

echo "===== 5. 创建系统运行用户 caddy ====="
if ! getent group caddy >/dev/null; then
    groupadd --system caddy
fi
if ! getent passwd caddy >/dev/null; then
    useradd --system --gid caddy --create-home --home-dir /var/lib/caddy --shell /usr/sbin/nologin --comment "Caddy web server" caddy
fi

echo "===== 6. 目录归属授权 caddy 用户 ====="
chown -R caddy:caddy /srv/dav /srv/caddy-share /var/lib/caddy

echo "===== 7. 生成交互式输入域名的 Caddyfile 模板 ====="
cat > /etc/caddy/Caddyfile <<EOF
{
	http_port ${HTTP_PORT}
	https_port ${HTTPS_PORT}
}

# 自动生成的反向代理站点 ${DOMAIN}
${DOMAIN} {
	encode gzip zstd
	reverse_proxy 127.0.0.1:${LOCAL_PORT}
}

# 后续新增站点可在下方自行添加
EOF

echo "===== 8. 写入 systemd caddy 服务单元 ====="
cat > /etc/systemd/system/caddy.service <<'EOF'
[Unit]
Description=Caddy
Documentation=https://caddyserver.com/docs/
After=network.target network-online.target
Requires=network-online.target

[Service]
Type=notify
User=caddy
Group=caddy
ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile
ExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile --force
TimeoutStopSec=5s
LimitNOFILE=1048576
LimitNPROC=512
PrivateTmp=true
ProtectSystem=full
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target
EOF

echo "===== 9. 重载 systemd 配置 ====="
systemctl daemon-reload

echo "===== 10. 格式化并校验 Caddyfile 语法 ====="
caddy fmt --overwrite /etc/caddy/Caddyfile
caddy validate --config /etc/caddy/Caddyfile

echo "===== 11. 设置开机自启并立即启动服务 ====="
systemctl enable --now caddy

echo -e "\n==================== 部署完成 ===================="
echo "配置文件路径：/etc/caddy/Caddyfile"
echo "当前代理站点：https://${DOMAIN} -> 127.0.0.1:${LOCAL_PORT}"
echo "证书存放目录：/etc/ssl/"
echo "WebDAV网盘目录：/srv/dav"
echo "静态文件共享目录：/srv/caddy-share"
echo -e "\n当前运行状态："
systemctl status caddy

# OpenVZ/Racknerd容器启动失败修复命令提示
echo -e "\n===== 容器兼容修复命令（服务启动失败时执行） ====="
echo "sed -i '/AmbientCapabilities/d;s/Type=notify/Type=simple/' /etc/systemd/system/caddy.service && systemctl daemon-reload && systemctl restart caddy"