#!/bin/bash
# ============================================================
# 新主服 82.41.66.212 一键解锁（VNC/网页控制台里粘贴执行）
# 作用：放行 SSH、装好 rsync、打印宝塔入口与密码
# ============================================================
set -e
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

echo "===== 1) 放行端口 ====="
# ufw
if command -v ufw >/dev/null 2>&1; then
  ufw allow 36458/tcp || true
  ufw allow 22/tcp || true
  ufw allow 35026/tcp || true
  ufw allow 8888/tcp || true
  ufw allow 80/tcp || true
  ufw allow 443/tcp || true
  ufw allow 8080/tcp || true
  ufw allow 7681/tcp || true
  ufw --force enable || true
  ufw status || true
fi
# firewalld
if command -v firewall-cmd >/dev/null 2>&1; then
  firewall-cmd --permanent --add-port=36458/tcp || true
  firewall-cmd --permanent --add-port=22/tcp || true
  firewall-cmd --permanent --add-port=35026/tcp || true
  firewall-cmd --permanent --add-port=80/tcp || true
  firewall-cmd --permanent --add-port=443/tcp || true
  firewall-cmd --permanent --add-port=8080/tcp || true
  firewall-cmd --reload || true
fi
# iptables 兜底
iptables -I INPUT -p tcp --dport 36458 -j ACCEPT 2>/dev/null || true
iptables -I INPUT -p tcp --dport 22 -j ACCEPT 2>/dev/null || true
iptables -I INPUT -p tcp --dport 35026 -j ACCEPT 2>/dev/null || true
iptables -I INPUT -p tcp --dport 80 -j ACCEPT 2>/dev/null || true
iptables -I INPUT -p tcp --dport 443 -j ACCEPT 2>/dev/null || true
iptables -I INPUT -p tcp --dport 8080 -j ACCEPT 2>/dev/null || true

# 确保 sshd 在 36458 听
systemctl enable --now ssh 2>/dev/null || systemctl enable --now sshd 2>/dev/null || true
ss -lntp | grep -E '36458|22|:35026' || true

echo "===== 2) 工具 ====="
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq || true
apt-get install -y -qq rsync curl wget 2>/dev/null || true

echo "===== 3) 宝塔信息 ====="
if [ -f /etc/init.d/bt ]; then
  /etc/init.d/bt default 2>/dev/null || bt default 2>/dev/null || true
  echo "--- admin_path ---"
  cat /www/server/panel/data/admin_path.pl 2>/dev/null || true
  echo
  echo "--- default user/pass ---"
  bt default 2>/dev/null || true
else
  echo "宝塔未装完，继续安装日志:"
  tail -30 /root/bt_install.log 2>/dev/null || true
fi

echo "===== 4) 网络自检 ====="
hostname
ip -4 addr | grep inet
echo "DONE. 把上面「面板地址/用户名/密码」发回给 Grok，或直接说：已放通"