# ==============================================================================
# Sing-Box 一键自动化部署脚本 (~/home/sing-box)
# 对应文章流程：自动下载依赖 -> 生成证书与UUID -> 配置 -> NSSM服务化
# ==============================================================================

$ErrorActionPreference = "Stop"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# 1. 自动定位家目录 ~/home/sing-box
$HomeDir = $env:USERPROFILE
$WorkDir = Join-Path -Path $HomeDir -ChildPath "home\sing-box"

if (-not (Test-Path $WorkDir)) {
    New-Item -ItemType Directory -Path $WorkDir -Force | Out-Null
}
Set-Location -Path $WorkDir
$WorkDirForwardSlash = $WorkDir.Replace('\', '/')

Write-Host "====== [1/5] 下载并安装环境依赖 ======" -ForegroundColor Green
Write-Host "工作路径: $WorkDir" -ForegroundColor Cyan

# 1.1 安装 VC++ Runtime
Write-Host "正在下载/安装 VC++ Runtime..." -ForegroundColor Yellow
Invoke-WebRequest -Uri "https://aka.ms/vs/17/release/vc_redist.x64.exe" -OutFile "$WorkDir\vc_redist.x64.exe"
Start-Process -FilePath "$WorkDir\vc_redist.x64.exe" -ArgumentList "/install", "/quiet", "/norestart" -Wait
Remove-Item "$WorkDir\vc_redist.x64.exe" -Force

# 1.2 自动从 GitHub API 下载最新 64 位 Sing-Box
Write-Host "正在获取最新版 Sing-Box..." -ForegroundColor Yellow
$singboxRelease = Invoke-RestMethod -Uri "https://api.github.com/repos/SagerNet/sing-box/releases/latest"
$singboxAsset = $singboxRelease.assets | Where-Object { $_.name -like "*windows-amd64.zip" } | Select-Object -First 1
$singboxZip = "$WorkDir\sing-box.zip"
Invoke-WebRequest -Uri $singboxAsset.browser_download_url -OutFile $singboxZip
Expand-Archive -Path $singboxZip -DestinationPath "$WorkDir\temp_singbox" -Force

$exePath = Get-ChildItem -Path "$WorkDir\temp_singbox" -Recurse -Filter "sing-box.exe" | Select-Object -First 1
Move-Item -Path $exePath.FullName -Destination "$WorkDir\sing-box.exe" -Force
Remove-Item "$WorkDir\temp_singbox", $singboxZip -Recurse -Force

# 1.3 下载 NSSM
Write-Host "正在下载 NSSM..." -ForegroundColor Yellow
$nssmZip = "$WorkDir\nssm.zip"
Invoke-WebRequest -Uri "https://nssm.cc/release/nssm-2.24.zip" -OutFile $nssmZip
Expand-Archive -Path $nssmZip -DestinationPath "$WorkDir\temp_nssm" -Force
Move-Item -Path "$WorkDir\temp_nssm\nssm-2.24\win64\nssm.exe" -Destination "$WorkDir\nssm.exe" -Force
Remove-Item "$WorkDir\temp_nssm", $nssmZip -Recurse -Force

# 1.4 下载 OpenSSL
Write-Host "正在下载 OpenSSL..." -ForegroundColor Yellow
$opensslZip = "$WorkDir\openssl.zip"
Invoke-WebRequest -Uri "https://github.com/IndySockets/OpenSSL-Binaries/raw/master/Archive/openssl-1.1.1w-x64-win64.zip" -OutFile $opensslZip
Expand-Archive -Path $opensslZip -DestinationPath "$WorkDir\openssl" -Force
Remove-Item $opensslZip -Force
$opensslExe = "$WorkDir\openssl\openssl.exe"


Write-Host "`n====== [2/5] 生成 OpenSSL 自签名证书 ======" -ForegroundColor Green
$crtPath = "$WorkDir\server.crt"
$keyPath = "$WorkDir\server.key"

& $opensslExe req -x509 -nodes -days 3650 -newkey rsa:2048 `
  -keyout $keyPath -out $crtPath `
  -subj "/CN=sing-box.local/O=SingBox/OU=Server"


Write-Host "`n====== [3/5] 动态生成 UUID 与 config.json ======" -ForegroundColor Green
$userUUID = [guid]::NewGuid().ToString().ToUpper()

$configJson = @"
{
    "log": {
        "level": "info",
        "output": "$WorkDirForwardSlash/sing-box.log",
        "timestamp": true
    },
    "inbounds": [
        {
            "type": "vless",
            "tag": "vless-in",
            "listen": "0.0.0.0",
            "listen_port": 443,
            "users": [
                {
                    "uuid": "$userUUID"
                }
            ],
            "transport": {
                "type": "ws",
                "path": "/ws"
            },
            "tls": {
                "enabled": true,
                "certificate_path": "$WorkDirForwardSlash/server.crt",
                "key_path": "$WorkDirForwardSlash/server.key",
                "insecure": true
            }
        }
    ],
    "outbounds": [
        {
            "type": "direct",
            "tag": "direct"
        }
    ]
}
"@

$configJson | Out-File -FilePath "$WorkDir\config.json" -Encoding UTF8 -Force


Write-Host "`n====== [4/5] 验证配置文件 ======" -ForegroundColor Green
& "$WorkDir\sing-box.exe" check -c "$WorkDir\config.json"


Write-Host "`n====== [5/5] NSSM 注册并启动系统服务 ======" -ForegroundColor Green
$ServiceName = "sing-box"

$existingService = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue
if ($existingService) {
    & "$WorkDir\nssm.exe" stop $ServiceName
    & "$WorkDir\nssm.exe" remove $ServiceName confirm
}

& "$WorkDir\nssm.exe" install $ServiceName "$WorkDir\sing-box.exe" "run -c config.json"
& "$WorkDir\nssm.exe" set $ServiceName AppDirectory "$WorkDir"
& "$WorkDir\nssm.exe" set $ServiceName Start SERVICE_AUTO_START
& "$WorkDir\nssm.exe" set $ServiceName AppExit Default Restart
& "$WorkDir\nssm.exe" set $ServiceName AppStdout "$WorkDir\service_stdout.log"
& "$WorkDir\nssm.exe" set $ServiceName AppStderr "$WorkDir\service_stderr.log"
& "$WorkDir\nssm.exe" start $ServiceName

Write-Host "`n========================================================" -ForegroundColor Green
Write-Host " 🎉 Sing-box 部署完成！" -ForegroundColor Green
Write-Host " 📁 安装位置: $WorkDir" -ForegroundColor Yellow
Write-Host " 🔑 生成的 UUID: $userUUID" -ForegroundColor Yellow
Write-Host "========================================================" -ForegroundColor Green