#!/bin/bash
# 在节点上部署 node-agent（M5）：从 /etc/node-agent/node.env 生成 config 并起 systemd。
# 前置：setup-node.sh 已跑（xray/hysteria/nginx 在跑，node.env 已生成）；
#       agent 二进制已放 /usr/local/bin/node-agent（或本脚本从 RESOURCE_BASE 拉）。
set -e
source /etc/node-agent/node.env
mkdir -p /var/lib/node-agent

# 生成节点契约凭据（随机、每节点唯一；持久化到 node.env 供注册脚本 register-node.sh 复用）。
# 路径段足够长随机（DESIGN §12：info_proxy_path 路径即凭据，要够长随机）。
if ! grep -q '^API_KEY=' /etc/node-agent/node.env 2>/dev/null; then
  cat >> /etc/node-agent/node.env <<EOF
API_KEY=$(openssl rand -hex 16)
PROXY_PATH=pp$(openssl rand -hex 12)
INFO_PROXY_PATH=ipp$(openssl rand -hex 12)
EOF
  source /etc/node-agent/node.env
fi

# 从 RESOURCE_BASE 拉最新 agent（先停服务避免覆盖运行中二进制报 ETXTBSY）
systemctl stop node-agent 2>/dev/null || true
curl -fsSL -o /usr/local/bin/node-agent "${RESOURCE_BASE}/bin/agent" && chmod +x /usr/local/bin/node-agent

cat > /etc/node-agent/config.yaml <<EOF
listen: "127.0.0.1:8080"
api_key: "${API_KEY}"
proxy_path: "${PROXY_PATH}"
info_proxy_path: "${INFO_PROXY_PATH}"
db_path: "/var/lib/node-agent/agent.db"
node:
  name: "node-${PUBLIC_IP}"
  public_ip: "${PUBLIC_IP}"
  decoy_domain: "${DECOY_DOMAIN}"
  reality_port: 443
  reality_pbk: "${REALITY_PBK}"
  reality_sid: "${REALITY_SID}"
  hy2_port: ${HY2_PORT}
  hy2_obfs: "${HY2_OBFS}"
xray:
  grpc_addr: "127.0.0.1:10085"
  inbound_tag: "vless-reality"
  sync_interval_s: 60
  config_path: "/usr/local/etc/xray/config.json"
  restart_cmd: "systemctl restart xray"
hysteria:
  stats_addr: "127.0.0.1:9999"
  stats_secret: "${STATS_SECRET}"
  auth_listen: "127.0.0.1:9090"
  config_path: "/etc/hysteria/config.yaml"
  restart_cmd: "systemctl restart hysteria"
  geoip_path: "/etc/hysteria/geoip.dat"
decoy:
  resource_base: "${RESOURCE_BASE}"
  root: "${DECOY_ROOT}"
  poll_sec: 3600
  reload_cmd: "systemctl reload nginx"
exec:
  disabled: false       # 远程运维执行端点开关（true=关闭 POST /agent/exec）
  shell: "bash"
  max_timeout_s: 600    # 单次执行超时上限（秒）；与 nginx proxy_read_timeout 对齐
  max_output_kb: 1024   # stdout/stderr 各自截断上限
EOF

cat > /etc/systemd/system/node-agent.service <<'EOF'
[Unit]
Description=node-agent
After=network.target xray.service hysteria.service nginx.service
[Service]
ExecStart=/usr/local/bin/node-agent -c /etc/node-agent/config.yaml
Restart=on-failure
RestartSec=3
LimitNOFILE=1048576
[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now node-agent
systemctl restart node-agent   # 确保拉到新 config
sleep 3
echo "node-agent: $(systemctl is-active node-agent)"
echo "--- recent log ---"
journalctl -u node-agent --no-pager -n 20
echo "--- decoy root after agent sync ---"
ls -la "${DECOY_ROOT}" 2>/dev/null