国内无需端口号直连自建服务器（免备案）

# 强制管道输出使用无 BOM 的 UTF-8，避免 bash 解析报错
$OutputEncoding = [System.Text.UTF8Encoding]::new($false)

# ========================= 必填参数（按需修改） =========================
# 服务器公网 IP 或域名
$ServerIp = "[填写你的VPS公网IP]"
# SSH 登录用户（通常是 root）
$SshUser = "root"
# SSH 端口，如果没有改过默认是 22
$SshPort = 22
# 是否自动接收新主机指纹（首次连接建议 true）
$AcceptNewHostKey = $true
# SSH 私钥路径（部署脚本会自动生成并写入服务器 authorized_keys）
$SshPrivateKeyPath = Join-Path $env:USERPROFILE ".ssh\id_ed25519"

# ========================= FRP 参数（可选） =========================
# FRP 版本：默认 latest（自动拉取 GitHub 最新发布）
$FrpVersion = "latest"
# FRPS 服务监听端口（给 frpc 连接）
$FrpsBindPort = 7000

# ========================= 防火墙参数（可选） =========================
# 是否放行 Dashboard 端口（仅放行端口，不写 dashboard 配置）
$AllowDashboardInUfw = $true
$DashboardPort = 7500

$ErrorActionPreference = "Stop"

function Get-OpenSshTool([string]$Name) {
  $cmd = Get-Command $Name -ErrorAction SilentlyContinue
  if ($cmd) { return $cmd.Source }
  throw "未找到 $Name。请先启用 Windows OpenSSH Client。"
}

$ssh = Get-OpenSshTool "ssh.exe"
$sshKeygen = Get-OpenSshTool "ssh-keygen.exe"

$sshOptions = @()
if ($AcceptNewHostKey) {
  $sshOptions += @("-o", "StrictHostKeyChecking=accept-new")
}

$target = "$SshUser@$ServerIp"

function Test-KeyLogin {
  & $ssh @sshOptions -p $SshPort -i $SshPrivateKeyPath -o BatchMode=yes $target "echo key-auth-ok" | Out-Null
  return ($LASTEXITCODE -eq 0)
}

function Ensure-SshKeyAuth {
  if (-not (Test-Path $SshPrivateKeyPath)) {
    $keyDir = Split-Path -Parent $SshPrivateKeyPath
    if (-not (Test-Path $keyDir)) { New-Item -ItemType Directory -Path $keyDir -Force | Out-Null }
    & $sshKeygen -t ed25519 -f $SshPrivateKeyPath -N "" -C "frp-deploy@$env:COMPUTERNAME" | Out-Null
  }

  if (Test-KeyLogin) {
    Write-Host "SSH 密钥已可用，后续将使用免密连接。" -ForegroundColor Green
    return
  }

  Write-Host "正在配置服务器 authorized_keys（首次运行将提示你输入一次 VPS 服务器的 SSH 密码）..." -ForegroundColor Yellow
  $pubKeyPath = "$SshPrivateKeyPath.pub"
  if (-not (Test-Path $pubKeyPath)) {
    throw "未找到公钥文件: $pubKeyPath"
  }

  $pubKeyContent = (Get-Content $pubKeyPath -Raw).Trim()
  $passwordAuthOptions = @(
    "-o", "PubkeyAuthentication=no",
    "-o", "PreferredAuthentications=password,keyboard-interactive"
  )
  # 写入公钥，同时确保 sshd_config 中 PubkeyAuthentication 为 yes 并重启 sshd
  $remoteAddKeyCmd = @"
umask 077
mkdir -p ~/.ssh
touch ~/.ssh/authorized_keys
grep -qxF "$pubKeyContent" ~/.ssh/authorized_keys || printf '%s\n' "$pubKeyContent" >> ~/.ssh/authorized_keys
sort -u ~/.ssh/authorized_keys -o ~/.ssh/authorized_keys
# 启用密钥登录（修复部分 VPS 出厂默认禁用的情况）
sed -i 's/^#*\s*PubkeyAuthentication\s.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
grep -qE '^PubkeyAuthentication' /etc/ssh/sshd_config || echo 'PubkeyAuthentication yes' >> /etc/ssh/sshd_config
systemctl restart sshd 2>/dev/null || service ssh restart 2>/dev/null || true
"@

  & $ssh @sshOptions @passwordAuthOptions -p $SshPort $target $remoteAddKeyCmd
  if ($LASTEXITCODE -ne 0) {
    throw "写入服务器 authorized_keys 失败。"
  }

  Start-Sleep -Seconds 3

  if (-not (Test-KeyLogin)) {
    throw "SSH 密钥登录验证失败，请检查服务器 SSH 配置。"
  }

  Write-Host "SSH 密钥配置完成，后续连接无需密码环节。" -ForegroundColor Green
}

$remoteScript = @"
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive

# 初始化 Debian 基础源与依赖补齐
cat >/etc/apt/sources.list <<'EOF'
deb http://deb.debian.org/debian bullseye main contrib non-free
deb http://deb.debian.org/debian bullseye-updates main contrib non-free
deb http://security.debian.org/debian-security bullseye-security main contrib non-free
EOF

apt-get clean
rm -rf /var/lib/apt/lists/*
apt-get update
apt-get install -y wget curl tar ufw gnupg debian-keyring debian-archive-keyring apt-transport-https

# 检测和自动安装 FRPS
FRPS_INSTALLED='false'
if [ -x /opt/frp/frps ] && [ -f /etc/systemd/system/frps.service ]; then
  echo '检测到 FRPS 已存在，自动跳过安装。'
else
  FRP_VERSION='${FrpVersion}'
  if [ -z "\$FRP_VERSION" ] || [ "\$FRP_VERSION" = "latest" ]; then
    FRP_VERSION=\$(curl -fsSL https://api.github.com/repos/fatedier/frp/releases/latest | sed -n 's/.*"tag_name":[[:space:]]*"v\([^"]*\)".*/\1/p' | head -n1)
  fi

  if [ -z "\$FRP_VERSION" ]; then
    echo '无法获取 FRP 版本号，请检查网络重试。'
    exit 1
  fi

  ARCHIVE="frp_\${FRP_VERSION}_linux_amd64.tar.gz"
  URL="https://github.com/fatedier/frp/releases/download/v\${FRP_VERSION}/\$ARCHIVE"
  cd /tmp
  wget -O "\$ARCHIVE" "\$URL"
  tar -xzf "\$ARCHIVE"
  install -d /opt/frp /etc/frp
  install -m 755 "/tmp/frp_\${FRP_VERSION}_linux_amd64/frps" /opt/frp/frps

  cat >/etc/systemd/system/frps.service <<'EOF'
[Unit]
Description=FRP Server
After=network.target

[Service]
Type=simple
ExecStart=/opt/frp/frps -c /etc/frp/frps.toml
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

  systemctl daemon-reload
  FRPS_INSTALLED='true'
fi

# 检测并自动安装 Caddy
CADDY_INSTALLED='false'
if command -v caddy >/dev/null 2>&1; then
  echo '检测到 Caddy 已存在，跳过安装。'
else
  install -m 0755 -d /etc/apt/keyrings
  rm -f /etc/apt/keyrings/caddy-stable-archive-keyring.gpg
  curl -fsSL https://dl.cloudsmith.io/public/caddy/stable/gpg.key | gpg --dearmor --batch --yes -o /etc/apt/keyrings/caddy-stable-archive-keyring.gpg
  chmod a+r /etc/apt/keyrings/caddy-stable-archive-keyring.gpg
  echo 'deb [signed-by=/etc/apt/keyrings/caddy-stable-archive-keyring.gpg] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main' >/etc/apt/sources.list.d/caddy-stable.list

  apt-get update
  apt-get install -y caddy
  CADDY_INSTALLED='true'
fi

# 核心步骤：向 Caddy 植入 Cloudflare 自动证书功能组件
if caddy list-modules | grep -q 'dns.providers.cloudflare'; then
  echo '检测到 Caddy 已安装 Cloudflare DNS 插件。'
else
  echo '正在安装 Caddy Cloudflare DNS 插件...'
  caddy add-package github.com/caddy-dns/cloudflare || echo '安装 Caddy 插件失败。'
  systemctl restart caddy || true
fi

systemctl enable frps >/dev/null 2>&1 || true
systemctl enable caddy >/dev/null 2>&1 || true

# 配置防火墙墙规则，直接接通端口
ufw allow ${SshPort}/tcp
ufw allow ${FrpsBindPort}/tcp
ufw allow 80/tcp
ufw allow 443/tcp
"@

if ($AllowDashboardInUfw) {
    $remoteScript += "`nufw allow ${DashboardPort}/tcp"
}

$remoteScript += @"
ufw --force enable

echo '=== BASE DEPLOY DONE ==='
echo 'FRP binary:'
/opt/frp/frps --version || true
echo 'caddy:'
caddy version || true
echo 'frps service enabled:'
systemctl is-enabled frps || true
echo 'caddy service enabled:'
systemctl is-enabled caddy || true
"@

$tmpScript = Join-Path $env:TEMP "deploy_frps_caddy_remote.sh"
# 剥除 BOM 操作，确保 Windows 下安全执行
$remoteScript = $remoteScript -replace [char]0xFEFF, "" -replace "`r`n", "`n" -replace "`r", ""
$utf8NoBom = [System.Text.UTF8Encoding]::new($false)
[IO.File]::WriteAllText($tmpScript, $remoteScript, $utf8NoBom)

Ensure-SshKeyAuth

Write-Host "开始基础部署到 $ServerIp ..." -ForegroundColor Cyan
(Get-Content $tmpScript -Raw) -replace [char]0xFEFF, "" -replace "`r`n", "`n" | & $ssh @sshOptions -p $SshPort -i $SshPrivateKeyPath -o BatchMode=yes "$SshUser@$ServerIp" "bash -s"
Write-Host "基础部署完成！第一步结束。" -ForegroundColor Green

# 强制管道输出使用无 BOM 的 UTF-8
$OutputEncoding = [System.Text.UTF8Encoding]::new($false)

# ========================= 必填参数（按需修改） =========================
$ServerIp = "[填写你的VPS公网IP]"
$SshUser = "root"
$SshPort = 22
$AcceptNewHostKey = $true
$SshPrivateKeyPath = Join-Path $env:USERPROFILE ".ssh\id_ed25519"

# 自动从所在的目录抓取配置文件
$LocalFrpsConfig = Join-Path $PSScriptRoot "frps.toml"
$LocalCaddyConfig = Join-Path $PSScriptRoot "Caddyfile"
$RemoteFrpsConfig = "/etc/frp/frps.toml"
$RemoteCaddyConfig = "/etc/caddy/Caddyfile"

$ErrorActionPreference = "Stop"

function Get-OpenSshTool([string]$Name) {
    $cmd = Get-Command $Name -ErrorAction SilentlyContinue
    if ($cmd) { return $cmd.Source }
  throw "未找到 $Name。请先启用 Windows OpenSSH Client。"
}

if (-not (Test-Path $LocalFrpsConfig)) { throw "未找到本地文件: $LocalFrpsConfig" }
if (-not (Test-Path $LocalCaddyConfig)) { throw "未找到本地文件: $LocalCaddyConfig" }
if (-not (Test-Path $SshPrivateKeyPath)) { throw "未找到 SSH 私钥文件。请确认先成功执行了基础部署脚本。" }

$ssh = Get-OpenSshTool "ssh.exe"
$scp = Get-OpenSshTool "scp.exe"
$sshOptions = @()
if ($AcceptNewHostKey) {
  $sshOptions += @("-o", "StrictHostKeyChecking=accept-new")
}

Write-Host "上传配置文件到远端临时目录..." -ForegroundColor Cyan
& $scp @sshOptions -i $SshPrivateKeyPath -o BatchMode=yes -P $SshPort $LocalFrpsConfig "${SshUser}@${ServerIp}:/tmp/frps.toml.new"
& $scp @sshOptions -i $SshPrivateKeyPath -o BatchMode=yes -P $SshPort $LocalCaddyConfig "${SshUser}@${ServerIp}:/tmp/Caddyfile.new"

$remoteScript = @"
set -euo pipefail
# 检查上传是否已抵达
if [ ! -f /tmp/frps.toml.new ]; then
  exit 1
fi
if [ ! -f /tmp/Caddyfile.new ]; then
  exit 1
fi

# 检查 Caddy 规则是否符合语法
caddy validate --config /tmp/Caddyfile.new

TS=\$(date +%Y%m%d%H%M%S)
cp -a ${RemoteFrpsConfig} ${RemoteFrpsConfig}.bak.\$TS || true
cp -a ${RemoteCaddyConfig} ${RemoteCaddyConfig}.bak.\$TS || true

install -m 600 /tmp/frps.toml.new ${RemoteFrpsConfig}
install -m 644 /tmp/Caddyfile.new ${RemoteCaddyConfig}

systemctl daemon-reload
systemctl enable --now frps
systemctl enable --now caddy
systemctl restart frps
systemctl restart caddy

echo '服务健康度检查:'
systemctl is-active frps
systemctl is-active caddy
"@

$tmpScript = Join-Path $env:TEMP "apply_server_configs.sh"
$remoteScript = $remoteScript -replace [char]0xFEFF, "" -replace "`r`n", "`n" -replace "`r", ""
$utf8NoBom = [System.Text.UTF8Encoding]::new($false)
[IO.File]::WriteAllText($tmpScript, $remoteScript, $utf8NoBom)

Write-Host "应用远端配置并重启服务..." -ForegroundColor Cyan
(Get-Content $tmpScript -Raw) -replace [char]0xFEFF, "" -replace "`r`n", "`n" | & $ssh @sshOptions -p $SshPort -i $SshPrivateKeyPath -o BatchMode=yes "$SshUser@$ServerIp" "bash -s"
Write-Host "更新完成。服务端堡垒已经搭设完毕！" -ForegroundColor Green