#!/bin/bash

# Setup Clash Meta proxy server on server2
# Clash Meta is more actively maintained than original Clash

echo "=== Setting up Clash Meta proxy server on server2 ==="
echo ""

ssh server2 << 'EOF'
    set -e
    
    # Get Tailscale IP
    TAILSCALE_IP=$(tailscale ip -4)
    echo "Tailscale IP: $TAILSCALE_IP"
    echo ""
    
    # Detect architecture
    ARCH=$(uname -m)
    case $ARCH in
        x86_64) CLASH_ARCH="amd64" ;;
        aarch64|arm64) CLASH_ARCH="arm64" ;;
        *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
    esac
    
    # Create directories
    CLASH_DIR="$HOME/clash-meta"
    mkdir -p "$CLASH_DIR"
    mkdir -p ~/.config/clash-meta
    cd "$CLASH_DIR"
    
    # Download Clash Meta
    echo "Downloading Clash Meta..."
    CLASH_VERSION="v1.18.0"
    CLASH_FILE="clash.meta-linux-${CLASH_ARCH}-${CLASH_VERSION}"
    
    if wget -q "https://github.com/MetaCubeX/mihomo/releases/download/${CLASH_VERSION}/${CLASH_FILE}.gz" -O clash.gz; then
        gunzip -f clash.gz
        mv "$CLASH_FILE" clash
        chmod +x clash
        echo "✓ Clash Meta downloaded"
    else
        echo "Failed to download Clash Meta. Trying alternative method..."
        # Try downloading from release page
        wget -q "https://github.com/MetaCubeX/mihomo/releases/latest/download/mihomo-linux-${CLASH_ARCH}.gz" -O clash.gz 2>/dev/null || \
        wget -q "https://github.com/MetaCubeX/mihomo/releases/download/v1.18.0/mihomo-linux-${CLASH_ARCH}.gz" -O clash.gz
        gunzip -f clash.gz
        mv mihomo-linux-${CLASH_ARCH} clash 2>/dev/null || mv mihomo clash
        chmod +x clash
    fi
    
    # Verify installation
    if [ -f ./clash ]; then
        ./clash -v || echo "Clash binary ready"
    else
        echo "✗ Clash binary not found"
        exit 1
    fi
    
    # Create Clash configuration
    echo "Creating configuration..."
    cat > ~/.config/clash-meta/config.yaml << CONFIG
# Clash Meta configuration for server2 proxy
port: 7890
socks-port: 7891
mixed-port: 7892
allow-lan: true
bind-address: '*'
mode: rule
log-level: info
ipv6: false
external-controller: 0.0.0.0:9090
external-ui: ui

# DNS
dns:
  enable: true
  listen: 0.0.0.0:53
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  nameserver:
    - 8.8.8.8
    - 1.1.1.1
  fallback:
    - 8.8.4.4
    - 1.0.0.1
  fallback-filter:
    geoip: true
    geoip-code: CN
    ipcidr:
      - 240.0.0.0/4

# Proxy (direct connection)
proxies:
  - name: "direct"
    type: direct

# Proxy groups
proxy-groups:
  - name: "Proxy"
    type: select
    proxies:
      - direct
  - name: "Auto"
    type: select
    proxies:
      - direct

# Rules - route all traffic through direct connection
rules:
  - MATCH,Proxy

# Experimental
experimental:
  ignore-resolve-fail: true
  sniff-tls-sni: true
CONFIG

    # Download Clash dashboard UI
    echo "Downloading Clash UI..."
    cd ~/.config/clash-meta
    if [ ! -d ui ]; then
        wget -q https://github.com/haishanh/yacd/archive/gh-pages.zip -O ui.zip 2>/dev/null || \
        wget -q https://github.com/haishanh/yacd/releases/latest/download/yacd.tar.xz -O yacd.tar.xz 2>/dev/null
        if [ -f yacd.tar.xz ]; then
            tar -xf yacd.tar.xz
            mv public ui
            rm yacd.tar.xz
        elif [ -f ui.zip ]; then
            unzip -q ui.zip
            mv yacd-gh-pages ui
            rm ui.zip
        else
            echo "UI download failed, but Clash will work without it"
        fi
    fi
    
    # Create systemd service
    echo "Creating systemd service..."
    sudo tee /etc/systemd/system/clash-meta.service > /dev/null << SERVICE
[Unit]
Description=Clash Meta daemon
After=network.target

[Service]
Type=simple
Restart=always
User=$USER
WorkingDirectory=$CLASH_DIR
ExecStart=$CLASH_DIR/clash -d $HOME/.config/clash-meta
Environment="HOME=$HOME"

[Install]
WantedBy=multi-user.target
SERVICE

    # Reload systemd and start Clash
    sudo systemctl daemon-reload
    sudo systemctl enable clash-meta
    sudo systemctl restart clash-meta
    
    # Wait for service to start
    sleep 3
    
    # Check status
    if sudo systemctl is-active --quiet clash-meta; then
        echo ""
        echo "✓ Clash Meta is running!"
        echo ""
        echo "=== Configuration Summary ==="
        echo "HTTP Proxy: $TAILSCALE_IP:7890"
        echo "SOCKS5 Proxy: $TAILSCALE_IP:7891"
        echo "Mixed Proxy (HTTP+SOCKS5): $TAILSCALE_IP:7892"
        echo "Web UI: http://$TAILSCALE_IP:9090/ui"
        echo ""
        
        # Configure firewall
        echo "=== Firewall Configuration ==="
        if command -v ufw >/dev/null 2>&1 && sudo ufw status | grep -q "Status: active"; then
            echo "Configuring UFW..."
            sudo ufw allow 7890/tcp comment "Clash HTTP"
            sudo ufw allow 7891/tcp comment "Clash SOCKS5"
            sudo ufw allow 7892/tcp comment "Clash Mixed"
            sudo ufw allow 9090/tcp comment "Clash Web UI"
            sudo ufw allow 53/udp comment "Clash DNS"
        else
            echo "UFW not active. If using iptables, ensure ports 7890, 7891, 7892, 9090, 53 are open."
        fi
        
        echo ""
        echo "=== Client Configuration ==="
        echo "For Clash clients, configure:"
        echo "  Type: HTTP"
        echo "  Server: $TAILSCALE_IP"
        echo "  Port: 7890"
        echo ""
        echo "Or use Mixed port (supports both HTTP and SOCKS5):"
        echo "  Server: $TAILSCALE_IP"
        echo "  Port: 7892"
        
    else
        echo "✗ Clash Meta failed to start"
        echo "Check logs: sudo journalctl -u clash-meta -n 50"
        exit 1
    fi
EOF

echo ""
echo "=== Setup Complete ==="
echo ""
echo "Commands:"
echo "  Status: ssh server2 'sudo systemctl status clash-meta'"
echo "  Logs: ssh server2 'sudo journalctl -u clash-meta -f'"
echo "  Restart: ssh server2 'sudo systemctl restart clash-meta'"