# -*- coding: utf-8 -*-
"""
在远程服务器 159.75.81.121 上为 risk.aiformat.cn 自动化配置 SSL / HTTPS
"""
import paramiko
import time

SERVER_IP = "159.75.81.121"
SSH_PORT = 22
SSH_USER = "root"
SSH_PASS = "sp-cc123"
DOMAIN = "risk.aiformat.cn"

def run_remote_cmd(ssh, cmd):
    print(f"\n🚀 [远程命令] {cmd}")
    stdin, stdout, stderr = ssh.exec_command(cmd)
    out = stdout.read().decode('utf-8', errors='ignore')
    err = stderr.read().decode('utf-8', errors='ignore')
    if out:
        print(f"[STDOUT]\n{out.strip()}")
    if err:
        print(f"[STDERR]\n{err.strip()}")
    return out, err

def setup_https():
    print(f"🔌 正在连接服务器 {SERVER_IP}...")
    ssh = paramiko.SSHClient()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    try:
        ssh.connect(SERVER_IP, port=SSH_PORT, username=SSH_USER, password=SSH_PASS, timeout=15)
        print("✅ SSH 连接成功！")
    except Exception as e:
        print(f"❌ SSH 连接失败: {e}")
        return

    # 1. 安装 certbot 与 python3-certbot-nginx
    install_certbot_cmd = """
    if command -v apt-get &> /dev/null; then
        apt-get update -y && apt-get install -y certbot python3-certbot-nginx
    elif command -v yum &> /dev/null; then
        yum install -y certbot python3-certbot-nginx
    fi
    """
    run_remote_cmd(ssh, install_certbot_cmd)

    # 2. 尝试使用 Certbot 自动申请 Let's Encrypt 证书并配置 Nginx
    certbot_cmd = f"certbot --nginx -d {DOMAIN} --non-interactive --agree-tos -m admin@aiformat.cn --redirect"
    out, err = run_remote_cmd(ssh, certbot_cmd)

    # 检查签发是否成功
    if "Congratulations" in out or "Successfully received certificate" in out or "Certificate" in out:
        print("🎉 Let's Encrypt SSL 证书签发并自动配置成功！")
    else:
        print("⚠️ Certbot 签发 Let's Encrypt 证书受阻，正在创建自签名 SSL 证书作为安全保障方案...")
        
        # 创建自签名证书放置在 /etc/ssl/risk.aiformat.cn/
        create_self_signed = f"""
        mkdir -p /etc/ssl/{DOMAIN}
        openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
            -keyout /etc/ssl/{DOMAIN}/server.key \
            -out /etc/ssl/{DOMAIN}/server.crt \
            -subj "/C=CN/ST=Fujian/L=Xiamen/O=RiskSystem/CN={DOMAIN}"
        """
        run_remote_cmd(ssh, create_self_signed)

        # 写入兼容 SSL 的 Nginx 配置
        nginx_ssl_conf = f"""server {{
    listen 80;
    server_name {DOMAIN};
    return 301 https://$host$request_uri;
}}

server {{
    listen 443 ssl http2;
    server_name {DOMAIN};

    ssl_certificate /etc/ssl/{DOMAIN}/server.crt;
    ssl_certificate_key /etc/ssl/{DOMAIN}/server.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {{
        proxy_pass http://127.0.0.1:8501;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400;
    }}

    location /_stcore/stream {{
        proxy_pass http://127.0.0.1:8501/_stcore/stream;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }}
}}
"""
        create_nginx_cmd = f"cat << 'EOF' > /etc/nginx/conf.d/risk.aiformat.cn.conf\n{nginx_ssl_conf}\nEOF"
        run_remote_cmd(ssh, create_nginx_cmd)

    # 3. 检查 Nginx 语法并重载
    run_remote_cmd(ssh, "nginx -t && systemctl reload nginx")
    time.sleep(2)

    # 4. 验证 HTTPS 连通性
    run_remote_cmd(ssh, f"curl -k -I https://127.0.0.1/ -H 'Host: {DOMAIN}'")

    ssh.close()
    print("\n✅ HTTPS 配置流程完成！")
    print(f"🔒 安全访问链接: https://{DOMAIN}")

if __name__ == "__main__":
    setup_https()