#!/usr/bin/env bash
# 给博客 vhost 加 /gitea/ 同源反代 → 127.0.0.1:13020（Sveltia 后台用）
# 目的：绕开 git.wait4x.online 的 ESA 522、消 CORS；幂等 + -t 门禁 + 回滚
set -euo pipefail
DEFAULT=/etc/nginx/sites-enabled/default
BAK=/tmp/add-gitea-proxy-bak-$(date +%s)
BLOCK='    location /gitea/ {
        proxy_pass http://127.0.0.1:13020/;
        proxy_set_header Host git.wait4x.online;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Real-IP $remote_addr;
        add_header Cache-Control "no-store" always;
        add_header X-Robots-Tag noindex always;
    }'

echo "==== ① 现状 ===="
grep -q "location /gitea/" "$DEFAULT" && echo "（已存在 /gitea/ 反代，将重写）" || echo "（未配置 /gitea/ 反代）"

echo
echo "==== ② 计划 ===="
echo "  在博客 server 块（server_name wait4x.online;）内插入 /gitea/ 反代 → 127.0.0.1:13020"

echo
read -rp ">> 执行？(y/N) " ok; [ "$ok" = "y" ] || { echo "已取消"; exit 0; }

cp "$DEFAULT" "$BAK"
python3 - "$DEFAULT" <<'PY'
import re, sys
path = sys.argv[1]
src = open(path, encoding='utf-8').read()
block = '''    location /gitea/ {
        proxy_pass http://127.0.0.1:13020/;
        proxy_set_header Host git.wait4x.online;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Real-IP $remote_addr;
        add_header Cache-Control "no-store" always;
        add_header X-Robots-Tag noindex always;
    }
'''
src = re.sub(r'[ \t]*location /gitea/ \{[^}]*\}\n', '', src)   # 幂等：先删旧块
if 'server_name wait4x.online;' not in src:
    sys.exit('未找到博客 server_name，中止')
src = src.replace('server_name wait4x.online;', 'server_name wait4x.online;\n' + block, 1)
open(path, 'w', encoding='utf-8').write(src)
print('已插入 /gitea/ 反代')
PY

echo
echo "==== ③ 门禁 ===="
if ! nginx -t; then echo "!! 语法失败，回滚"; cp "$BAK" "$DEFAULT"; nginx -t && systemctl reload nginx; exit 1; fi
systemctl reload nginx && echo "  nginx 已重载"

echo
echo "==== ④ 终验 ===="
echo -n "  本地反代: "; curl -s -o /dev/null -w '%{http_code}\n' --noproxy '*' -m 6 -H "Host: wait4x.online" http://127.0.0.1/gitea/api/v1/version 2>/dev/null || echo "(80 未监听属正常，走 443)"
echo -n "  公网反代: "; curl -s --compressed --noproxy '*' -m 10 -o /dev/null -w '%{http_code}\n' https://wait4x.online/gitea/api/v1/version
echo -n "  版本响应: "; curl -s --compressed --noproxy '*' -m 10 https://wait4x.online/gitea/api/v1/version
rm -f "$BAK"
echo
echo "  公网反代 200 即成功。随后打开 https://wait4x.online/admin/ 用 gitea 令牌登录。"