#!/data/data/com.termux/files/usr/bin/bash
# =============================================================================
# Ugphone / Termux 一键开启 SSH + 反向隧道
#
# 云手机执行（手机2示例）:
#   PHONE_ID=2 pkg update -y && pkg install -y curl && curl -fsSL https://ipan.mbvpn.cn/ug/ugssh.sh | bash
#
# 外网连接（用户名以脚本输出为准，格式 u0_aXX）:
#   ssh -p 18023 u0_a78@103.27.77.226
#   密码: 25257758
#
# VPS 首次准备（在服务器 root 执行一次）:
#   1. useradd -m -s /usr/sbin/nologin ugtunnel
#   2. ssh-keygen -t ed25519 -f /root/ug-tunnel-keys/id_ed25519 -N ""
#   3. 公钥写入 /home/ugtunnel/.ssh/authorized_keys（限制 permitlisten 端口 18022-18025）
#   4. /etc/ssh/sshd_config 设 GatewayPorts clientspecified 且 PubkeyAuthentication yes
#   5. 私钥内容更新到本脚本 TUNNEL_KEY_URL，或替换下方内置密钥
# =============================================================================

# ===================== 配置区（换服务器只改这里）=====================

# ── SSH 登录账号 ──
USER_NAME="wolf"                  # 客户端备注名；Termux 不能自定义 SSH 用户名为 wolf/root
USER_PASS="25257758"              # SSH 登录密码
SSH_PORT="8022"                   # 云手机本机 SSH 端口

# ── 反向隧道 VPS（云手机主动连这里）──
TUNNEL_HOST="103.27.77.226"       # VPS 公网 IP 或域名
TUNNEL_SSH_PORT="22"              # VPS SSH 端口
TUNNEL_USER="ugtunnel"            # VPS 隧道用户（见脚本头部 VPS 首次准备说明）

# ── 手机编号 → 公网映射端口 ──
# 手机1=18022  手机2=18023  手机3=18024  手机4=18025
TUNNEL_PORT_BASE="18021"          # 公式: 远程端口 = TUNNEL_PORT_BASE + PHONE_ID

# ── 脚本/密钥下载地址（换服务器时一起改）──
SCRIPT_URL="https://ipan.mbvpn.cn/ug/ugssh.sh"
# 若换 VPS，把新服务器生成的私钥放到这个 URL，脚本会自动下载（优先于下方内置密钥）
TUNNEL_KEY_URL=""                 # 例: https://ipan.mbvpn.cn/ug/tunnel_key

# ===================== 配置区结束 ====================================

set -e

PHONE_ID="${PHONE_ID:-1}"
TUNNEL_PORT=$((TUNNEL_PORT_BASE + PHONE_ID))

RED='\033[0;31m'
GREEN='\033[0;32m'
CYAN='\033[0;36m'
YELLOW='\033[1;33m'
NC='\033[0m'

info()  { echo -e "${CYAN}[*]${NC} $*"; }
ok()    { echo -e "${GREEN}[OK]${NC} $*"; }
warn()  { echo -e "${YELLOW}[!]${NC} $*"; }
die()   { echo -e "${RED}[ERR]${NC} $*"; exit 1; }

# ── 检测 Termux 环境 ──
[[ -n "${PREFIX:-}" ]] || die "请在 Termux 里运行此脚本"
PKG="${PREFIX}/bin/pkg"
[[ -x "$PKG" ]] || die "未找到 pkg，请确认 Termux 已正确安装"

info "更新 Termux 软件源..."
"$PKG" update -y

info "安装 openssh、expect、autossh、curl..."
"$PKG" install -y openssh expect autossh curl

# ── Termux 用户名说明 ──
# Termux 的 sshd 只允许【本应用被 Android 分配的用户】登录（whoami，如 u0_a78、u0_a79…）。
# 不能新建 wolf/root 等自定义用户名，也不是固定 u0_a78，每台云机可能不同。
# USER_NAME 仅作 SSH 客户端备注；密码仍设为 USER_PASS。
CURRENT_USER=$(whoami)
LOGIN_USER="$CURRENT_USER"

info "Termux SSH 用户: ${LOGIN_USER}（备注名: ${USER_NAME}）"

try_create_wolf_user() {
    if id "$USER_NAME" &>/dev/null 2>&1; then
        ok "已存在用户 ${USER_NAME}"
        return 0
    fi
    if [[ "$(id -u)" -ne 0 ]]; then
        return 1
    fi
    if ! command -v useradd >/dev/null 2>&1; then
        "$PKG" install -y util-linux 2>/dev/null || true
    fi
    if command -v useradd >/dev/null 2>&1; then
        useradd -m -s "${PREFIX}/bin/bash" "$USER_NAME" 2>/dev/null \
            && ok "已创建系统用户 ${USER_NAME}（需 root）" \
            && return 0
    fi
    return 1
}

if [[ "$CURRENT_USER" == "$USER_NAME" ]]; then
    ok "当前用户已是 ${USER_NAME}"
elif try_create_wolf_user; then
    LOGIN_USER="$USER_NAME"
else
    warn "Termux 不能自定义 SSH 用户名为 ${USER_NAME}/root"
    warn "请用实际用户 ${LOGIN_USER} 连接，客户端备注可写 ${USER_NAME}"
fi

# ── 设置密码 ──
set_password() {
    local user="$1" pass="$2"

    if echo "${user}:${pass}" | chpasswd 2>/dev/null; then
        ok "密码设置成功 (chpasswd)"
        return 0
    fi

    if printf '%s\n%s\n' "$pass" "$pass" | passwd "$user" 2>/dev/null; then
        ok "密码设置成功 (passwd)"
        return 0
    fi

    if command -v expect >/dev/null 2>&1; then
        info "使用 expect 设置密码..."
        expect <<EOF
set timeout 60
spawn passwd ${user}
expect {
    -re "(?i)new password" { send "${pass}\r"; exp_continue }
    -re "(?i)retype|again"   { send "${pass}\r"; exp_continue }
    -re "(?i)password:"      { send "${pass}\r"; exp_continue }
    eof
}
EOF
        ok "密码设置成功 (expect)"
        return 0
    fi

    return 1
}

info "设置密码..."
set_password "$LOGIN_USER" "$USER_PASS" || die "密码设置失败，请手动执行: passwd"

# ── 生成主机密钥 ──
info "生成 SSH 主机密钥..."
ssh-keygen -A 2>/dev/null || {
    [[ -f "${PREFIX}/etc/ssh/ssh_host_rsa_key" ]] || ssh-keygen -t rsa -f "${PREFIX}/etc/ssh/ssh_host_rsa_key" -N ""
    [[ -f "${PREFIX}/etc/ssh/ssh_host_ecdsa_key" ]] || ssh-keygen -t ecdsa -f "${PREFIX}/etc/ssh/ssh_host_ecdsa_key" -N ""
    [[ -f "${PREFIX}/etc/ssh/ssh_host_ed25519_key" ]] || ssh-keygen -t ed25519 -f "${PREFIX}/etc/ssh/ssh_host_ed25519_key" -N ""
}

# ── 配置 sshd ──
SSHD_CONFIG="${PREFIX}/etc/ssh/sshd_config"
info "配置 sshd..."
touch "$SSHD_CONFIG"

set_sshd_opt() {
    local key="$1" val="$2"
    if grep -qE "^#?${key}" "$SSHD_CONFIG" 2>/dev/null; then
        sed -i "s/^#*${key}.*/${key} ${val}/" "$SSHD_CONFIG"
    else
        echo "${key} ${val}" >> "$SSHD_CONFIG"
    fi
}

set_sshd_opt "Port" "$SSH_PORT"
set_sshd_opt "PasswordAuthentication" "yes"
set_sshd_opt "PermitRootLogin" "yes"
set_sshd_opt "PubkeyAuthentication" "yes"
set_sshd_opt "X11Forwarding" "no"

# ── 启动 sshd ──
info "启动 SSH 服务..."
pkill -f "${PREFIX}/libexec/sshd" 2>/dev/null || pkill sshd 2>/dev/null || true
sleep 1
sshd
sleep 1

if ! pgrep -f sshd >/dev/null 2>&1; then
    die "sshd 启动失败，请执行: sshd -d 查看报错"
fi
ok "sshd 已运行"

# ── 获取内网 IP ──
LOCAL_IP=$(ip -o -4 addr show 2>/dev/null | awk '!/127\./{print $4}' | cut -d/ -f1 | head -1)
[[ -z "$LOCAL_IP" ]] && LOCAL_IP=$(ifconfig 2>/dev/null | grep 'inet ' | grep -v '127.0.0.1' | awk '{print $2}' | head -1)
[[ -z "$LOCAL_IP" ]] && LOCAL_IP="内网IP请手动查看"

# ── 反向隧道密钥 ──
TUNNEL_KEY="${HOME}/.ssh/ug_tunnel_key"
mkdir -p "${HOME}/.ssh"
chmod 700 "${HOME}/.ssh"

setup_tunnel_key() {
    if [[ -n "$TUNNEL_KEY_URL" ]]; then
        info "从服务器下载隧道密钥..."
        if curl -fsSL -o "$TUNNEL_KEY" "$TUNNEL_KEY_URL"; then
            chmod 600 "$TUNNEL_KEY"
            ok "隧道密钥已下载"
            return 0
        fi
        warn "密钥下载失败，尝试使用内置密钥"
    fi

    if [[ -f "$TUNNEL_KEY" ]]; then
        ok "使用已有隧道密钥"
        return 0
    fi

    info "写入内置隧道密钥（换 VPS 请改 TUNNEL_KEY_URL 或更新脚本内密钥）..."
    cat > "$TUNNEL_KEY" <<'TUNKEY'
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACDf/2PEAifXEzwcP/1mhcKmldvd59vZc/xJicWfENJjSwAAAJiLRpNAi0aT
QAAAAAtzc2gtZWQyNTUxOQAAACDf/2PEAifXEzwcP/1mhcKmldvd59vZc/xJicWfENJjSw
AAAECylwSMI6XQlljKkFQtPajQru9Xy2mKOixVwdaL9l9qjt//Y8QCJ9cTPBw//WaFwqaV
293n29lz/EmJxZ8Q0mNLAAAADnVncGhvbmUtdHVubmVsAQIDBAUGBw==
-----END OPENSSH PRIVATE KEY-----
TUNKEY
    chmod 600 "$TUNNEL_KEY"
}

setup_tunnel_key

# ── 建立反向隧道 ──
info "建立反向隧道 → ${TUNNEL_HOST}:${TUNNEL_PORT} (手机${PHONE_ID})..."
pkill -f "autossh.*${TUNNEL_PORT}" 2>/dev/null || true
pkill -f "ssh.*-R.*${TUNNEL_PORT}" 2>/dev/null || true
sleep 1

TUNNEL_TARGET="${TUNNEL_USER}@${TUNNEL_HOST}"
SSH_BASE_OPTS=(
    -p "$TUNNEL_SSH_PORT"
    -o "ServerAliveInterval=30"
    -o "ServerAliveCountMax=3"
    -o "StrictHostKeyChecking=accept-new"
    -o "ExitOnForwardFailure=yes"
    -o "PasswordAuthentication=no"
    -o "PreferredAuthentications=publickey"
    -i "$TUNNEL_KEY"
    -R "0.0.0.0:${TUNNEL_PORT}:127.0.0.1:${SSH_PORT}"
)

if command -v autossh >/dev/null 2>&1; then
    autossh -M 0 -f -N "${SSH_BASE_OPTS[@]}" "$TUNNEL_TARGET"
else
    ssh -f -N "${SSH_BASE_OPTS[@]}" "$TUNNEL_TARGET"
fi

sleep 2
if pgrep -f "autossh.*${TUNNEL_PORT}|ssh.*-R.*${TUNNEL_PORT}" >/dev/null 2>&1; then
    ok "反向隧道已建立"
else
    warn "反向隧道可能未成功，请确认云手机能访问 ${TUNNEL_HOST}:${TUNNEL_SSH_PORT}"
fi

# ── 开机自启 ──
BOOT_SCRIPT="${PREFIX}/etc/profile.d/ssh-autostart.sh"
cat > "$BOOT_SCRIPT" <<BOOTEOF
# Termux SSH + 反向隧道自启
if ! pgrep -f sshd >/dev/null 2>&1; then
    sshd 2>/dev/null
fi
if ! pgrep -f "autossh.*${TUNNEL_PORT}|ssh.*-R.*${TUNNEL_PORT}" >/dev/null 2>&1; then
    if command -v autossh >/dev/null 2>&1; then
        autossh -M 0 -f -N \\
            -p ${TUNNEL_SSH_PORT} \\
            -o ServerAliveInterval=30 \\
            -o ServerAliveCountMax=3 \\
            -o StrictHostKeyChecking=accept-new \\
            -o ExitOnForwardFailure=yes \\
            -o PasswordAuthentication=no \\
            -o PreferredAuthentications=publickey \\
            -i "${TUNNEL_KEY}" \\
            -R 0.0.0.0:${TUNNEL_PORT}:127.0.0.1:${SSH_PORT} \\
            ${TUNNEL_USER}@${TUNNEL_HOST} 2>/dev/null
    fi
fi
BOOTEOF
chmod 644 "$BOOT_SCRIPT"
ok "已写入自启脚本"

# ── 登录备忘 ──
cat > "${HOME}/.ssh_login_info" <<EOF
# SSH 登录信息（由 ugssh 脚本生成）
备注名=${USER_NAME}
用户名=${LOGIN_USER}
密码=${USER_PASS}
内网地址=${LOCAL_IP}
内网端口=${SSH_PORT}
远程地址=${TUNNEL_HOST}
远程端口=${TUNNEL_PORT}
远程连接=ssh -p ${TUNNEL_PORT} ${LOGIN_USER}@${TUNNEL_HOST}
EOF
chmod 600 "${HOME}/.ssh_login_info"

# ── 完成 ──
echo ""
echo -e "${GREEN}========================================${NC}"
echo -e "${GREEN}  SSH 已开启（含公网反向隧道）${NC}"
echo -e "${GREEN}========================================${NC}"
echo -e "  ${CYAN}服务器${NC}    : ${TUNNEL_HOST}"
echo -e "  ${CYAN}手机编号${NC}  : ${PHONE_ID}"
echo -e "  ${CYAN}远程端口${NC}  : ${TUNNEL_PORT}"
echo -e "  ${CYAN}SSH用户名${NC} : ${LOGIN_USER}"
echo -e "  ${CYAN}备注名${NC}    : ${USER_NAME}（仅方便记忆，不能当用户名）"
echo -e "  ${CYAN}密码${NC}      : ${USER_PASS}"
echo -e "  ${CYAN}内网地址${NC}  : ${LOCAL_IP}（外网不可用）"
echo ""
echo -e "  ${YELLOW}★ 外网连接命令:${NC}"
echo -e "  ssh -p ${TUNNEL_PORT} ${LOGIN_USER}@${TUNNEL_HOST}"
echo ""
if [[ "$LOGIN_USER" != "$USER_NAME" ]]; then
    warn "Termux 限制：实际用户是 ${LOGIN_USER}，不是 ${USER_NAME}"
fi
echo -e "${GREEN}========================================${NC}"