#!/usr/bin/env bash
# Hand-written nginx vhosts (no aaPanel):
#   - landing   : <DOMAIN_ROOT>            -> static page
#   - cover     : <SUB_COVER>.<root>       -> 6 WS reverse proxies (one per inbound) + benign root
#   - xui panel : <SUB_XUI>.<root>         -> 127.0.0.1:<XUI_PORT>
#   - default   : unmatched SNI            -> return 444
# All TLS via the standalone wildcard cert; HTTP :80 -> 301 HTTPS.
. "$(dirname "$0")/_lib.sh"
HERE="$(cd "$(dirname "$0")" && pwd)"

COVER="$SUB_COVER.$DOMAIN_ROOT"
XUI_HOST="$SUB_XUI.$DOMAIN_ROOT"
CERTDIR="/etc/nginx/ssl/$DOMAIN_ROOT"

# landing page html (shared by landing + cover root so neither looks dead)
LANDING_HTML="$(sed "s/__NODE_NAME__/$NODE_NAME/g" "$HERE/../templates/landing.html")"

# build the 6 WS location blocks
WS_BLOCKS=""
add_ws() { # $1=path $2=port $3=name
  WS_BLOCKS+="
    # $3
    location = $1 {
        proxy_pass http://127.0.0.1:$2;
        proxy_http_version 1.1;
        proxy_set_header Upgrade \\\$http_upgrade;
        proxy_set_header Connection \\\$connection_upgrade;
        proxy_set_header Host \\\$host;
        proxy_set_header X-Real-IP \\\$remote_addr;
        proxy_set_header X-Forwarded-For \\\$proxy_add_x_forwarded_for;
        proxy_read_timeout 300s;
        proxy_send_timeout 300s;
    }"
}
add_ws "$WS_PATH_VMESS_DIRECT"  "$PORT_VMESS_DIRECT"  "vmess-direct"
add_ws "$WS_PATH_VMESS_WARP"    "$PORT_VMESS_WARP"    "vmess-warp"
add_ws "$WS_PATH_TROJAN_DIRECT" "$PORT_TROJAN_DIRECT" "trojan-direct"
add_ws "$WS_PATH_TROJAN_WARP"   "$PORT_TROJAN_WARP"   "trojan-warp"
add_ws "$WS_PATH_SS_DIRECT"     "$PORT_SS_DIRECT"     "ss-direct"
add_ws "$WS_PATH_SS_WARP"       "$PORT_SS_WARP"       "ss-warp"

# push landing content to the box
printf '%s' "$LANDING_HTML" | run "mkdir -p /var/www/$DOMAIN_ROOT /var/www/$COVER && cat > /var/www/$DOMAIN_ROOT/index.html && cp /var/www/$DOMAIN_ROOT/index.html /var/www/$COVER/index.html"

# write the vhost config
run "cat > /etc/nginx/conf.d/edge.conf <<CONF
map \\\$http_upgrade \\\$connection_upgrade { default upgrade; '' close; }

# HTTP -> HTTPS
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    return 301 https://\\\$host\\\$request_uri;
}

# default TLS server: unmatched SNI -> drop
server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    server_name _;
    ssl_certificate $CERTDIR/fullchain.pem;
    ssl_certificate_key $CERTDIR/privkey.pem;
    return 444;
}

# landing
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name $DOMAIN_ROOT;
    ssl_certificate $CERTDIR/fullchain.pem;
    ssl_certificate_key $CERTDIR/privkey.pem;
    root /var/www/$DOMAIN_ROOT;
    index index.html;
    location / { try_files \\\$uri \\\$uri/ =404; }
}

# node cover: 6 WS reverse proxies + benign root
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name $COVER;
    ssl_certificate $CERTDIR/fullchain.pem;
    ssl_certificate_key $CERTDIR/privkey.pem;
    root /var/www/$COVER;
    index index.html;
$WS_BLOCKS

    location / { try_files \\\$uri \\\$uri/ =404; }
}

# 3x-ui panel
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name $XUI_HOST;
    ssl_certificate $CERTDIR/fullchain.pem;
    ssl_certificate_key $CERTDIR/privkey.pem;
    location / {
        proxy_pass http://127.0.0.1:$XUI_PORT;
        proxy_http_version 1.1;
        proxy_set_header Upgrade \\\$http_upgrade;
        proxy_set_header Connection \\\$connection_upgrade;
        proxy_set_header Host \\\$host;
        proxy_set_header X-Real-IP \\\$remote_addr;
        proxy_set_header X-Forwarded-For \\\$proxy_add_x_forwarded_for;
        proxy_read_timeout 300s;
    }
}
CONF

# apt nginx ships a default_server on :80 -> remove so ours wins
rm -f /etc/nginx/sites-enabled/default
nginx -t && systemctl reload nginx && echo nginx-reloaded"