#!/usr/bin/env bash
# =============================================================================
#  Saudi VPN - server installer  (Ubuntu 22.04 / 24.04, Debian 11/12)
#
#  Aik VPS par teen protocols lagata hai:
#    1. Shadowsocks  (SSR ki jagah)     port 8388  tcp+udp   -> WhatsApp calls
#    2. VLESS Reality (Stealth)         port 443   tcp
#    3. OpenVPN                         port 1194  tcp (ya udp)
#
#  Istemal (VPS par root):
#     NAME="Turkey-1" COUNTRY="Turkey" CODE="TR" CITY="Istanbul" bash install_server.sh
#
#  Optional:
#     SS_PORT=8388  VLESS_PORT=443  OVPN_PORT=1194  OVPN_PROTO=tcp|udp
#     SNI=www.microsoft.com
#
#  Akhir mein /root/server-entry.json banti hai: yahi block servers.json
#  mein paste karna hai.
# =============================================================================
set -euo pipefail

NAME="${NAME:-$(hostname)}"
COUNTRY="${COUNTRY:-Unknown}"
CODE="${CODE:-UN}"
CITY="${CITY:-}"
SS_PORT="${SS_PORT:-8388}"
VLESS_PORT="${VLESS_PORT:-443}"
OVPN_PORT="${OVPN_PORT:-1194}"
OVPN_PROTO="${OVPN_PROTO:-tcp}"
SNI="${SNI:-www.microsoft.com}"
SS_METHOD="chacha20-ietf-poly1305"

XRAY_CONFIG=/usr/local/etc/xray/config.json
ENTRY=/root/server-entry.json

red()   { printf '\033[31m%s\033[0m\n' "$*"; }
green() { printf '\033[32m%s\033[0m\n' "$*"; }

[[ $EUID -eq 0 ]] || { red "Root se chalayen: sudo bash $0"; exit 1; }
[[ "$OVPN_PROTO" == tcp || "$OVPN_PROTO" == udp ]] || { red "OVPN_PROTO tcp ya udp ho"; exit 1; }
for p in "$SS_PORT" "$VLESS_PORT" "$OVPN_PORT"; do
  [[ "$p" =~ ^[0-9]+$ ]] || { red "Port number galat: $p"; exit 1; }
done
if [[ "$SS_PORT" == "$VLESS_PORT" ]] || { [[ "$OVPN_PROTO" == tcp ]] && [[ "$OVPN_PORT" == "$VLESS_PORT" || "$OVPN_PORT" == "$SS_PORT" ]]; }; then
  red "Har protocol ka port alag hona chahiye"; exit 1
fi

# ---- 1. Packages -------------------------------------------------------------
green "[1/6] Packages..."
export DEBIAN_FRONTEND=noninteractive
apt-get update -y >/dev/null
apt-get install -y curl openssl ca-certificates python3 qrencode >/dev/null

IP="$(curl -4 -fsS https://api.ipify.org || curl -4 -fsS https://ifconfig.me)"
[[ -n "$IP" ]] || { red "Public IP nahi mili"; exit 1; }
echo "Server IP: $IP"

# Oracle Cloud ke Ubuntu images mein iptables pehle se sab ports band (REJECT)
# rakhta hai. Aisa ho to hamare ports khol do.
if iptables -S INPUT 2>/dev/null | grep -q -- '-j REJECT'; then
  echo "iptables REJECT rules mile (Oracle Cloud?) - ports khol raha hoon..."
  for rule in "tcp $SS_PORT" "udp $SS_PORT" "tcp $VLESS_PORT" "$OVPN_PROTO $OVPN_PORT"; do
    read -r proto port <<<"$rule"
    iptables -C INPUT -p "$proto" --dport "$port" -j ACCEPT 2>/dev/null \
      || iptables -I INPUT 1 -p "$proto" --dport "$port" -j ACCEPT
  done
  command -v netfilter-persistent >/dev/null && netfilter-persistent save >/dev/null || true
fi

# ---- 2. OpenVPN (angristan/openvpn-install) ----------------------------------
green "[2/6] OpenVPN install ho raha hai ($OVPN_PROTO/$OVPN_PORT)..."
OVPN_SCRIPT=/root/openvpn-install.sh
curl -fsSL https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh -o "$OVPN_SCRIPT"
chmod +x "$OVPN_SCRIPT"
if [[ ! -f /etc/openvpn/server.conf && ! -f /etc/openvpn/server/server.conf ]]; then
  # --multi-client: aik hi client file se hazaron users aik sath connect ho saken
  "$OVPN_SCRIPT" install \
      --endpoint "$IP" \
      --port "$OVPN_PORT" \
      --protocol "$OVPN_PROTO" \
      --dns cloudflare \
      --multi-client \
      --client saudivpn
else
  echo "OpenVPN pehle se install hai, skip."
fi
OVPN_FILE="$(ls -t /root/saudivpn.ovpn /root/*.ovpn 2>/dev/null | head -n1 || true)"
[[ -f "$OVPN_FILE" ]] || { red "OpenVPN client file (.ovpn) nahi mili"; exit 1; }
echo "OpenVPN client file: $OVPN_FILE"

# ---- 3. Xray core ------------------------------------------------------------
green "[3/6] Xray install ho raha hai..."
bash -c "$(curl -fsSL https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
XRAY=/usr/local/bin/xray
"$XRAY" version | head -n1

# ---- 4. Keys -----------------------------------------------------------------
green "[4/6] Keys..."
UUID="$("$XRAY" uuid)"
KEYS="$("$XRAY" x25519)"
# Purane Xray: "Private key:/Public key:"   Naye Xray: "PrivateKey:/Password:"
PRIVATE_KEY="$(echo "$KEYS" | awk -F': *' 'tolower($1) ~ /private/ {print $2; exit}' | tr -d '[:space:]')"
PUBLIC_KEY="$(echo "$KEYS" | awk -F': *' 'tolower($1) ~ /public|password/ {print $2; exit}' | tr -d '[:space:]')"
[[ -n "$PRIVATE_KEY" && -n "$PUBLIC_KEY" ]] || { red "x25519 keys parse nahi huin:"; echo "$KEYS"; exit 1; }
SHORT_ID="$(openssl rand -hex 8)"
SS_PASSWORD="$(openssl rand -base64 24 | tr -d '/+=' | cut -c1-24)"

# ---- 5. Xray config (Shadowsocks + VLESS Reality) ----------------------------
green "[5/6] Xray config..."
mkdir -p "$(dirname "$XRAY_CONFIG")"
cat > "$XRAY_CONFIG" <<EOF
{
  "log": { "loglevel": "warning" },
  "inbounds": [
    {
      "tag": "shadowsocks",
      "listen": "0.0.0.0",
      "port": ${SS_PORT},
      "protocol": "shadowsocks",
      "settings": {
        "method": "${SS_METHOD}",
        "password": "${SS_PASSWORD}",
        "network": "tcp,udp"
      },
      "sniffing": { "enabled": true, "destOverride": ["http", "tls", "quic"], "routeOnly": true }
    },
    {
      "tag": "vless-reality",
      "listen": "0.0.0.0",
      "port": ${VLESS_PORT},
      "protocol": "vless",
      "settings": {
        "clients": [ { "id": "${UUID}", "flow": "xtls-rprx-vision" } ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "${SNI}:443",
          "xver": 0,
          "serverNames": [ "${SNI}" ],
          "privateKey": "${PRIVATE_KEY}",
          "shortIds": [ "${SHORT_ID}" ]
        }
      },
      "sniffing": { "enabled": true, "destOverride": ["http", "tls", "quic"], "routeOnly": true }
    }
  ],
  "outbounds": [
    { "protocol": "freedom", "tag": "direct" },
    { "protocol": "blackhole", "tag": "block" }
  ],
  "routing": {
    "rules": [
      { "type": "field", "ip": ["geoip:private"], "outboundTag": "block" },
      { "type": "field", "protocol": ["bittorrent"], "outboundTag": "block" }
    ]
  }
}
EOF
"$XRAY" run -test -config "$XRAY_CONFIG" >/dev/null && echo "Xray config OK"

# Speed ke liye BBR
grep -q 'tcp_congestion_control=bbr' /etc/sysctl.conf || cat >> /etc/sysctl.conf <<'EOF'
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
EOF
sysctl -p >/dev/null || true

systemctl enable xray >/dev/null 2>&1
systemctl restart xray
sleep 1
systemctl is-active --quiet xray || { red "Xray start nahi hua:"; journalctl -u xray -n 30 --no-pager; exit 1; }

# ---- 6. Links + servers.json entry -------------------------------------------
green "[6/6] Links bana raha hoon..."
ENC_NAME="$(python3 -c 'import sys,urllib.parse;print(urllib.parse.quote(sys.argv[1]))' "$NAME")"
SS_USERINFO="$(printf '%s:%s' "$SS_METHOD" "$SS_PASSWORD" | base64 -w0 | tr '+/' '-_' | tr -d '=')"
SS_LINK="ss://${SS_USERINFO}@${IP}:${SS_PORT}#${ENC_NAME}"
VLESS_LINK="vless://${UUID}@${IP}:${VLESS_PORT}?encryption=none&flow=xtls-rprx-vision&security=reality&sni=${SNI}&fp=chrome&pbk=${PUBLIC_KEY}&sid=${SHORT_ID}&type=tcp&headerType=none#${ENC_NAME}"

ID="$(echo "${CODE}-${NAME}" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9\n' '-')"
python3 - "$ID" "$COUNTRY" "$CODE" "$CITY" "$SS_LINK" "$VLESS_LINK" "$OVPN_FILE" > "$ENTRY" <<'PY'
import json, sys
id_, country, code, city, ss, vless, ovpn_path = sys.argv[1:]
print(json.dumps({
    "id": id_.strip("-"),
    "country": country,
    "countryCode": code.upper(),
    "city": city,
    "premium": False,
    "ss": ss,
    "vless": vless,
    "openvpn": open(ovpn_path).read(),
}, indent=2, ensure_ascii=False))
PY
chmod 600 "$ENTRY"

echo
green "========== Mukammal =========="
echo "Shadowsocks (SSR): $SS_LINK"
echo
echo "Stealth (Reality): $VLESS_LINK"
echo
echo "OpenVPN file     : $OVPN_FILE"
echo
echo "Shadowsocks QR (test ke liye v2rayNG / Shadowrocket se scan karein):"
qrencode -t ansiutf8 "$SS_LINK" || true
echo
green "servers.json ke liye poora block: $ENTRY"
echo "  cat $ENTRY"
echo
echo "Yaad rahe: VPS provider ke firewall/security group mein yeh ports kholein:"
echo "  ${SS_PORT}/tcp  ${SS_PORT}/udp  ${VLESS_PORT}/tcp  ${OVPN_PORT}/${OVPN_PROTO}"