#!/bin/bash

# ============================================================
# noVNC 公网暴露脚本
# 通过 cloudflared quick tunnel 暴露 :6080 到公网
# 域名不固定（进程存活期间不变，重启/超时回收）
# ============================================================

echo "========== 启动 cloudflared 隧道 =========="
echo ""

# ---------- 1. 检查 cloudflared ----------
if ! command -v cloudflared &>/dev/null; then
    echo "❌ cloudflared 未安装"
    echo "  安装命令："
    echo "  curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 -o /usr/local/bin/cloudflared"
    echo "  chmod +x /usr/local/bin/cloudflared"
    exit 1
fi

echo "cloudflared 版本: $(cloudflared --version 2>&1)"
echo ""

# ---------- 2. 检查 6080 是否在监听 ----------
if ! ss -ltnp 2>/dev/null | grep -q ':6080'; then
    echo "❌ :6080 未监听，请先运行: ./start-novnc.sh"
    exit 1
fi
echo "✅ :6080 在监听"
echo ""

# ---------- 3. 防重复启动 ----------
echo "[1/2] 检查已有隧道..."
EXISTING_PIDS=$(pgrep -f "cloudflared.*tunnel.*--url.*localhost:6080" 2>/dev/null || true)
if [ -n "$EXISTING_PIDS" ]; then
    echo "  ⚠️  已有隧道在运行 (PID: $EXISTING_PIDS)"
    echo "  域名可能已失效，杀旧建新..."
    echo "$EXISTING_PIDS" | while read pid; do
        kill "$pid" 2>/dev/null
    done
    sleep 2
    # 强杀残留
    pgrep -f "cloudflared.*tunnel.*--url.*localhost:6080" 2>/dev/null | while read pid; do
        kill -9 "$pid" 2>/dev/null
    done
    sleep 1
fi

# ---------- 4. 启动新隧道 ----------
echo ""
echo "[2/2] 启动 cloudflared quick tunnel (:6080)..."
LOG_FILE="/tmp/novnc_cfqt.log"
nohup cloudflared tunnel --url http://localhost:6080 > "$LOG_FILE" 2>&1 &
TUNNEL_PID=$!
echo "  隧道进程 PID: $TUNNEL_PID"

# ---------- 5. 等待域名分配 ----------
echo ""
echo "等待域名分配（最多 30 秒）..."
DOMAIN=""
for i in $(seq 1 30); do
    sleep 1
    DOMAIN=$(grep -oE "https://[a-z0-9-]+\.trycloudflare\.com" "$LOG_FILE" 2>/dev/null | head -1)
    if [ -n "$DOMAIN" ]; then
        break
    fi
done

if [ -z "$DOMAIN" ]; then
    echo "❌ 域名获取失败，查看日志："
    tail -20 "$LOG_FILE"
    exit 1
fi

# ---------- 6. 验证公网可达 ----------
echo ""
echo "验证公网可达性..."
sleep 2
HTTP_CODE=$(curl -s --max-time 10 -o /dev/null -w "%{http_code}" "$DOMAIN/" 2>/dev/null)

# ---------- 7. 输出结果 ----------
echo ""
echo "========== 隧道启动完成 =========="
echo ""
echo "  公网域名: $DOMAIN"
echo "  HTTP 状态: $HTTP_CODE"
echo "  域名已写入: /tmp/novnc_cfqt_domain.txt"
echo ""
echo "$DOMAIN" > /tmp/novnc_cfqt_domain.txt

# 页面内容验证
NOVNC_CHECK=$(curl -s --max-time 10 "$DOMAIN/" 2>/dev/null | grep -c "noVNC" || echo 0)
if [ "$NOVNC_CHECK" -gt 0 ]; then
    echo "  ✅ noVNC 页面验证通过"
else
    echo "  ⚠️  页面可能异常（未检测到 noVNC 标记）"
    echo "  如果显示目录列表，在本机运行："
    echo "    cd /usr/share/novnc && ln -sf vnc.html index.html"
fi

echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "  浏览器打开: $DOMAIN"
echo "  输入 VNC 密码 → 进入桌面"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo "⚠️  注意："
echo "  - cfqt 域名不固定，隧道进程重启域名会变"
echo "  - 域名无鉴权，任何人拿到都能访问，VNC 密码是唯一防线"
echo "  - 要固定域名需注册 Cloudflare 账号配置命名隧道"
echo ""