# ═══════════════════════════════════════════════
# 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001
# 📜 Copyright: 国作登字-2026-A-00037559
# ═══════════════════════════════════════════════
# 🌐 铸渊专线 · 部署与管理
#
# 铸渊核心身体 · 锻心器官扩展
# 管理代理服务的安装、更新、订阅发送
# ═══════════════════════════════════════════════

name: '🌐 铸渊专线 · 部署'

on:
  workflow_dispatch:
    inputs:
      action:
        description: '操作类型'
        required: true
        type: choice
        options:
          - install
          - update
          - status
          - restart
          - send-subscription
          - update-dashboard
          - setup-cn-relay
        default: 'status'
      email:
        description: '目标邮箱 (仅send-subscription时需要)'
        required: false
        type: string

permissions:
  contents: write

jobs:
  # ═══ §1 代理服务部署 ═══
  deploy-proxy:
    name: '🌐 代理服务 · ${{ github.event.inputs.action }}'
    runs-on: ubuntu-latest
    if: >-
      github.event.inputs.action == 'install' ||
      github.event.inputs.action == 'update' ||
      github.event.inputs.action == 'status' ||
      github.event.inputs.action == 'restart'

    steps:
      - name: '📥 检出代码'
        uses: actions/checkout@v4

      - name: '🔑 配置SSH密钥'
        env:
          SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/id_deploy
          chmod 600 ~/.ssh/id_deploy

          # 验证密钥格式
          if ! head -1 ~/.ssh/id_deploy | grep -q "BEGIN"; then
            echo "❌ SSH密钥格式异常"
            exit 1
          fi

          ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

          # 连接测试
          ssh -i ~/.ssh/id_deploy \
              -o StrictHostKeyChecking=accept-new \
              -o BatchMode=yes \
              -o ConnectTimeout=15 \
              ${{ secrets.ZY_SERVER_USER }}@${{ secrets.ZY_SERVER_HOST }} \
              "echo '✅ SSH连接成功'"

      - name: '📦 上传代理服务代码'
        if: >-
          github.event.inputs.action == 'install' ||
          github.event.inputs.action == 'update'
        run: |
          rsync -avz --delete \
            -e "ssh -i ~/.ssh/id_deploy -o StrictHostKeyChecking=accept-new" \
            server/proxy/ \
            ${{ secrets.ZY_SERVER_USER }}@${{ secrets.ZY_SERVER_HOST }}:/opt/zhuyuan/proxy-deploy/

      - name: '🚀 执行部署'
        run: |
          ssh -i ~/.ssh/id_deploy \
              -o StrictHostKeyChecking=accept-new \
              ${{ secrets.ZY_SERVER_USER }}@${{ secrets.ZY_SERVER_HOST }} \
              "cd /opt/zhuyuan/proxy-deploy && \
               export ZY_SERVER_HOST='${{ secrets.ZY_SERVER_HOST }}' && \
               export ZY_CN_RELAY_HOST='${{ secrets.ZY_CN_SERVER_HOST }}' && \
               bash deploy-proxy.sh ${{ github.event.inputs.action }}"

      - name: '🧹 清理SSH密钥'
        if: always()
        run: rm -f ~/.ssh/id_deploy

  # ═══ §2 发送订阅链接 ═══
  send-subscription:
    name: '📧 发送订阅链接'
    runs-on: ubuntu-latest
    if: github.event.inputs.action == 'send-subscription'

    steps:
      - name: '📥 检出代码'
        uses: actions/checkout@v4

      - name: '🔑 配置SSH密钥'
        env:
          SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/id_deploy
          chmod 600 ~/.ssh/id_deploy
          ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

      - name: '📧 发送订阅邮件'
        run: |
          TARGET_EMAIL="${{ github.event.inputs.email }}"
          if [ -z "$TARGET_EMAIL" ]; then
            TARGET_EMAIL="${{ secrets.ZY_SMTP_USER }}"
          fi

          echo "📧 发送订阅到: $TARGET_EMAIL"

          ssh -i ~/.ssh/id_deploy \
              -o StrictHostKeyChecking=accept-new \
              ${{ secrets.ZY_SERVER_USER }}@${{ secrets.ZY_SERVER_HOST }} \
              "cd /opt/zhuyuan/proxy && \
               ZY_SMTP_USER='${{ secrets.ZY_SMTP_USER }}' \
               ZY_SMTP_PASS='${{ secrets.ZY_SMTP_PASS }}' \
               ZY_SERVER_HOST='${{ secrets.ZY_SERVER_HOST }}' \
               node service/send-subscription.js send '$TARGET_EMAIL'"

      - name: '🧹 清理SSH密钥'
        if: always()
        run: rm -f ~/.ssh/id_deploy

  # ═══ §3 更新仪表盘 ═══
  update-dashboard:
    name: '📊 更新仪表盘'
    runs-on: ubuntu-latest
    if: github.event.inputs.action == 'update-dashboard'

    steps:
      - name: '📥 检出代码'
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.ZY_GITHUB_PAT }}

      - name: '🔑 配置SSH密钥'
        env:
          SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/id_deploy
          chmod 600 ~/.ssh/id_deploy
          ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

      - name: '📊 获取流量数据'
        run: |
          # 从服务器获取配额数据
          ssh -i ~/.ssh/id_deploy \
              -o StrictHostKeyChecking=accept-new \
              ${{ secrets.ZY_SERVER_USER }}@${{ secrets.ZY_SERVER_HOST }} \
              "cat /opt/zhuyuan/proxy/data/quota-status.json 2>/dev/null || echo '{}'" \
              > /tmp/quota-status.json

          cat /tmp/quota-status.json

      - name: '📝 更新README仪表盘'
        run: |
          node server/proxy/dashboard/update-dashboard.js --json /tmp/quota-status.json

      - name: '📤 提交更新'
        run: |
          git config user.name "铸渊 · ZhuYuan"
          git config user.email "zhuyuan-bot@guanghulab.com"

          if git diff --quiet README.md; then
            echo "仪表盘无变化"
          else
            git add README.md
            git commit -m "📊 铸渊专线仪表盘更新 · $(date -u +%Y-%m-%d)"
            git push
            echo "✅ 仪表盘已更新并推送"
          fi

      - name: '🧹 清理'
        if: always()
        run: rm -f ~/.ssh/id_deploy /tmp/quota-status.json

  # ═══ §4 CN中转配置 ═══
  setup-cn-relay:
    name: '🇨🇳 CN中转配置'
    runs-on: ubuntu-latest
    if: github.event.inputs.action == 'setup-cn-relay'

    steps:
      - name: '📥 检出代码'
        uses: actions/checkout@v4

      - name: '🔑 配置CN服务器SSH密钥'
        env:
          SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
          CN_SSH_PORT: ${{ secrets.ZY_CN_SSH_PORT }}
        run: |
          # 端口配置 (支持自定义SSH端口，腾讯云服务器常用非22端口)
          SSH_PORT="${CN_SSH_PORT:-22}"
          echo "SSH_PORT=${SSH_PORT}" >> $GITHUB_ENV
          echo "🔧 CN服务器SSH端口: ${SSH_PORT}"

          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/id_cn
          chmod 600 ~/.ssh/id_cn

          if ! head -1 ~/.ssh/id_cn | grep -q "BEGIN"; then
            echo "❌ CN服务器SSH密钥格式异常"
            echo "  请检查 ZY_CN_SERVER_KEY Secret"
            exit 1
          fi

          echo "🔍 扫描CN服务器主机密钥 (端口 ${SSH_PORT})..."
          ssh-keyscan -p ${SSH_PORT} -H ${{ secrets.ZY_CN_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

          echo "🔗 测试SSH连接..."
          ssh -i ~/.ssh/id_cn \
              -p ${SSH_PORT} \
              -o StrictHostKeyChecking=accept-new \
              -o BatchMode=yes \
              -o ConnectTimeout=15 \
              ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} \
              "echo '✅ CN服务器SSH连接成功'" || {
            echo ""
            echo "❌ SSH连接失败 · 排查清单:"
            echo "  1. 确认 ZY_CN_SSH_PORT Secret 已设置为CN服务器的SSH端口 (当前: ${SSH_PORT})"
            echo "  2. 腾讯云控制台 → 安全组 → 确认入站规则允许端口 ${SSH_PORT}"
            echo "  3. 确认 ZY_CN_SERVER_HOST 地址正确"
            echo "  4. 确认 ZY_CN_SERVER_KEY 密钥与服务器匹配"
            echo "  5. 确认CN服务器已开机且SSH服务正在运行"
            exit 1
          }

      - name: '📦 上传CN中转脚本'
        run: |
          scp -i ~/.ssh/id_cn \
            -P ${{ env.SSH_PORT }} \
            -o StrictHostKeyChecking=accept-new \
            server/proxy/setup/setup-cn-relay.sh \
            ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }}:/tmp/setup-cn-relay.sh

      - name: '🇨🇳 执行CN中转配置'
        run: |
          ssh -i ~/.ssh/id_cn \
              -p ${{ env.SSH_PORT }} \
              -o StrictHostKeyChecking=accept-new \
              ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} \
              "chmod +x /tmp/setup-cn-relay.sh && \
               export ZY_SG_SERVER_HOST='${{ secrets.ZY_SERVER_HOST }}' && \
               sudo -E bash /tmp/setup-cn-relay.sh"

      - name: '💚 CN中转验证'
        run: |
          CN_HOST="${{ secrets.ZY_CN_SERVER_HOST }}"
          echo "🔍 验证CN中转..."

          # 检查中转端口
          if nc -z -w5 "$CN_HOST" 2053 2>/dev/null; then
            echo "✅ CN中转端口 2053: 可达"
          else
            echo "⚠️ CN中转端口 2053: 暂不可达 (可能需要等待防火墙生效)"
          fi

          # 检查HTTP健康
          HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" "http://${CN_HOST}/health" 2>/dev/null || echo "000")
          if [ "$HTTP_CODE" = "200" ]; then
            echo "✅ CN HTTP健康检查: 正常"
          else
            echo "⚠️ CN HTTP: 状态码 $HTTP_CODE (可能需要等待)"
          fi

      - name: '🧹 清理SSH密钥'
        if: always()
        run: rm -f ~/.ssh/id_cn