#!/usr/bin/env bash
set -Eeuo pipefail

SERVICE_NAME="${SERVICE_NAME:-iptables-forward}"
SCRIPT_DIR="${SCRIPT_DIR:-/home/scripts}"
RULE_SCRIPT="${RULE_SCRIPT:-$SCRIPT_DIR/iptables-forward.sh}"
SERVICE_FILE="${SERVICE_FILE:-/etc/systemd/system/${SERVICE_NAME}.service}"
TIMER_FILE="${TIMER_FILE:-/etc/systemd/system/${SERVICE_NAME}.timer}"
DELAY="${DELAY:-20s}"
LAN_A="${LAN_A:-192.168.2.0/24}"
LAN_B="${LAN_B:-192.168.3.0/24}"
TUN_IF="${TUN_IF:-tun0}"
MODE="${1:-install}"

info() { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
warn() { printf '\033[1;33mWARN:\033[0m %s\n' "$*" >&2; }
fail() { printf '\033[1;31mERROR:\033[0m %s\n' "$*" >&2; exit 1; }
need_root() { [ "$(id -u)" -eq 0 ] || fail "请用 root 运行：sudo bash install.sh ${MODE}"; }
need_cmd() { command -v "$1" >/dev/null 2>&1 || fail "缺少命令：$1"; }

write_rule_script() {
  mkdir -p "$SCRIPT_DIR"
  cat > "$RULE_SCRIPT" <<EOF
#!/usr/bin/env bash
set -Eeuo pipefail

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -F FORWARD
iptables -P FORWARD ACCEPT
iptables -A FORWARD -s ${LAN_A} -d ${LAN_B} -j ACCEPT
iptables -A FORWARD -s ${LAN_B} -d ${LAN_A} -j ACCEPT
iptables -A FORWARD -i ${TUN_IF} -j ACCEPT
iptables -A FORWARD -o ${TUN_IF} -j ACCEPT
EOF
  chmod 0755 "$RULE_SCRIPT"
}

write_systemd_units() {
  cat > "$SERVICE_FILE" <<EOF
[Unit]
Description=EasyTier iptables forward rules loader
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=${RULE_SCRIPT}
User=root
EOF

  cat > "$TIMER_FILE" <<EOF
[Unit]
Description=Delay load EasyTier iptables forward rules after boot

[Timer]
OnBootSec=${DELAY}
Unit=${SERVICE_NAME}.service

[Install]
WantedBy=timers.target
EOF
}

install_all() {
  need_root
  need_cmd systemctl
  need_cmd iptables
  info "写入转发规则脚本：$RULE_SCRIPT"
  write_rule_script
  info "写入 systemd service/timer"
  write_systemd_units
  info "加载并启用 timer（只启用 timer，不直接 enable service）"
  systemctl daemon-reload
  systemctl enable --now "${SERVICE_NAME}.timer"
  info "立即执行一次规则加载，避免等到下次开机才生效"
  systemctl start "${SERVICE_NAME}.service"
  info "安装完成"
  status_all
}

uninstall_all() {
  need_root
  need_cmd systemctl
  info "停止并禁用 timer/service"
  systemctl disable --now "${SERVICE_NAME}.timer" 2>/dev/null || true
  systemctl stop "${SERVICE_NAME}.service" 2>/dev/null || true
  rm -f "$SERVICE_FILE" "$TIMER_FILE" "$RULE_SCRIPT"
  systemctl daemon-reload
  info "已移除 systemd 单元和规则脚本；现有 iptables 规则不会自动清空，如需清空请手动执行 iptables 管理命令。"
}

status_all() {
  need_root
  printf '\n# systemd timer\n'
  systemctl --no-pager --full status "${SERVICE_NAME}.timer" || true
  printf '\n# systemd service\n'
  systemctl --no-pager --full status "${SERVICE_NAME}.service" || true
  printf '\n# ip_forward\n'
  cat /proc/sys/net/ipv4/ip_forward || true
  printf '\n# iptables FORWARD\n'
  iptables -S FORWARD || true
}

case "$MODE" in
  install) install_all ;;
  uninstall|remove) uninstall_all ;;
  status) status_all ;;
  *)
    cat <<USAGE
Usage: sudo bash install.sh [install|status|uninstall]

Environment overrides:
  LAN_A=$LAN_A
  LAN_B=$LAN_B
  TUN_IF=$TUN_IF
  DELAY=$DELAY
  SERVICE_NAME=$SERVICE_NAME
  SCRIPT_DIR=$SCRIPT_DIR

Examples:
  sudo bash install.sh install
  sudo LAN_A=192.168.2.0/24 LAN_B=192.168.3.0/24 TUN_IF=tun0 bash install.sh install
  sudo DELAY=30s bash install.sh install
  sudo bash install.sh status
  sudo bash install.sh uninstall
USAGE
    exit 2
    ;;
esac