#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

# Verified bootstrapper for WEB PANEL PROXY v2.0.2.
# Installs the Telegram WEB proxy plus a private management panel.

readonly PANEL_VERSION="v2.0.2"
readonly ARCHIVE_URL="https://github.com/POLESNIESOVETI12/web-panel-proxy/archive/refs/tags/${PANEL_VERSION}.zip"
readonly ARCHIVE_SHA256="ac2258323b71bde13eb45314a0a70449561774697c5e4d3603791e459c55e7bb"

WORK_DIR=""
die() { printf '\nERROR: %s\n' "$*" >&2; exit 1; }
cleanup() { [[ -z "${WORK_DIR}" || ! -d "${WORK_DIR}" ]] || rm -rf -- "${WORK_DIR}"; }
trap cleanup EXIT

[[ "${EUID}" -eq 0 ]] || die "Run as root: sudo bash install-with-panel.sh"
[[ "$(uname -m)" == "x86_64" ]] || die "An x86_64 VPS is required."
[[ -r /etc/os-release ]] || die "Cannot identify the operating system."
# shellcheck disable=SC1091
source /etc/os-release
case "${ID:-}" in
  ubuntu) dpkg --compare-versions "${VERSION_ID:-0}" ge 22.04 || die "Ubuntu 22.04+ is required." ;;
  debian) dpkg --compare-versions "${VERSION_ID:-0}" ge 12 || die "Debian 12+ is required." ;;
  *) die "Supported systems: Ubuntu 22.04+ or Debian 12+." ;;
esac

export DEBIAN_FRONTEND=noninteractive
if ! command -v curl >/dev/null 2>&1 || ! command -v unzip >/dev/null 2>&1; then
  apt-get -o DPkg::Lock::Timeout=600 update
  apt-get -o DPkg::Lock::Timeout=600 install -y --no-install-recommends curl unzip ca-certificates
fi
command -v sha256sum >/dev/null 2>&1 || die "sha256sum is required."

WORK_DIR="$(mktemp -d /tmp/telegram-web-panel.XXXXXXXX)"
ARCHIVE="${WORK_DIR}/panel.zip"

printf '\n==> Downloading WEB PANEL PROXY %s\n' "${PANEL_VERSION}"
curl --fail --silent --show-error --location \
  --proto '=https' --proto-redir '=https' --tlsv1.2 \
  --output "${ARCHIVE}" "${ARCHIVE_URL}"

ACTUAL_SHA256="$(sha256sum "${ARCHIVE}" | awk '{print $1}')"
[[ "${ACTUAL_SHA256}" == "${ARCHIVE_SHA256}" ]] ||
  die "Downloaded archive checksum mismatch; installation was not started."

unzip -q "${ARCHIVE}" -d "${WORK_DIR}/source"
SOURCE_DIR="${WORK_DIR}/source/web-panel-proxy-${PANEL_VERSION#v}"
for file in install-final.sh install-webproxy-core.sh install-panel.sh uninstall-web-proxy.sh; do
  [[ -s "${SOURCE_DIR}/${file}" ]] || die "Installation package is incomplete: ${file}"
done
chmod 0700 "${SOURCE_DIR}"/*.sh

printf '%s\n' \
  "" \
  "The installer will ask for:" \
  "  1. proxy hostname (A record must already point to this VPS);" \
  "  2. certificate email;" \
  "  3. panel login and password." \
  ""

bash "${SOURCE_DIR}/install-final.sh"

DOMAIN="$(sed -n 's/^Environment=TPROXY_HOSTNAME=//p' /etc/systemd/system/caddy.service.d/tproxy.conf 2>/dev/null | head -n1 || true)"
PANEL_PATH="$(sed -n 's/^Environment=WEBPROXY_PANEL_PATH=//p' /etc/systemd/system/tproxy-panel.service 2>/dev/null | head -n1 || true)"
if [[ -n "${DOMAIN}" && "${PANEL_PATH}" =~ ^/panel-[a-f0-9]+$ ]]; then
  cat > /root/telegram-web-panel-address.txt <<EOF
Panel URL: https://${DOMAIN}${PANEL_PATH}/login
Configuration: /etc/web-proxy-panel
Panel data: /var/lib/tproxy-panel
Diagnostics: systemctl status caddy mtproxy tproxy-server tproxy-panel --no-pager
EOF
  chmod 0600 /root/telegram-web-panel-address.txt
  printf '\nPanel address saved to /root/telegram-web-panel-address.txt\n'
fi