---

#!/bin/bash
export LC_ALL=C
set -u
s(){ echo; echo "===== $1 ====="; }
DOMAIN=mainnet.assaxaq.online
CONF=/usr/local/etc/xray-cf/config.json

s "BACKUP + REMOVE xray-cf (only this instance)"
if [ -d /opt/xray-cf ]; then
  tar czf /root/xray-cf-backup-$(date +%s).tgz -C /opt xray-cf && echo "backup ok"
  rm -rf /opt/xray-cf && echo "removed /opt/xray-cf"
fi
docker rm -f xray-cf 2>/dev/null && echo "removed container xray-cf" || echo "container xray-cf not found"

s "FREE PORT CHECK"
ss -tlnp | grep -E ':(80|443) ' || echo "80 and 443 free"

s "CERTIFICATE"
if [ ! -f /etc/letsencrypt/live/$DOMAIN/fullchain.pem ]; then
  certbot certonly --standalone --non-interactive --agree-tos \
    --register-unsafely-without-email -d $DOMAIN \
    --deploy-hook "systemctl restart xray-cf" || { echo "CERTBOT FAILED"; exit 1; }
fi
ls /etc/letsencrypt/live/$DOMAIN/

s "GENERATE CREDENTIALS"
UUID=$(/usr/local/bin/xray uuid)
WSPATH=$(openssl rand -hex 8)
echo "uuid=$UUID"
echo "path=/$WSPATH"

s "WRITE CONFIG"
mkdir -p /usr/local/etc/xray-cf
cat > $CONF <<EOF
{
  "log": { "loglevel": "warning" },
  "inbounds": [
    {
      "tag": "cf-ws",
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [ { "id": "$UUID" } ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "ws",
        "security": "tls",
        "tlsSettings": {
          "alpn": ["http/1.1"],
          "certificates": [
            {
              "certificateFile": "/etc/letsencrypt/live/$DOMAIN/fullchain.pem",
              "keyFile": "/etc/letsencrypt/live/$DOMAIN/privkey.pem"
            }
          ]
        },
        "wsSettings": { "path": "/$WSPATH" }
      },
      "sniffing": { "enabled": true, "destOverride": ["http", "tls"] }
    }
  ],
  "outbounds": [
    { "tag": "direct", "protocol": "freedom" }
  ]
}
EOF
/usr/local/bin/xray run -test -config $CONF

s "SYSTEMD UNIT"
cat > /etc/systemd/system/xray-cf.service <<EOF
[Unit]
Description=Xray VLESS-WS behind Cloudflare
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=/usr/local/bin/xray run -config $CONF
Restart=on-failure
RestartSec=5
MemoryMax=150M

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now xray-cf
sleep 2
systemctl is-active xray-cf

s "LISTEN CHECK"
ss -tlnp | grep ':443 '

s "LOCAL TLS TEST"
curl -skI -m5 --resolve $DOMAIN:443:127.0.0.1 https://$DOMAIN/$WSPATH 2>&1 | head -3

s "CLOUDFLARE TEST"
curl -skI -m8 https://$DOMAIN/$WSPATH 2>&1 | head -3

s "VLESS LINK (for phone)"
echo "vless://$UUID@$DOMAIN:443?encryption=none&security=tls&sni=$DOMAIN&alpn=http%2F1.1&type=ws&host=$DOMAIN&path=%2F$WSPATH#cf-ws-nl"

s "MEMORY"
free -m | head -2