#!/bin/bash
# 移动云 VPS 监控彻底屏蔽脚本
# 覆盖：Ecloud-Assist-Agent、probes、assist-plugin-manager、multi-queue-ecloud、qemu-guest-agent 等
# 用法：新机直接 bash stop.sh 即可（默认等同 -y --purge）
# 可选：--soft --no-purge --keep-qga --keep-mq --block-report

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# 默认：新机一键彻底（非交互 + 移除 Ecloud 目录）
AUTO_YES=1
KEEP_QGA=0
KEEP_MQ=0
PURGE=1
BLOCK_REPORT=0

usage() {
    cat <<'EOF'
移动云监控屏蔽脚本

用法: stop.sh [选项]

  无参数（默认）      新机推荐：非交互 + 彻底 purge，等同 -y --purge
  -y, --yes           非交互（默认已开启，可省略）
  --soft              温和模式：会询问 auditd，且不 purge 目录
  --no-purge          不移动 Ecloud 目录，仅去执行权限
  --purge             移动 Ecloud 目录防复活（默认已开启）
  --keep-qga          保留 qemu-guest-agent（控制台部分功能依赖它）
  --keep-mq           保留 multi-queue-ecloud（网卡多队列优化，非监控）
  --block-report      用 iptables 阻断云助手上报地址（需 iptables）
  -h, --help          显示帮助

示例:
  bash stop.sh                  # 新机一次性彻底屏蔽（推荐）
  bash stop.sh --keep-qga       # 彻底屏蔽但保留控制台 guest-agent
  bash stop.sh --soft           # 保守模式，可交互、不删目录
EOF
}

while [[ $# -gt 0 ]]; do
    case "$1" in
        -y|--yes) AUTO_YES=1 ;;
        --soft) AUTO_YES=0; PURGE=0 ;;
        --no-purge) PURGE=0 ;;
        --purge) PURGE=1 ;;
        --keep-qga) KEEP_QGA=1 ;;
        --keep-mq) KEEP_MQ=1 ;;
        --block-report) BLOCK_REPORT=1 ;;
        -h|--help) usage; exit 0 ;;
        *) echo "未知参数: $1"; usage; exit 1 ;;
    esac
    shift
done

confirm() {
    local prompt="$1"
    if [[ "${AUTO_YES}" -eq 1 ]]; then
        return 0
    fi
    read -r -p "${prompt} (y/n): " ans
    [[ "${ans}" =~ ^[Yy]$ ]]
}

BACKUP_DIR="/root/vps_monitor_backup_$(date +%Y%m%d_%H%M%S)"
LOG_FILE=""
AGENT_HOME=""
AGENT_VER_DIR=""
PROBES_DIR=""

discover_agent_paths() {
    local root=""
    if [[ -d /usr/local/share/Ecloud ]]; then
        root="/usr/local/share/Ecloud"
    else
        root=$(ls -d /usr/local/share/Ecloud.disabled.* 2>/dev/null | sort | tail -1 || true)
    fi
    if [[ -z "${root}" || ! -d "${root}/AssistAgent" ]]; then
        return 1
    fi
    AGENT_HOME="${root}/AssistAgent"
    AGENT_VER_DIR=$(find "${AGENT_HOME}" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort -V | tail -1)
    PROBES_DIR="${AGENT_HOME}/plugin/probes/1.0.0.1"
    return 0
}

run_agent_official_stop() {
    local agent_bin="${AGENT_VER_DIR}/Ecloud-Assist-Agent"
    [[ -f "${agent_bin}" ]] || return 1
    local need_restore=0
    [[ ! -x "${agent_bin}" ]] && chmod u+x "${agent_bin}" && need_restore=1
    (
        cd "${AGENT_VER_DIR}"
        run_quiet ./Ecloud-Assist-Agent --stop
        run_quiet ./Ecloud-Assist-Agent --remove
    )
    if [[ "${need_restore}" -eq 1 ]]; then
        chmod a-x "${agent_bin}" 2>/dev/null || true
    fi
    return 0
}

log() {
    local msg="$1"
    echo -e "${msg}"
    if [[ -n "${LOG_FILE}" ]]; then
        echo -e "${msg}" | sed 's/\x1b\[[0-9;]*m//g' >> "${LOG_FILE}"
    fi
}

log_plain() {
    echo "$1" >> "${LOG_FILE}"
}

step() {
    log "${YELLOW}[$1] $2${NC}"
}

ok() { log "${GREEN}✅ $1${NC}"; }
warn() { log "${YELLOW}⚠️  $1${NC}"; }
fail() { log "${RED}❌ $1${NC}"; }

run_quiet() {
    "$@" >>"${LOG_FILE}" 2>&1 || true
}

kill_by_name() {
    local name="$1"
    if pgrep -x "${name}" >/dev/null 2>&1; then
        pkill -2 -x "${name}" 2>/dev/null || true
        sleep 1
        pkill -9 -x "${name}" 2>/dev/null || true
        log_plain "已终止进程: ${name}"
    fi
}

mask_unit() {
    local unit="$1"
    [[ "${unit}" != *.service ]] && unit="${unit}.service"

    if ! systemctl cat "${unit}" &>/dev/null; then
        return 1
    fi

    systemctl stop "${unit}" 2>/dev/null || true
    systemctl disable "${unit}" 2>/dev/null || true

    if systemctl mask "${unit}" 2>/dev/null; then
        log_plain "已 mask: ${unit}"
        return 0
    fi

    # static 等单元无法 mask 时，用 drop-in 阻止启动
    local dropin_dir="/etc/systemd/system/${unit}.d"
    local dropin="${dropin_dir}/block-by-stop-sh.conf"
    mkdir -p "${dropin_dir}"
    cat > "${dropin}" <<EOF
[Unit]
ConditionPathExists=/nonexistent/block-${unit}
EOF
    systemctl daemon-reload 2>/dev/null || true
    log_plain "已写入 drop-in 阻止启动: ${unit}"
    return 0
}

disable_sysv() {
    local name="$1"
    if [[ -x "/etc/init.d/${name}" ]]; then
        run_quiet service "${name}" stop
        command -v update-rc.d >/dev/null && run_quiet update-rc.d "${name}" disable
        command -v chkconfig >/dev/null && run_quiet chkconfig "${name}" off
        log_plain "已禁用 SysV 服务: ${name}"
    fi
}

# ── 1. 初始化 ──────────────────────────────────────────────
step "1/8" "初始化环境与日志..."
mkdir -p "${BACKUP_DIR}"
LOG_FILE="${BACKUP_DIR}/clean_monitor.log"
log_plain "===== 启动: $(date) ====="
log_plain "参数: AUTO_YES=${AUTO_YES} KEEP_QGA=${KEEP_QGA} KEEP_MQ=${KEEP_MQ} PURGE=${PURGE} BLOCK_REPORT=${BLOCK_REPORT}"
log_plain "模式: $([[ ${AUTO_YES} -eq 1 && ${PURGE} -eq 1 ]] && echo '一键彻底(默认)' || echo '自定义')"
log_plain "备份目录: ${BACKUP_DIR}"
ok "备份目录: ${BACKUP_DIR}"
if [[ "${AUTO_YES}" -eq 1 && "${PURGE}" -eq 1 ]]; then
    log "${BLUE}ℹ️  当前为一键彻底模式：新机直接 bash stop.sh 即可${NC}"
fi

# ── 2. 系统信息 ────────────────────────────────────────────
step "2/8" "记录系统信息..."
OS_INFO=$(grep PRETTY_NAME /etc/os-release 2>/dev/null | cut -d= -f2 | tr -d '"' || echo unknown)
log_plain "系统: ${OS_INFO}"
log_plain "内核: $(uname -r)"
log_plain "IP: $(curl -s --connect-timeout 3 icanhazip.com 2>/dev/null || hostname -I | awk '{print $1}')"
ok "系统信息已记录"

# ── 3. 移动云 AssistAgent（核心监控）──────────────────────
step "3/8" "停止并卸载 Ecloud-Assist-Agent（云助手）..."

if discover_agent_paths; then
    log_plain "云助手路径: ${AGENT_VER_DIR}"
    if run_agent_official_stop; then
        ok "已执行 Ecloud-Assist-Agent --stop / --remove"
    else
        warn "云助手二进制不存在，尝试杀进程"
    fi
else
    warn "未检测到 Ecloud/AssistAgent 安装（可能已 purge 或非移动云镜像）"
fi

for proc in Ecloud-Assist-Agent assist-plugin-manager probes unionagent; do
    kill_by_name "${proc}"
done

if [[ -L /usr/sbin/assist-plugin-manager ]] || [[ -e /usr/sbin/assist-plugin-manager ]]; then
    cp -a /usr/sbin/assist-plugin-manager "${BACKUP_DIR}/assist-plugin-manager.bak" 2>/dev/null || true
    rm -f /usr/sbin/assist-plugin-manager
    ok "已移除 /usr/sbin/assist-plugin-manager 软链接"
fi

rm -rf /tmp/agent /tmp/proxy /var/run/Ecloud-Assist-Agent.pid 2>/dev/null || true
log_plain "已清理 agent 运行时套接字与 pid 文件"

# ── 4. probes 采集插件 ─────────────────────────────────────
step "4/8" "停止 probes 采集插件..."

discover_agent_paths || true
if [[ -n "${PROBES_DIR}" && -d "${PROBES_DIR}" ]]; then
    if [[ -f "${PROBES_DIR}/stop.sh" ]]; then
        (cd "${PROBES_DIR}" && bash ./stop.sh) >>"${LOG_FILE}" 2>&1 || true
    fi
    if [[ -f "${PROBES_DIR}/uninstall_service.sh" ]]; then
        (cd "${PROBES_DIR}" && bash ./uninstall_service.sh) >>"${LOG_FILE}" 2>&1 || true
    fi
    run_quiet systemctl stop probes.service
    run_quiet systemctl disable probes.service
    mask_unit probes.service && ok "probes.service 已 mask" || warn "probes.service 未安装"
    kill_by_name probes
else
    warn "未找到 probes 目录"
fi

# ── 5. 其他移动云/平台监控组件 ─────────────────────────────
step "5/8" "处理平台监控与审计组件..."

# multi-queue-ecloud：主要是网卡多队列，部分镜像会随系统启动
if [[ "${KEEP_MQ}" -eq 0 ]]; then
    disable_sysv multi-queue-ecloud
    run_quiet systemctl stop multi-queue-ecloud.service
    run_quiet systemctl disable multi-queue-ecloud.service
    if mask_unit multi-queue-ecloud.service; then
        ok "multi-queue-ecloud 已停止并屏蔽自启"
    elif systemctl is-active multi-queue-ecloud.service &>/dev/null; then
        warn "multi-queue-ecloud 仍在运行，请检查"
    else
        ok "multi-queue-ecloud 已停止（SysV 已 disable）"
    fi
else
    warn "已跳过 multi-queue-ecloud（--keep-mq）"
fi

# qemu-guest-agent：云平台 guest-ping 心跳
if [[ "${KEEP_QGA}" -eq 0 ]]; then
    run_quiet systemctl stop qemu-guest-agent.service
    run_quiet systemctl disable qemu-guest-agent.service
    if mask_unit qemu-guest-agent.service; then
        ok "qemu-guest-agent 已停止并屏蔽自启"
    elif ! pgrep -x qemu-ga >/dev/null 2>&1; then
        ok "qemu-guest-agent 已停止"
    else
        warn "qemu-guest-agent 仍在运行"
    fi
    kill_by_name qemu-ga
else
    warn "已保留 qemu-guest-agent（--keep-qga）"
fi

# auditd（若存在）
if systemctl list-unit-files auditd.service 2>/dev/null | grep -q auditd.service; then
    if confirm "是否停止并 mask auditd 审计服务"; then
        run_quiet systemctl stop auditd
        run_quiet systemctl disable auditd
        mask_unit auditd.service && ok "auditd 已 mask" || warn "auditd mask 失败"
    else
        warn "已跳过 auditd"
    fi
else
    log_plain "未安装 auditd.service"
fi

# 检测并记录其他可疑进程（不默认杀 rsyslog，避免影响系统日志）
MONITOR_PROCS=(cloud-monitor agent monitor argus)
found=()
for proc in "${MONITOR_PROCS[@]}"; do
    if pgrep -x "${proc}" >/dev/null 2>&1; then
        found+=("${proc}")
        kill_by_name "${proc}"
    fi
done
if [[ ${#found[@]} -gt 0 ]]; then
    ok "已处理额外进程: ${found[*]}"
else
    log_plain "未发现额外 cloud-monitor/agent/monitor/argus 进程"
fi

# ── 6. SSH 登录监控横幅 ────────────────────────────────────
step "6/8" "清理 SSH 登录监控提示..."
for f in /etc/motd /etc/issue /etc/issue.net; do
    if [[ -f "${f}" ]]; then
        cp -a "${f}" "${BACKUP_DIR}/$(basename "${f}").bak" 2>/dev/null || true
        : > "${f}"
        log_plain "已清空 ${f}"
    fi
done
# 部分镜像在 sshd_config 里配置了 Banner
if [[ -f /etc/ssh/sshd_config ]]; then
    cp -a /etc/ssh/sshd_config "${BACKUP_DIR}/sshd_config.bak" 2>/dev/null || true
    if grep -qE '^[[:space:]]*Banner[[:space:]]' /etc/ssh/sshd_config; then
        sed -i.bak_stop 's/^\([[:space:]]*Banner\)/#\1/' /etc/ssh/sshd_config
        systemctl reload sshd 2>/dev/null || systemctl reload ssh 2>/dev/null || true
        log_plain "已注释 sshd Banner 并 reload"
    fi
fi
ok "SSH 横幅已清理（已备份）"

# ── 7. 持久化：防止重启后复活 ──────────────────────────────
step "7/8" "写入防复活措施..."

if [[ "${PURGE}" -eq 1 ]] && [[ -d /usr/local/share/Ecloud ]]; then
    disabled_path="/usr/local/share/Ecloud.disabled.$(date +%Y%m%d_%H%M%S)"
    mv /usr/local/share/Ecloud "${disabled_path}"
    chmod -R a-x "${disabled_path}" 2>/dev/null || true
    ok "已重命名 Ecloud 目录至 ${disabled_path} 并去除执行权限"
    log_plain "PURGE: ${disabled_path}"
else
    # 不 purge 时仍禁止自动执行，降低被 update 拉起概率
    discover_agent_paths || true
    if [[ -n "${AGENT_VER_DIR}" && -d "${AGENT_VER_DIR}" ]]; then
        chmod a-x "${AGENT_VER_DIR}/Ecloud-Assist-Agent" \
            "${AGENT_VER_DIR}/assist-plugin-manager" \
            "${AGENT_VER_DIR}/update" 2>/dev/null || true
        [[ -d "${PROBES_DIR}" ]] && find "${PROBES_DIR}" -maxdepth 1 -type f -executable -exec chmod a-x {} \; 2>/dev/null || true
        ok "已去除云助手主程序可执行权限（未删除文件，可用备份还原）"
    fi
    if [[ "${PURGE}" -eq 0 ]]; then
        warn "未 purge：仅禁用执行权限；彻底移除请直接 bash stop.sh（默认会 purge）"
    fi
fi

# 备份并关闭云助手配置中的心跳/升级（若目录仍在）
discover_agent_paths || true
for cfg in "${AGENT_VER_DIR}/config/config.yml" "${PROBES_DIR}/config/config.yaml"; do
    if [[ -f "${cfg}" ]]; then
        cp -a "${cfg}" "${BACKUP_DIR}/$(basename "${cfg}").bak" 2>/dev/null || true
        sed -i \
            -e 's/^\([[:space:]]*enableHeartbeat:\).*/\1 false/' \
            -e 's/^\([[:space:]]*updateInterval:\).*/\1 999999999/' \
            -e 's/^\([[:space:]]*enable:\)[[:space:]]*true/\1 false/' \
            "${cfg}" 2>/dev/null || true
        log_plain "已弱化配置: ${cfg}"
    fi
done

# 阻断上报（config.yml 中 task server 示例: 10.16.8.51:18080）
if [[ "${BLOCK_REPORT}" -eq 1 ]]; then
    if command -v iptables >/dev/null 2>&1; then
        for host in 10.16.8.51 100.100.2.136; do
            iptables -C OUTPUT -d "${host}" -j REJECT 2>/dev/null \
                || iptables -A OUTPUT -d "${host}" -j REJECT 2>/dev/null || true
            log_plain "iptables REJECT OUTPUT -> ${host}"
        done
        ok "已添加 iptables 阻断规则（重启后可能丢失，建议写入防火墙持久化）"
    else
        warn "未找到 iptables，跳过 --block-report"
    fi
fi

# cloud-init 保留（实例初始化需要），但记录提示
log_plain "保留 cloud-init（避免影响 hostname/网络初始化）"

# ── 8. 总结 ────────────────────────────────────────────────
step "8/8" "生成操作总结..."

log_plain "===== 总结 ====="
log_plain "AssistAgent: 已 stop/remove + 杀进程"
log_plain "probes: 已 stop + uninstall_service + mask"
log_plain "multi-queue-ecloud: $([[ ${KEEP_MQ} -eq 1 ]] && echo 保留 || echo 已 mask)"
log_plain "qemu-guest-agent: $([[ ${KEEP_QGA} -eq 1 ]] && echo 保留 || echo 已 mask)"
log_plain "PURGE: ${PURGE}"
log_plain "===== 结束: $(date) ====="

echo ""
ok "全部完成"
log "${BLUE}日志: ${LOG_FILE}${NC}"
log "${BLUE}备份: ${BACKUP_DIR}${NC}"
log "${RED}注意: 屏蔽监控可能违反云主机服务协议，控制台部分功能（密码重置/VNC）在关闭 qemu-ga 后可能受限${NC}"