#!/usr/bin/env bash
set -euo pipefail

config=/etc/nginx/conf.d/sc.jiansun.vip.conf
frps_config=/etc/frp/frps-sucai.toml
frps_service=frps-sucai.service
test -f "$config"
test -f "$frps_config"
backup="${config}.before-notification-center-$(date +%Y%m%d%H%M%S)"
frps_backup="${frps_config}.before-notification-center-$(date +%Y%m%d%H%M%S)"
cp -a "$config" "$backup"
cp -a "$frps_config" "$frps_backup"

FRPS_CONFIG="$frps_config" python3 - <<'PY'
from pathlib import Path
import os
import re

path = Path(os.environ['FRPS_CONFIG'])
text = path.read_text(encoding='utf-8')
match = re.search(
    r'allowPorts\s*=\s*\[\s*\{\s*start\s*=\s*2321\s*,\s*end\s*=\s*(\d+)\s*\}\s*,?\s*\]',
    text,
    re.S,
)
if not match:
    raise SystemExit('未识别素材库 FRP 端口白名单，拒绝修改')
if int(match.group(1)) < 2326:
    text = text[:match.start(1)] + '2326' + text[match.end(1):]
    path.write_text(text, encoding='utf-8')
PY

if ! /opt/frp-furniture-server/frps verify -c "$frps_config"; then
  cp -a "$frps_backup" "$frps_config"
  echo 'FRP 服务端配置验证失败，已回滚' >&2
  exit 1
fi
if ! systemctl restart "$frps_service"; then
  cp -a "$frps_backup" "$frps_config"
  systemctl restart "$frps_service"
  echo 'FRP 服务端重启失败，已回滚' >&2
  exit 1
fi

frp_ready=0
for _ in $(seq 1 20); do
  if ss -lnt | grep -q ':2321 ' \
    && ss -lnt | grep -q ':2322 ' \
    && ss -lnt | grep -q ':2323 ' \
    && ss -lnt | grep -q ':2326 '; then
    frp_ready=1
    break
  fi
  sleep 2
done
if test "$frp_ready" != 1; then
  cp -a "$frps_backup" "$frps_config"
  systemctl restart "$frps_service"
  echo 'FRP 隧道未全部恢复，已回滚' >&2
  exit 1
fi

CONFIG="$config" python3 - <<'PY'
from pathlib import Path
import os

path = Path(os.environ['CONFIG'])
text = path.read_text(encoding='utf-8')
if 'location ^~ /notification-center/' in text:
    raise SystemExit(0)
needle = '    location / {\n'
if needle not in text:
    raise SystemExit('未找到主站 location，拒绝修改')
block = '''    location ^~ /notification-center/ {
        proxy_pass http://127.0.0.1:2326/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 5s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
        client_max_body_size 128k;
    }

'''
path.write_text(text.replace(needle, block + needle, 1), encoding='utf-8')
PY

if ! nginx -t; then
  cp -a "$backup" "$config"
  nginx -t
  echo 'Nginx 配置验证失败，已回滚' >&2
  exit 1
fi
systemctl reload nginx

curl -fsS --max-time 10 --resolve sc.jiansun.vip:443:127.0.0.1 \
  https://sc.jiansun.vip/api/health >/tmp/yyd-material-public-health.json
curl -fsS --max-time 10 --resolve s3.jiansun.vip:443:127.0.0.1 \
  https://s3.jiansun.vip/minio/health/live >/tmp/yyd-s3-public-health.txt

healthy=0
for _ in $(seq 1 20); do
  if curl -fsS --max-time 5 --resolve sc.jiansun.vip:443:127.0.0.1 \
    https://sc.jiansun.vip/notification-center/health \
    >/tmp/yyd-notification-public-health.json; then
    healthy=1
    break
  fi
  sleep 2
done
if test "$healthy" != 1; then
  cp -a "$backup" "$config"
  nginx -t
  systemctl reload nginx
  echo '通知中心公网健康检查失败，已回滚 Nginx 配置' >&2
  exit 1
fi

cat /tmp/yyd-notification-public-health.json
echo
echo 'PUBLIC_NOTIFICATION_CENTER_OK'