#!/bin/bash
set -e

# 获取脚本所在目录（无论是否使用 sudo，文件都生成在执行脚本的目录下）
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

# 检查 sudo 权限并设置 sudo 命令前缀
check_sudo() {
    if [ "$EUID" -eq 0 ]; then
        # 已经是 root 用户，不需要 sudo
        SUDO_CMD=""
    else
        # 检查是否有 sudo 权限
        if ! command -v sudo &> /dev/null; then
            echo -e "\033[0;31m错误: 当前用户不是 root，且未安装 sudo\033[0m"
            echo "请以 root 用户运行，或安装并配置 sudo"
            exit 1
        fi
        
        # 检查 sudo 是否免密或者可以正常使用
        if ! sudo -n true 2>/dev/null; then
            echo -e "\033[1;33m需要 sudo 权限来执行安装操作\033[0m"
            echo "请确保当前用户有 sudo 权限，或者使用: sudo $0"
            # 尝试获取 sudo 权限
            sudo -v || {
                echo -e "\033[0;31m错误: 无法获取 sudo 权限\033[0m"
                exit 1
            }
        fi
        SUDO_CMD="sudo"
    fi
}

# 初始化 sudo 检查
check_sudo

# 切换到脚本所在目录（确保文件生成在执行脚本的目录下）
cd "$SCRIPT_DIR"
echo -e "${BLUE}工作目录: $SCRIPT_DIR${NC}"

# 获取 docker-compose 的完整路径（解决 sudo 下找不到命令的问题）
DOCKER_COMPOSE_BIN=$(command -v docker-compose 2>/dev/null || echo "/usr/bin/docker-compose")

# 获取本机IP地址（优先获取能够连接外网的IP，排除docker和lo）
get_host_ip() {
    local ip=""
    # 方法1: 通过默认路由获取
    ip=$($SUDO_CMD ip route get 1.1.1.1 2>/dev/null | grep -oP 'src \K[0-9.]+' | head -1)
    
    # 方法2: 如果方法1失败，尝试获取所有非lo非docker的IP
    if [ -z "$ip" ]; then
        ip=$($SUDO_CMD ip -4 addr show | grep -oP '(?<=inet\s)[0-9]+(\.[0-9]+){3}' | grep -v '127.0.0.1' | grep -vE '^(172\.|10\.|192\.168\.)' | head -1)
    fi
    
    # 方法3: 如果还是失败，尝试获取任意非lo的IP
    if [ -z "$ip" ]; then
        ip=$($SUDO_CMD ip -4 addr show | grep -oP '(?<=inet\s)[0-9]+(\.[0-9]+){3}' | grep -v '127.0.0.1' | head -1)
    fi
    
    # 方法4: 使用hostname命令
    if [ -z "$ip" ]; then
        ip=$(hostname -I 2>/dev/null | awk '{print $1}')
    fi
    
    echo "$ip"
}

# 设置主机IP
HOST_IP=$(get_host_ip)

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# =============================================================================
#  [1/13] 检查并关闭防火墙
# =============================================================================
echo -e "${BLUE}==========================================${NC}"
echo -e "${BLUE}  检查防火墙状态${NC}"
echo -e "${BLUE}==========================================${NC}"

disable_firewall() {
    local firewall_name=$1
    echo -e "${YELLOW}检测到 $firewall_name 正在运行，准备关闭...${NC}"
    $SUDO_CMD systemctl stop $firewall_name
    $SUDO_CMD systemctl disable $firewall_name
    echo -e "${GREEN}$firewall_name 已关闭并禁用开机自启${NC}"
}

# 检查并关闭 firewalld（RHEL/CentOS/Rocky 等）
if command -v firewall-cmd &> /dev/null; then
    if $SUDO_CMD systemctl is-active --quiet firewalld 2>/dev/null; then
        disable_firewall "firewalld"
        $SUDO_CMD systemctl stop firewalld
    else
        # 检查是否已禁用
        if $SUDO_CMD systemctl is-enabled --quiet firewalld 2>/dev/null; then
            echo -e "${YELLOW}firewalld 未运行，但已启用开机自启，准备禁用...${NC}"
            $SUDO_CMD systemctl disable firewalld
        fi
        echo -e "${GREEN}firewalld 状态正常（未运行）${NC}"
    fi
fi

# 检查并关闭 ufw（Ubuntu/Debian 等）
if command -v ufw &> /dev/null; then
    # 检查 ufw 防火墙规则是否启用
    if $SUDO_CMD ufw status | grep -q "Status: active"; then
        echo -e "${YELLOW}检测到 ufw 防火墙规则已启用，准备关闭...${NC}"
        $SUDO_CMD ufw disable
        echo -e "${GREEN}ufw 防火墙规则已关闭${NC}"
    else
        echo -e "${GREEN}ufw 防火墙规则未启用${NC}"
    fi
    
    # 检查 ufw 服务是否正在运行或已设置开机自启
    ufw_service_active=false
    ufw_service_enabled=false
    
    if $SUDO_CMD systemctl is-active --quiet ufw 2>/dev/null; then
        ufw_service_active=true
    fi
    if $SUDO_CMD systemctl is-enabled --quiet ufw 2>/dev/null; then
        ufw_service_enabled=true
    fi
    
    if [ "$ufw_service_active" = "true" ] || [ "$ufw_service_enabled" = "true" ]; then
        if [ "$ufw_service_active" = "true" ]; then
            echo -e "${YELLOW}检测到 ufw 服务正在运行，准备停止...${NC}"
            $SUDO_CMD systemctl stop ufw
        fi
        if [ "$ufw_service_enabled" = "true" ]; then
            echo -e "${YELLOW}检测到 ufw 服务已启用开机自启，准备禁用...${NC}"
            $SUDO_CMD systemctl disable ufw
        fi
        echo -e "${GREEN}ufw 服务已停止并禁用开机自启${NC}"
    else
        echo -e "${GREEN}ufw 服务状态正常（未运行且已禁用开机自启）${NC}"
    fi
fi

# 检查并关闭 iptables-services（某些系统使用）
if $SUDO_CMD systemctl is-active --quiet iptables 2>/dev/null; then
    disable_firewall "iptables"
fi

if $SUDO_CMD systemctl is-active --quiet ip6tables 2>/dev/null; then
    disable_firewall "ip6tables"
fi

# 检查并配置 SELinux（允许 Nginx 进行网络连接）
echo -e "${BLUE}检查 SELinux 配置...${NC}"
if command -v getenforce &> /dev/null; then
    SELINUX_STATUS=$($SUDO_CMD getenforce 2>/dev/null || echo "Disabled")
    if [ "$SELINUX_STATUS" = "Enforcing" ] || [ "$SELINUX_STATUS" = "Permissive" ]; then
        echo -e "${YELLOW}检测到 SELinux 处于 $SELINUX_STATUS 模式，配置 Nginx 网络连接权限...${NC}"
        $SUDO_CMD setsebool -P httpd_can_network_connect 1 2>/dev/null || true
        echo -e "${GREEN}SELinux 配置完成（允许 Nginx 网络连接）${NC}"
    else
        echo -e "${GREEN}SELinux 已禁用，无需配置${NC}"
    fi
else
    echo -e "${GREEN}系统未安装 SELinux，跳过配置${NC}"
fi

# =============================================================================
#  [2/13] 检查并安装 Docker 和 Docker Compose
# =============================================================================
echo -e "${BLUE}==========================================${NC}"
echo -e "${BLUE}  检查 Docker 环境${NC}"
echo -e "${BLUE}==========================================${NC}"

# 确保 wget 已安装（如果没有则自动安装）
ensure_wget() {
    if command -v wget &> /dev/null; then
        return 0
    fi
    
    if command -v curl &> /dev/null; then
        return 0
    fi
    
    echo -e "${YELLOW}未找到 wget 或 curl，正在安装 wget...${NC}"
    # 检测系统类型并安装 wget
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        OS=$ID
    fi
    case $OS in
        ubuntu|debian)
            $SUDO_CMD apt-get update && $SUDO_CMD apt-get install -y wget
            ;;
        centos|rhel|fedora|rocky|almalinux|anolis|kylin)
            $SUDO_CMD yum install -y wget
            ;;
        openEuler)
            $SUDO_CMD dnf install -y wget
            ;;
        *)
            echo -e "${RED}不支持的操作系统: $OS，请手动安装 wget 后重试${NC}"
            exit 1
            ;;
    esac
}

# 下载文件的通用函数（优先使用 wget，备选 curl）
download_file() {
    local url=$1
    local output=$2
    
    # 确保 wget 或 curl 可用
    ensure_wget
    
    if command -v wget &> /dev/null; then
        $SUDO_CMD wget "$url" -O "$output"
    else
        $SUDO_CMD curl -fsSL "$url" -o "$output"
    fi
}

# 带重试的 curl 下载函数
curl_with_retry() {
    local url=$1
    local output=$2
    local max_retries=${3:-3}
    local retry=0
    
    while [ $retry -lt $max_retries ]; do
        if curl -fsSL --connect-timeout 15 --max-time 60 "$url" -o "$output" 2>/dev/null; then
            return 0
        fi
        retry=$((retry + 1))
        if [ $retry -lt $max_retries ]; then
            echo "下载失败，${retry}秒后重试..."
            sleep $retry
        fi
    done
    return 1
}
# 检查 Docker 是否已安装
install_docker() {
    echo -e "${YELLOW}Docker 未安装，开始安装...${NC}"
    
    # 清除 shell 命令哈希缓存，确保能检测到新的 docker 命令
    hash -r
    
    # 检测系统类型
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        OS=$ID
        VER=$VERSION_ID
    else
        echo -e "${RED}无法检测操作系统类型${NC}"
        exit 1
    fi
    
    case $OS in
        ubuntu|debian)
            echo "检测到 Debian/Ubuntu 系统，使用国内镜像安装..."
            # 卸载旧版本
            $SUDO_CMD apt-get remove -y docker docker-engine docker.io containerd runc 2>/dev/null || true
            
            # 更新 apt 索引
            $SUDO_CMD apt-get update
            
            # 安装必要依赖
            $SUDO_CMD apt-get install -y ca-certificates curl gnupg lsb-release apt-transport-https software-properties-common
            
            # 创建 keyrings 目录
            $SUDO_CMD install -m 0755 -d /etc/apt/keyrings
            
            # 添加 Docker GPG 密钥（使用国内镜像）
            echo "添加 Docker GPG 密钥..."
            if ! curl_with_retry "https://mirrors.aliyun.com/docker-ce/linux/$OS/gpg" "/tmp/docker.gpg" 3; then
                echo -e "${YELLOW}阿里云镜像失败，尝试其他源...${NC}"
                if ! curl_with_retry "https://get.docker.com/gpg" "/tmp/docker.gpg" 3; then
                    echo -e "${YELLOW}尝试使用备用方法安装 GPG 密钥...${NC}"
                    # 使用 apt-key 作为备用
                    curl -fsSL https://get.docker.com/gpg | $SUDO_CMD apt-key add - 2>/dev/null || \
                    $SUDO_CMD apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 9DC858229FC7DD38854AE2D88D81803C0EBFCD88 2>/dev/null || true
                fi
            fi
            
            if [ -f "/tmp/docker.gpg" ]; then
                $SUDO_CMD gpg --dearmor < /tmp/docker.gpg | $SUDO_CMD tee /etc/apt/keyrings/docker.gpg > /dev/null
                $SUDO_CMD chmod a+r /etc/apt/keyrings/docker.gpg
            fi
            
            # 添加 Docker 软件源（使用阿里云镜像）
            echo "添加 Docker 软件源..."
            CODENAME=$(lsb_release -cs)
            echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://mirrors.aliyun.com/docker-ce/linux/$OS $CODENAME stable" | $SUDO_CMD tee /etc/apt/sources.list.d/docker.list > /dev/null
            
            # 更新 apt 索引
            $SUDO_CMD apt-get update
            
            # 安装 Docker
            $SUDO_CMD apt-get install -y docker-ce docker-ce-cli containerd.io
            
            # 启动 Docker 服务
            $SUDO_CMD systemctl start docker
            $SUDO_CMD systemctl enable docker
            
            # 将当前用户添加到 docker 组（如果非 root 用户）
            if [ "$SUDO_CMD" = "sudo" ]; then
                $SUDO_CMD usermod -aG docker $USER
                echo -e "${YELLOW}已将当前用户添加到 docker 组，请重新登录或执行 'newgrp docker' 使权限生效${NC}"
            fi
            ;;
            
        centos|rhel|fedora|rocky|almalinux|anolis|kylin)
            echo "检测到 RHEL/CentOS/Kylin 系统，使用国内镜像安装..."
            
            # 卸载旧版本（包括 Podman 相关包）
            echo "卸载旧版本 Docker 和 Podman..."
            $SUDO_CMD yum remove -y docker docker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate docker-engine 2>/dev/null || true
            
            # 卸载 Podman 相关包（Anolis OS 预装，包括 runc 因为它与 containerd.io 冲突）
            echo "卸载 Podman 相关包..."
            if command -v dnf &> /dev/null; then
                $SUDO_CMD dnf remove -y --allowerasing podman-docker podman podman-gvproxy podman-plugins podman-catatonit buildah skopeo containers-common runc 2>/dev/null || true
            else
                $SUDO_CMD yum remove -y podman-docker podman podman-gvproxy podman-plugins podman-catatonit buildah skopeo containers-common runc 2>/dev/null || true
            fi
            
            # 清理残留文件
            $SUDO_CMD rm -f /usr/bin/docker /usr/bin/docker-compose /etc/containers/nodocker 2>/dev/null || true
            
            # 清理 dnf/yum 缓存（解决"The downloaded packages were saved in cache"错误）
            echo "清理 dnf/yum 缓存..."
            $SUDO_CMD dnf clean packages 2>/dev/null || true
            $SUDO_CMD dnf clean all 2>/dev/null || true
            $SUDO_CMD yum clean all 2>/dev/null || true
            
            # 安装必要依赖
            # Kylin Linux 10 使用 dnf，yum-utils 已被 dnf-utils 替代
            if $SUDO_CMD yum install -y yum-utils device-mapper-persistent-data lvm2 2>/dev/null; then
                echo -e "${GREEN}yum-utils 安装成功${NC}"
            else
                echo -e "${YELLOW}yum-utils 安装失败，尝试安装 dnf-utils（Kylin Linux 10 替代方案）...${NC}"
                $SUDO_CMD yum install -y dnf-utils device-mapper-persistent-data lvm2 2>/dev/null || \
                $SUDO_CMD dnf install -y dnf-utils device-mapper-persistent-data lvm2 2>/dev/null || true
            fi
            
            # 添加 Docker 软件源（优先使用阿里云镜像）
            # Kylin Linux V10 的 $releasever 是 'V10'，但 Docker 仓库需要数字版本号 '10'
            # Anolis OS 的 VERSION_ID 是 '8.10'，但 Docker 仓库需要 '8'
            DOCKER_CE_VERSION="$VERSION_ID"
            if [ "$ID" = "kylin" ] && [[ "$VERSION_ID" == V10* ]]; then
                # Kylin Linux V10 基于 CentOS/RHEL 8 (glibc 2.28)，不是 CentOS 10
                DOCKER_CE_VERSION="8"
                echo -e "${YELLOW}检测到 Kylin Linux V10，使用 Docker CE 版本号: $DOCKER_CE_VERSION${NC}"
            elif [ "$ID" = "anolis" ]; then
                # Anolis OS 8.x 使用 CentOS 8 的 Docker 仓库
                DOCKER_CE_VERSION="8"
                echo -e "${YELLOW}检测到 Anolis OS，使用 Docker CE 版本号: $DOCKER_CE_VERSION${NC}"
            fi
            echo "添加 Docker 软件源..."
            
            # 导入 Docker GPG 密钥
            echo "导入 Docker GPG 密钥..."
            $SUDO_CMD rpm --import https://mirrors.aliyun.com/docker-ce/linux/centos/gpg 2>/dev/null || \
            $SUDO_CMD rpm --import https://download.docker.com/linux/centos/gpg 2>/dev/null || \
            echo -e "${YELLOW}GPG 密钥导入失败，将尝试禁用 GPG 检查继续安装${NC}"
            # 尝试使用 config-manager 添加仓库（适用于有 yum-utils/dnf-utils 的情况）
            if command -v yum-config-manager &> /dev/null; then
                if ! $SUDO_CMD yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo 2>/dev/null; then
                    echo -e "${YELLOW}尝试使用官方源...${NC}"
                    $SUDO_CMD yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo 2>/dev/null || true
                fi
                # 修改 repo 文件中的版本号（Kylin Linux 需要）
                if [ "$ID" = "kylin" ] && [ -f /etc/yum.repos.d/docker-ce.repo ]; then
                    echo -e "${YELLOW}修改 docker-ce.repo 中的版本号...${NC}"
                    $SUDO_CMD sed -i "s/\$releasever/$DOCKER_CE_VERSION/g" /etc/yum.repos.d/docker-ce.repo
                fi
            elif command -v dnf config-manager &> /dev/null; then
                # Kylin Linux 10 / CentOS 8+ 使用 dnf config-manager
                if ! $SUDO_CMD dnf config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo 2>/dev/null; then
                    echo -e "${YELLOW}尝试使用官方源...${NC}"
                    $SUDO_CMD dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo 2>/dev/null || true
                fi
                # 修改 repo 文件中的版本号（Kylin Linux 需要）
                if [ "$ID" = "kylin" ] && [ -f /etc/yum.repos.d/docker-ce.repo ]; then
                    echo -e "${YELLOW}修改 docker-ce.repo 中的版本号...${NC}"
                    $SUDO_CMD sed -i "s/\$releasever/$DOCKER_CE_VERSION/g" /etc/yum.repos.d/docker-ce.repo
                fi
            else
                # 如果没有 config-manager，直接写入 repo 文件
                echo -e "${YELLOW}未找到 config-manager，直接写入 repo 文件...${NC}"
                $SUDO_CMD tee /etc/yum.repos.d/docker-ce.repo > /dev/null << DOCKER_REPO_EOF
[docker-ce-stable]
name=Docker CE Stable - \$basearch
baseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/${DOCKER_CE_VERSION}/x86_64/stable
enabled=1
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg
DOCKER_REPO_EOF
            fi
            
            # 安装 Docker（使用 --allowerasing 允许替换冲突的 Podman 包）
            echo -e "${YELLOW}正在安装 Docker...${NC}"
            DOCKER_INSTALL_SUCCESS=false
            
            # 优先尝试 dnf（支持 --allowerasing）
            if command -v dnf &> /dev/null; then
                echo "使用 dnf 安装 Docker..."
                if $SUDO_CMD dnf install -y --allowerasing docker-ce docker-ce-cli containerd.io 2>&1; then
                    DOCKER_INSTALL_SUCCESS=true
                fi
            else
                echo "使用 yum 安装 Docker..."
                # yum 不支持 --allowerasing，先手动卸载冲突包
                echo "确保 Podman 已完全卸载..."
                $SUDO_CMD yum remove -y podman-docker podman runc containers-common 2>/dev/null || true
                if $SUDO_CMD yum install -y docker-ce docker-ce-cli containerd.io; then
                    DOCKER_INSTALL_SUCCESS=true
                fi
            fi
            
            # 如果安装失败且可能是 GPG 密钥问题，尝试禁用 GPG 检查
            if [ "$DOCKER_INSTALL_SUCCESS" != "true" ]; then
                echo -e "${YELLOW}首次安装失败，可能是 GPG 密钥问题，尝试禁用 GPG 检查...${NC}"
                $SUDO_CMD sed -i 's/gpgcheck=1/gpgcheck=0/' /etc/yum.repos.d/docker-ce.repo
                
                if command -v dnf &> /dev/null; then
                    if $SUDO_CMD dnf install -y --allowerasing docker-ce docker-ce-cli containerd.io; then
                        DOCKER_INSTALL_SUCCESS=true
                    fi
                else
                    if $SUDO_CMD yum install -y docker-ce docker-ce-cli containerd.io; then
                        DOCKER_INSTALL_SUCCESS=true
                    fi
                fi
            fi
            
            if [ "$DOCKER_INSTALL_SUCCESS" != "true" ]; then
                echo -e "${YELLOW}阿里云镜像安装失败，尝试使用清华镜像源...${NC}"
                # 切换到清华镜像源
                $SUDO_CMD tee /etc/yum.repos.d/docker-ce.repo > /dev/null << DOCKER_REPO_EOF
[docker-ce-stable]
name=Docker CE Stable - \$basearch
baseurl=https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/centos/${DOCKER_CE_VERSION}/\$basearch/stable
enabled=1
gpgcheck=1
gpgkey=https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/centos/gpg
DOCKER_REPO_EOF
                $SUDO_CMD dnf clean all 2>/dev/null || true
                
                # 重试安装
                echo "使用清华镜像源安装 Docker..."
                if command -v dnf &> /dev/null; then
                    if $SUDO_CMD dnf install -y --allowerasing docker-ce docker-ce-cli containerd.io; then
                        DOCKER_INSTALL_SUCCESS=true
                    fi
                else
                    if $SUDO_CMD yum install -y docker-ce docker-ce-cli containerd.io; then
                        DOCKER_INSTALL_SUCCESS=true
                    fi
                fi
            fi
            
            if [ "$DOCKER_INSTALL_SUCCESS" != "true" ]; then
                echo -e "${YELLOW}清华镜像安装失败，尝试使用官方源并跳过弱依赖...${NC}"
                # 切换到官方源并跳过弱依赖
                $SUDO_CMD tee /etc/yum.repos.d/docker-ce.repo > /dev/null << DOCKER_REPO_EOF
[docker-ce-stable]
name=Docker CE Stable - \$basearch
baseurl=https://download.docker.com/linux/centos/${DOCKER_CE_VERSION}/\$basearch/stable
enabled=1
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg
DOCKER_REPO_EOF
                
                # 清理缓存
                echo "清理 dnf/yum 缓存..."
                $SUDO_CMD dnf clean packages 2>/dev/null || true
                $SUDO_CMD dnf clean all 2>/dev/null || true
                $SUDO_CMD yum clean all 2>/dev/null || true
                
                # 重试安装，跳过破损包
                echo "使用官方源安装 Docker..."
                if command -v dnf &> /dev/null; then
                    if $SUDO_CMD dnf install -y --allowerasing --skip-broken --setopt=install_weak_deps=False docker-ce docker-ce-cli containerd.io; then
                        DOCKER_INSTALL_SUCCESS=true
                    fi
                else
                    if $SUDO_CMD yum install -y --skip-broken docker-ce docker-ce-cli containerd.io; then
                        DOCKER_INSTALL_SUCCESS=true
                    fi
                fi
            fi
            
            # 第四次尝试：使用手动下载安装方式（CentOS 8 已停止维护时的备用方案）
            if [ "$DOCKER_INSTALL_SUCCESS" != "true" ]; then
                echo -e "${YELLOW}仓库安装失败，尝试手动下载安装 Docker...${NC}"
                
                # 清理缓存
                echo "清理 dnf/yum 缓存..."
                $SUDO_CMD dnf clean all 2>/dev/null || true
                $SUDO_CMD yum clean all 2>/dev/null || true
                
                # 创建临时目录
                TEMP_DIR=$(mktemp -d)
                cd "$TEMP_DIR"
                
                # 尝试下载安装最新版本的 Docker CE
                echo "下载 Docker CE 包..."
                DOCKER_VERSION="27.3.1"
                ARCH=$(uname -m)
                
                # 下载 containerd.io
                echo "下载 containerd.io..."
                $SUDO_CMD curl -fsSL -o containerd.io.rpm "https://download.docker.com/linux/centos/${DOCKER_CE_VERSION}/${ARCH}/stable/Packages/containerd.io-1.6.32-3.1.el8.${ARCH}.rpm" 2>/dev/null || \
                $SUDO_CMD curl -fsSL -o containerd.io.rpm "https://mirrors.aliyun.com/docker-ce/linux/centos/${DOCKER_CE_VERSION}/${ARCH}/stable/Packages/containerd.io-1.6.32-3.1.el8.${ARCH}.rpm" 2>/dev/null || true
                
                # 下载 docker-ce
                echo "下载 docker-ce..."
                $SUDO_CMD curl -fsSL -o docker-ce.rpm "https://download.docker.com/linux/centos/${DOCKER_CE_VERSION}/${ARCH}/stable/Packages/docker-ce-${DOCKER_VERSION}-1.el8.${ARCH}.rpm" 2>/dev/null || \
                $SUDO_CMD curl -fsSL -o docker-ce.rpm "https://mirrors.aliyun.com/docker-ce/linux/centos/${DOCKER_CE_VERSION}/${ARCH}/stable/Packages/docker-ce-${DOCKER_VERSION}-1.el8.${ARCH}.rpm" 2>/dev/null || true
                
                # 下载 docker-ce-cli
                echo "下载 docker-ce-cli..."
                $SUDO_CMD curl -fsSL -o docker-ce-cli.rpm "https://download.docker.com/linux/centos/${DOCKER_CE_VERSION}/${ARCH}/stable/Packages/docker-ce-cli-${DOCKER_VERSION}-1.el8.${ARCH}.rpm" 2>/dev/null || \
                $SUDO_CMD curl -fsSL -o docker-ce-cli.rpm "https://mirrors.aliyun.com/docker-ce/linux/centos/${DOCKER_CE_VERSION}/${ARCH}/stable/Packages/docker-ce-cli-${DOCKER_VERSION}-1.el8.${ARCH}.rpm" 2>/dev/null || true
                
                # 下载 docker-buildx-plugin 和 docker-compose-plugin（可选）
                $SUDO_CMD curl -fsSL -o docker-buildx-plugin.rpm "https://download.docker.com/linux/centos/${DOCKER_CE_VERSION}/${ARCH}/stable/Packages/docker-buildx-plugin-0.17.1-1.el8.${ARCH}.rpm" 2>/dev/null || true
                $SUDO_CMD curl -fsSL -o docker-compose-plugin.rpm "https://download.docker.com/linux/centos/${DOCKER_CE_VERSION}/${ARCH}/stable/Packages/docker-compose-plugin-2.29.6-1.el8.${ARCH}.rpm" 2>/dev/null || true
                
                # 安装下载的 RPM 包
                echo "安装下载的 RPM 包..."
                if [ -f "containerd.io.rpm" ] && [ -f "docker-ce.rpm" ] && [ -f "docker-ce-cli.rpm" ]; then
                    if command -v dnf &> /dev/null; then
                        if $SUDO_CMD dnf install -y --allowerasing ./*.rpm; then
                            DOCKER_INSTALL_SUCCESS=true
                        fi
                    else
                        if $SUDO_CMD yum install -y ./*.rpm; then
                            DOCKER_INSTALL_SUCCESS=true
                        fi
                    fi
                else
                    echo -e "${YELLOW}RPM 包下载不完整，跳过手动安装${NC}"
                fi
                
                # 清理临时目录
                cd "$SCRIPT_DIR"
                rm -rf "$TEMP_DIR"
            fi
            
            if [ "$DOCKER_INSTALL_SUCCESS" != "true" ]; then
                echo -e "${RED}Docker 安装失败！${NC}"
                echo -e "${YELLOW}尝试检查仓库配置...${NC}"
                cat /etc/yum.repos.d/docker-ce.repo 2>/dev/null || true
                
                echo ""
                echo -e "${YELLOW}==============================================${NC}"
                echo -e "${YELLOW}可能的解决方案：${NC}"
                echo -e "${YELLOW}==============================================${NC}"
                echo "1. 清理缓存后重试:"
                echo "   sudo dnf clean all && sudo yum clean all"
                echo ""
                echo "2. 检查并移除冲突的 Podman 包:"
                echo "   sudo dnf remove -y podman-docker podman buildah skopeo containers-common runc"
                echo ""
                echo "3. 手动安装 containerd.io:"
                echo "   sudo dnf install -y https://download.docker.com/linux/centos/8/x86_64/stable/Packages/containerd.io-1.6.32-3.1.el8.x86_64.rpm"
                echo ""
                echo "4. 如果是 Kylin Linux V10 / CentOS 8 停止维护问题，可以尝试："
                echo "   sudo sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/*.repo"
                echo "   sudo sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/*.repo"
                echo "   sudo dnf clean all && sudo dnf makecache"
                echo ""
                echo -e "${YELLOW}详细错误日志请查看上方输出${NC}"
                echo -e "${RED}请尝试上述解决方案后重新运行脚本${NC}"
                exit 1
            fi
            
            # 验证 Docker 是否安装成功（不是 Podman 伪装）
            hash -r  # 清除命令哈希缓存
            if ! command -v docker &> /dev/null; then
                echo -e "${RED}错误: Docker 安装后未找到 docker 命令${NC}"
                exit 1
            fi
            
            # 验证不是 Podman 伪装
            if docker --version 2>/dev/null | grep -qi "podman"; then
                echo -e "${RED}错误: 安装的仍然是 Podman 伪装的 Docker${NC}"
                echo -e "${YELLOW}请手动执行: sudo yum remove -y podman-docker podman${NC}"
                echo -e "${YELLOW}然后重新运行脚本${NC}"
                exit 1
            fi
            
            echo -e "${GREEN}Docker 安装成功: $(docker --version)${NC}"
            
            # 验证 docker.service 是否存在
            if ! $SUDO_CMD systemctl cat docker.service &>/dev/null; then
                echo -e "${YELLOW}警告: docker.service 未找到，尝试重新加载 systemd...${NC}"
                $SUDO_CMD systemctl daemon-reload
                if ! $SUDO_CMD systemctl cat docker.service &>/dev/null; then
                    echo -e "${RED}错误: docker.service 仍然不存在，Docker 可能未正确安装${NC}"
                    exit 1
                fi
            fi
            
            # 启动 Docker 服务
            $SUDO_CMD systemctl start docker
            $SUDO_CMD systemctl enable docker
            
            # 将当前用户添加到 docker 组（如果非 root 用户）
            if [ "$SUDO_CMD" = "sudo" ]; then
                $SUDO_CMD usermod -aG docker $USER
                echo -e "${YELLOW}已将当前用户添加到 docker 组，请重新登录或执行 'newgrp docker' 使权限生效${NC}"
            fi
            ;;
            
        openEuler)
            echo "检测到 openEuler 系统，使用 dnf 安装..."
            
            # 卸载旧版本
            $SUDO_CMD dnf remove -y docker docker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate docker-engine 2>/dev/null || true
            
            # 安装必要依赖
            $SUDO_CMD dnf install -y device-mapper-persistent-data lvm2
            
            # 添加 Docker 软件源（使用阿里云镜像）
            echo "添加 Docker 软件源..."
            $SUDO_CMD tee /etc/yum.repos.d/docker-ce.repo > /dev/null << 'DOCKER_REPO_EOF'
[docker-ce-stable]
name=Docker CE Stable - $basearch
baseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/8/$basearch/stable
enabled=1
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg
DOCKER_REPO_EOF
            
            # 安装 Docker
            $SUDO_CMD dnf install -y --allowerasing docker-ce docker-ce-cli containerd.io
            
            # 启动 Docker 服务
            $SUDO_CMD systemctl start docker
            $SUDO_CMD systemctl enable docker
            
            # 将当前用户添加到 docker 组（如果非 root 用户）
            if [ "$SUDO_CMD" = "sudo" ]; then
                $SUDO_CMD usermod -aG docker $USER
                echo -e "${YELLOW}已将当前用户添加到 docker 组，请重新登录或执行 'newgrp docker' 使权限生效${NC}"
            fi
            ;;
            
        *)
            echo -e "${RED}不支持的操作系统: $OS${NC}"
            echo "请手动安装 Docker"
            exit 1
            ;;
    esac
    
    echo -e "${GREEN}Docker 安装完成${NC}"
}
# 等待 Docker 守护进程就绪
wait_for_docker() {
    local max_wait=${1:-60}
    local wait_count=0
    
    echo "等待 Docker 守护进程就绪..."
    while [ $wait_count -lt $max_wait ]; do
        if $SUDO_CMD docker info &>/dev/null; then
            echo -e "${GREEN}Docker 守护进程已就绪${NC}"
            return 0
        fi
        echo -n "."
        sleep 1
        wait_count=$((wait_count + 1))
    done
    
    echo -e "\n${RED}错误: Docker 守护进程在 ${max_wait} 秒内未就绪${NC}"
    return 1
}

# 配置 Docker daemon.json
configure_docker_daemon() {
    echo "配置 Docker 镜像源..."
    
    # 创建 /etc/docker 目录（如果不存在）
    $SUDO_CMD mkdir -p /etc/docker
    
    # 写入 daemon.json 配置
    $SUDO_CMD tee /etc/docker/daemon.json > /dev/null << 'DOCKER_DAEMON_EOF'
{
  "registry-mirrors": [
    "https://docker.registry.cyou",
    "https://docker-cf.registry.cyou",
    "https://dockercf.jsdelivr.fyi",
    "https://docker.jsdelivr.fyi",
    "https://dockertest.jsdelivr.fyi",
    "https://mirror.aliyuncs.com",
    "https://dockerproxy.com",
    "https://mirror.baidubce.com",
    "https://docker.m.daocloud.io",
    "https://docker.nju.edu.cn",
    "https://docker.mirrors.sjtug.sjtu.edu.cn",
    "https://docker.mirrors.ustc.edu.cn",
    "https://mirror.iscas.ac.cn",
    "https://docker.rainbond.cc"
  ],
  "insecure-registries": ["docker.jiasion.net"]
}
DOCKER_DAEMON_EOF
    
    # 重载 Docker 配置
    if $SUDO_CMD systemctl is-active --quiet docker 2>/dev/null; then
        echo "重载 Docker 配置..."
        $SUDO_CMD systemctl daemon-reload
        $SUDO_CMD systemctl restart docker
        # 等待 Docker 重启完成
        wait_for_docker 30
    fi
    
    echo -e "${GREEN}Docker 镜像源配置完成${NC}"
}

# 检查并安装 docker-compose（使用指定命令安装，带重试机制）
install_docker_compose() {
    echo -e "${YELLOW}Docker Compose 未安装，开始安装...${NC}"
    download_file "http://download.jiasion.cn/mirror/docker-compose" "/usr/bin/docker-compose"
    COMPOSE_BIN="/usr/bin/docker-compose"
    $SUDO_CMD chmod +x "$COMPOSE_BIN"
    # 验证安装
    if command -v docker-compose &> /dev/null; then
        echo -e "${GREEN}Docker Compose 安装成功${NC}"
        docker-compose --version
    else
        echo -e "${RED}Docker Compose 安装后无法找到命令${NC}"
        exit 1
    fi
}

# 检查 Docker 是否为真正的 Docker（而非 Podman 伪装）
check_real_docker() {
    # 检查 docker 命令是否存在
    if ! command -v docker &> /dev/null; then
        return 0  # docker 不存在，需要安装
    fi
    
    # 检查 docker 版本输出是否包含 podman
    if docker --version 2>/dev/null | grep -qi "podman"; then
        echo -e "${YELLOW}检测到 Podman 伪装的 Docker...${NC}"
        return 1
    fi
    
    # 检查 docker.service 是否可用
    if ! $SUDO_CMD systemctl cat docker.service &>/dev/null; then
        echo -e "${YELLOW}检测到 Docker 命令但 docker.service 不存在...${NC}"
        return 1
    fi
    
    return 0
}

# 卸载 Podman 相关包
remove_podman_docker() {
    echo -e "${YELLOW}正在彻底卸载 Podman...${NC}"
    
    # 停止 podman 服务
    $SUDO_CMD systemctl stop podman.socket 2>/dev/null || true
    $SUDO_CMD systemctl stop podman.service 2>/dev/null || true
    $SUDO_CMD systemctl stop containerd 2>/dev/null || true
    $SUDO_CMD systemctl disable podman.socket 2>/dev/null || true
    $SUDO_CMD systemctl disable podman.service 2>/dev/null || true
    
    # 强制卸载 podman 相关包（包括 runc，因为它与 containerd.io 冲突）
    echo "卸载 Podman 包..."
    if command -v dnf &> /dev/null; then
        $SUDO_CMD dnf remove -y --allowerasing podman-docker podman podman-gvproxy podman-plugins podman-catatonit buildah skopeo containers-common runc 2>/dev/null || true
    else
        $SUDO_CMD yum remove -y podman-docker podman podman-gvproxy podman-plugins podman-catatonit buildah skopeo containers-common runc 2>/dev/null || true
    fi
    
    # 清理残留文件
    $SUDO_CMD rm -f /usr/bin/docker /usr/bin/docker-compose /etc/containers/nodocker 2>/dev/null || true
    $SUDO_CMD rm -rf /etc/containers 2>/dev/null || true
    
    # 重新加载 systemd
    $SUDO_CMD systemctl daemon-reload
    
    # 清除 shell 命令哈希缓存
    hash -r
    
    echo -e "${GREEN}Podman 已卸载${NC}"
}

# 主流程：检查并安装 Docker
echo -e "${BLUE}==========================================${NC}"
echo -e "${BLUE}  检查 Docker 环境${NC}"
echo -e "${BLUE}==========================================${NC}"

# 首先检查是否为 Podman 伪装
NEED_INSTALL=false
if command -v docker &> /dev/null; then
    if ! check_real_docker; then
        echo -e "${YELLOW}发现 Podman 伪装的 Docker，需要先卸载...${NC}"
        remove_podman_docker
        NEED_INSTALL=true
    else
        echo -e "${GREEN}Docker 已安装: $(docker --version)${NC}"
    fi
else
    echo -e "${YELLOW}Docker 命令不存在，需要安装...${NC}"
    NEED_INSTALL=true
fi

# 如果需要安装 Docker
if [ "$NEED_INSTALL" = "true" ]; then
    install_docker
fi

# 检查 Docker 服务状态
if ! $SUDO_CMD systemctl is-active --quiet docker 2>/dev/null; then
    echo "启动 Docker 服务..."
    $SUDO_CMD systemctl start docker || {
        echo -e "${RED}启动 Docker 服务失败，尝试重新加载 systemd...${NC}"
        $SUDO_CMD systemctl daemon-reload
        $SUDO_CMD systemctl start docker
    }
    $SUDO_CMD systemctl enable docker
fi

# 等待 Docker 就绪
wait_for_docker 60

# 检查 Docker 配置（daemon.json）
if [ -f /etc/docker/daemon.json ]; then
    echo "检查 Docker 配置..."
    # 检查是否包含所需的 registry-mirrors
    if grep -q "registry-mirrors" /etc/docker/daemon.json 2>/dev/null; then
        echo -e "${GREEN}Docker 镜像源已配置${NC}"
    else
        echo -e "${YELLOW}Docker 配置不完整，重新配置...${NC}"
        configure_docker_daemon
    fi
else
    configure_docker_daemon
fi

# 检查 Docker Compose（独立命令，非插件）
if command -v docker-compose &> /dev/null; then
    echo -e "${GREEN}Docker Compose 已安装: $(docker-compose --version)${NC}"
else
    install_docker_compose
fi

echo -e "${BLUE}==========================================${NC}"

# =============================================================================
# [3/13] 检查并安装 Nginx
# =============================================================================
echo -e "${BLUE}[3/13] 检查并安装 Nginx...${NC}"

install_nginx() {
    echo -e "${YELLOW}Nginx 未安装，开始安装...${NC}"
    
    # 检测系统类型
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        OS=$ID
    else
        echo -e "${RED}无法检测操作系统类型${NC}"
        return 1
    fi
    
    case $OS in
        ubuntu|debian)
            echo "检测到 Debian/Ubuntu 系统，使用 apt 安装 Nginx..."
            $SUDO_CMD apt-get update
            $SUDO_CMD apt-get install -y nginx
            ;;
        centos|rhel|fedora|rocky|almalinux|anolis|kylin)
            echo "检测到 RHEL/CentOS/Kylin 系统，使用 yum/dnf 安装 Nginx..."
            # 尝试安装 epel-release，Kylin Linux 可能没有这个仓库
            $SUDO_CMD yum install -y epel-release 2>/dev/null || \
            $SUDO_CMD dnf install -y epel-release 2>/dev/null || true
            # 安装 Nginx，优先尝试 yum，失败则尝试 dnf
            $SUDO_CMD yum install -y nginx 2>/dev/null || \
            $SUDO_CMD dnf install -y nginx 2>/dev/null || true
            ;;
        openEuler)
            echo "检测到 openEuler 系统，使用 dnf 安装 Nginx..."
            $SUDO_CMD dnf install -y nginx
            ;;
        *)
            echo -e "${RED}不支持的操作系统: $OS${NC}"
            return 1
            ;;
    esac
    
    echo -e "${GREEN}Nginx 安装完成${NC}"
}
# 检查 Nginx 是否已安装
if command -v nginx &> /dev/null; then
    echo -e "${GREEN}Nginx 已安装: $(nginx -v 2>&1)${NC}"
else
    install_nginx
fi
# 设置 locale 环境变量（消除 perl 警告）
export LANG=C
export LC_ALL=C
# 解决默认站点冲突问题
echo "检查默认站点配置..."

# 1. 处理 Ubuntu/Debian 系统的 sites-enabled/default 配置
if [ -f /etc/nginx/sites-enabled/default ]; then
    echo -e "${YELLOW}检测到 sites-enabled/default 配置，正在修改...${NC}"
    # 移除 default_server 标记，避免端口冲突
    $SUDO_CMD sed -i 's/listen 80 default_server/listen 80/g' /etc/nginx/sites-enabled/default
    $SUDO_CMD sed -i 's/listen \[::\]:80 default_server/listen [::]:80/g' /etc/nginx/sites-enabled/default
    echo -e "${GREEN}sites-enabled/default 配置已修改（移除 default_server）${NC}"
fi

# 2. 处理 RHEL/CentOS/openEuler 系统的 conf.d/default.conf 配置
if [ -f /etc/nginx/conf.d/default.conf ]; then
    echo -e "${YELLOW}检测到 conf.d/default.conf 配置，正在修改...${NC}"
    $SUDO_CMD sed -i 's/listen 80 default_server/listen 80/g' /etc/nginx/conf.d/default.conf
    $SUDO_CMD sed -i 's/listen \[::\]:80 default_server/listen [::]:80/g' /etc/nginx/conf.d/default.conf
    echo -e "${GREEN}conf.d/default.conf 配置已修改（移除 default_server）${NC}"
fi

# 3. 处理 nginx.conf 主配置文件中的默认 server 块（适用于 openEuler 等系统）
if [ -f /etc/nginx/nginx.conf ]; then
    # 检查 nginx.conf 中是否包含 listen 80 default_server
    if grep -q "listen.*80.*default_server" /etc/nginx/nginx.conf 2>/dev/null; then
        echo -e "${YELLOW}检测到 nginx.conf 中存在 default_server，正在修改...${NC}"
        $SUDO_CMD sed -i 's/listen\s\+80\s\+default_server\([^;]*\)/listen 80\1/g' /etc/nginx/nginx.conf
        $SUDO_CMD sed -i 's/listen\s\+\[::\]:80\s\+default_server\([^;]*\)/listen [::]:80\1/g' /etc/nginx/nginx.conf
        echo -e "${GREEN}nginx.conf 配置已修改（移除 default_server）${NC}"
    fi
fi

# 检查是否修改了任何配置
if ! grep -r "listen.*80.*default_server" /etc/nginx/sites-enabled/ /etc/nginx/conf.d/ /etc/nginx/nginx.conf 2>/dev/null | grep -v "^Binary"; then
    echo -e "${GREEN}默认站点配置检查完成（无 default_server 冲突）${NC}"
else
    echo -e "${YELLOW}警告: 仍有配置包含 default_server 标记${NC}"
fi
# 确保 Nginx 以 root 用户运行
echo "检查 Nginx 用户配置..."
if [ -f /etc/nginx/nginx.conf ]; then
    # 检查配置文件中是否包含 user 指令
    if grep -q "^user\s" /etc/nginx/nginx.conf; then
        # 修改 user 指令为 root
        $SUDO_CMD sed -i 's/^user\s.*/user root;/' /etc/nginx/nginx.conf
        echo -e "${GREEN}Nginx 用户已配置为 root${NC}"
    else
        # 在 events 块之前添加 user root;
        $SUDO_CMD sed -i '/^events/i user root;' /etc/nginx/nginx.conf
        echo -e "${GREEN}已添加 user root 配置${NC}"
    fi
else
    echo -e "${YELLOW}警告: /etc/nginx/nginx.conf 不存在${NC}"
fi
# 默认配置
DEFAULT_IMAGE_TAG="latest"
IMAGE_TAG="${1:-$DEFAULT_IMAGE_TAG}"
# 各个服务的认证开关（独立设置）
MONGO_ENABLE_AUTH="${2:-false}"
REDIS_ENABLE_AUTH="${3:-false}"
MQTT_ENABLE_AUTH="${4:-false}"
# 认证配置
MONGO_ROOT_USERNAME="admin"
MONGO_ROOT_PASSWORD="jiasion602"
MONGO_USER="jiasion"
MONGO_PASSWORD="jiasion602"
MONGO_DATABASE="jsctrl"
REDIS_PASSWORD="jiasion602"
MQTT_USERNAME="jiasion"
MQTT_PASSWORD="jiasion1057"

echo -e "${GREEN}部署配置:${NC}"
echo "  镜像版本: $IMAGE_TAG"
echo "  主机IP:   $HOST_IP"
echo -e "${GREEN}认证配置:${NC}"
echo "  MongoDB: $MONGO_ENABLE_AUTH"
echo "  Redis:   $REDIS_ENABLE_AUTH"
echo "  MQTT:    $MQTT_ENABLE_AUTH"

# =============================================================================
#  [4/13] 创建目录结构（如果不存在）
# =============================================================================
echo -e "${BLUE}[4/13] 检查并创建目录结构...${NC}"
# MongoDB 目录
if [ ! -d "/home/mongodb/data" ]; then
    $SUDO_CMD mkdir -p /home/mongodb/data
    echo "  创建: /home/mongodb/data"
fi
if [ ! -d "/home/mongodb/logs" ]; then
    $SUDO_CMD mkdir -p /home/mongodb/logs
    echo "  创建: /home/mongodb/logs"
fi
if [ ! -d "/home/mongodb/config" ]; then
    $SUDO_CMD mkdir -p /home/mongodb/config
    echo "  创建: /home/mongodb/config"
fi
if [ ! -d "/home/mongodb/scripts" ]; then
    $SUDO_CMD mkdir -p /home/mongodb/scripts
    echo "  创建: /home/mongodb/scripts"
fi

# Redis 目录
if [ ! -d "/home/redis/data" ]; then
    $SUDO_CMD mkdir -p /home/redis/data
    echo "  创建: /home/redis/data"
fi
if [ ! -d "/home/redis/config" ]; then
    $SUDO_CMD mkdir -p /home/redis/config
    echo "  创建: /home/redis/config"
fi
if [ ! -d "/home/redis/scripts" ]; then
    $SUDO_CMD mkdir -p /home/redis/scripts
    echo "  创建: /home/redis/scripts"
fi

# MQTT 目录
if [ ! -d "/home/mosquitto/config" ]; then
    $SUDO_CMD mkdir -p /home/mosquitto/config
    echo "  创建: /home/mosquitto/config"
fi
if [ ! -d "/home/mosquitto/data" ]; then
    $SUDO_CMD mkdir -p /home/mosquitto/data
    echo "  创建: /home/mosquitto/data"
fi
if [ ! -d "/home/mosquitto/logs" ]; then
    $SUDO_CMD mkdir -p /home/mosquitto/logs
    echo "  创建: /home/mosquitto/logs"
fi

# jsserver 目录
if [ ! -d "/home/jsserver" ]; then
    $SUDO_CMD mkdir -p /home/jsserver
    echo "  创建: /home/jsserver"
fi

# 创建 jsserver entrypoint 脚本
JS_ENTRYPOINT="/home/jsserver/server_docker-entrypoint.sh"
if [ ! -f "$JS_ENTRYPOINT" ]; then
$SUDO_CMD tee "$JS_ENTRYPOINT" > /dev/null << 'JS_SCRIPT_EOF'
#!/bin/sh
set -e

if [ -d "/usr/local/jiasion.orig" ] && [ -n "$(ls -A /usr/local/jiasion.orig 2>/dev/null)" ]; then
      cp -r /usr/local/jiasion.orig/. /usr/local/jiasion/ 2>/dev/null || cp -r /usr/local/jiasion.orig/* /usr/local/jiasion/
      echo "已从 /usr/local/jiasion.orig 复制初始文件到 /usr/local/jiasion"
      cp /usr/local/jiasion/jiasion.site.conf /etc/nginx/conf.d/  2>/dev/null || echo "警告: 无法复制 jiasion.site.conf（可能是只读文件系统）"
else
    echo "警告: /usr/local/jiasion.orig 不存在或为空，无法初始化 /usr/local/jiasion"
fi

echo "检查 /home/jsserver 目录下的图标文件..."

if [ ! -f "/home/jsserver/favicon.png" ]; then
    if [ -f "/usr/local/jiasion/web/favicon.png" ]; then
        cp /usr/local/jiasion/web/favicon.png /home/jsserver/ 2>/dev/null || echo "警告: 无法复制 favicon.png（可能是只读文件系统）"
    else
        echo "警告: /usr/local/jiasion/web/favicon.png 不存在"
    fi
else
    echo "favicon.png 已存在，跳过复制"
fi

if [ ! -f "/home/jsserver/logo.png" ]; then
    if [ -f "/usr/local/jiasion/web/logo.png" ]; then
        cp /usr/local/jiasion/web/logo.png /home/jsserver/ 2>/dev/null || echo "警告: 无法复制 logo.png（可能是只读文件系统）"
    else
        echo "警告: /usr/local/jiasion/web/logo.png 不存在"
    fi
else
    echo "logo.png 已存在，跳过复制"
fi

echo "启动 server..."
exec /usr/bin/jsServer -conf /home/jsserver/jsserver.conf
JS_SCRIPT_EOF
    $SUDO_CMD chmod +x "$JS_ENTRYPOINT"
    echo "  创建: $JS_ENTRYPOINT"
else
    echo "  已存在: $JS_ENTRYPOINT"
fi


# NTP 时间同步服务器目录
if [ ! -d "/home/ntp/config" ]; then
    $SUDO_CMD mkdir -p /home/ntp/config
    echo "  创建: /home/ntp/config"
fi
if [ ! -d "/home/ntp/data" ]; then
    $SUDO_CMD mkdir -p /home/ntp/data
    echo "  创建: /home/ntp/data"
fi
if [ ! -d "/home/ntp/logs" ]; then
    $SUDO_CMD mkdir -p /home/ntp/logs
    echo "  创建: /home/ntp/logs"
fi

# 检查 /home/dface 目录是否存在文件，不存在才下载和解压
if [ -z "$(ls -A /home/dface 2>/dev/null)" ]; then
    echo "下载 dface_sdk..."
    download_file "http://download.jiasion.cn/mirror/dface_sdk.tar.gz" "dface_sdk.tar.gz"
    $SUDO_CMD tar -xzvf dface_sdk.tar.gz
    if [ ! -d "/home/dface" ]; then
        $SUDO_CMD mkdir -p /home/dface
        echo "  创建: /home/dface"
    fi
    $SUDO_CMD cp dface_sdk  /home/dface -rf
    $SUDO_CMD rm dface_sdk.tar.gz dface_sdk -rf
    echo "  dface_sdk 安装完成"
else
    echo "  /home/dface 已存在文件，跳过 dface_sdk 下载和安装"
fi

echo -e "${GREEN}目录结构检查完成${NC}"

# =============================================================================
#  [5/13] 创建 MongoDB 启动脚本（如果不存在）
# =============================================================================
echo -e "${BLUE}检查并创建 MongoDB 启动脚本...${NC}"

MONGO_ENTRYPOINT="/home/mongodb/scripts/docker-entrypoint.sh"
if [ ! -f "$MONGO_ENTRYPOINT" ]; then
$SUDO_CMD tee "$MONGO_ENTRYPOINT" > /dev/null << 'MONGO_SCRIPT_EOF'
#!/bin/bash
set -e

MONGO_ENABLE_AUTH=${MONGO_ENABLE_AUTH:-false}
MONGO_ROOT_USERNAME=${MONGO_ROOT_USERNAME:-admin}
MONGO_ROOT_PASSWORD=${MONGO_ROOT_PASSWORD:-jiasion602}
MONGO_USER=${MONGO_USER:-jiasion}
MONGO_PASSWORD=${MONGO_PASSWORD:-jiasion602}
MONGO_DATABASE=${MONGO_DATABASE:-jsctrl}

mkdir -p /data/configdb

# 生成配置文件
if [ "$MONGO_ENABLE_AUTH" = "true" ]; then
cat > /data/configdb/mongod.conf <<'MONGOD_EOF'
storage:
  dbPath: /data/db
  journal:
    enabled: true
systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log
net:
  port: 27017
  bindIp: 0.0.0.0
security:
  authorization: enabled
MONGOD_EOF
else
cat > /data/configdb/mongod.conf <<'MONGOD_EOF'
storage:
  dbPath: /data/db
  journal:
    enabled: true
systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log
net:
  port: 27017
  bindIp: 0.0.0.0
MONGOD_EOF
fi

mkdir -p /var/log/mongodb
chown -R mongodb:mongodb /var/log/mongodb
chown -R mongodb:mongodb /data/db
chown -R mongodb:mongodb /data/configdb

# 临时启动 MongoDB（无认证模式）用于用户管理
echo "临时启动 MongoDB 进行用户检查..."
mongod --fork --logpath /var/log/mongodb/mongod.log --bind_ip 0.0.0.0 --dbpath /data/db

echo "等待 MongoDB 启动..."
sleep 3

MAX_WAIT=60
WAIT_COUNT=0
while [ $WAIT_COUNT -lt $MAX_WAIT ]; do
    if mongosh --eval "db.adminCommand({ping: 1})" 2>/dev/null | grep -q "ok"; then
        echo "MongoDB 已就绪"
        break
    fi
    echo -n "."
    sleep 1
    WAIT_COUNT=$((WAIT_COUNT + 1))
done

if [ $WAIT_COUNT -eq $MAX_WAIT ]; then
    echo "错误: MongoDB 启动超时"
    exit 1
fi

# 检查并更新 root 用户
echo "检查 root 用户..."
ROOT_EXISTS=$(mongosh admin --eval "db.getUser('$MONGO_ROOT_USERNAME')" 2>/dev/null | grep -o "user: '$MONGO_ROOT_USERNAME'" || echo "")
if [ -z "$ROOT_EXISTS" ]; then
    echo "创建 root 用户: $MONGO_ROOT_USERNAME"
    mongosh admin --eval "
        db.createUser({
            user: '$MONGO_ROOT_USERNAME',
            pwd: '$MONGO_ROOT_PASSWORD',
            roles: [
                { role: 'root', db: 'admin' },
                { role: 'userAdminAnyDatabase', db: 'admin' },
                { role: 'dbAdminAnyDatabase', db: 'admin' },
                { role: 'readWriteAnyDatabase', db: 'admin' }
            ]
        });
    " || echo "root 用户创建失败或已存在"
else
    echo "更新 root 用户密码..."
    mongosh admin --eval "
        db.changeUserPassword('$MONGO_ROOT_USERNAME', '$MONGO_ROOT_PASSWORD');
    " 2>/dev/null || echo "root 用户密码更新失败"
fi

# 检查并更新应用用户
echo "检查应用用户..."
APP_EXISTS=$(mongosh admin --eval "db.getUser('$MONGO_USER')" 2>/dev/null | grep -o "user: '$MONGO_USER'" || echo "")
if [ -z "$APP_EXISTS" ]; then
    echo "创建应用用户: $MONGO_USER"
    mongosh admin --eval "
        db.createUser({
            user: '$MONGO_USER',
            pwd: '$MONGO_PASSWORD',
            roles: [
                { role: 'readWrite', db: '$MONGO_DATABASE' },
                { role: 'dbAdmin', db: '$MONGO_DATABASE' }
            ]
        });
    " 2>/dev/null || echo "应用用户创建失败或已存在"
else
    echo "更新应用用户 $MONGO_USER 密码..."
    mongosh admin --eval "
        db.changeUserPassword('$MONGO_USER', '$MONGO_PASSWORD');
    " 2>/dev/null || echo "应用用户密码更新失败"
fi

echo "用户更新完成"

# 关闭临时 MongoDB
echo "关闭临时 MongoDB..."
mongosh admin --eval "db.shutdownServer()" 2>/dev/null || true
sleep 2

echo "启动 MongoDB..."
if [ "$MONGO_ENABLE_AUTH" = "true" ]; then
    exec mongod --config /data/configdb/mongod.conf --auth
else
    exec mongod --config /data/configdb/mongod.conf
fi
MONGO_SCRIPT_EOF
    $SUDO_CMD chmod +x "$MONGO_ENTRYPOINT"
    echo "  创建: $MONGO_ENTRYPOINT"
else
    echo "  已存在: $MONGO_ENTRYPOINT"
fi

echo -e "${GREEN}MongoDB 启动脚本检查完成${NC}"

# =============================================================================
# [6/13] 创建 Redis 配置文件（如果不存在）
# =============================================================================
echo -e "${BLUE}[6/13] 检查并创建 Redis 配置文件...${NC}"

REDIS_CONF="/home/redis/config/redis.conf"
if [ ! -f "$REDIS_CONF" ]; then
$SUDO_CMD tee "$REDIS_CONF" > /dev/null << 'REDIS_CONF_EOF'
# Redis 配置文件
bind 0.0.0.0
port 6379
tcp-backlog 511
timeout 0
tcp-keepalive 300
daemonize no
loglevel notice
logfile ""
databases 16
save 900 1
save 300 10
save 60 10000
stop-writes-on-bgsave-error yes
rdbcompression yes
rdbchecksum yes
dbfilename dump.rdb
dir /data
REDIS_CONF_EOF
    echo "  创建: $REDIS_CONF"
else
    echo "  已存在: $REDIS_CONF"
fi

echo -e "${GREEN}Redis 配置文件检查完成${NC}"

# =============================================================================
# [7/13] 创建 Redis 启动脚本（如果不存在）
# =============================================================================
echo -e "${BLUE}[7/13] 检查并创建 Redis 启动脚本...${NC}"

REDIS_START="/home/redis/scripts/start-redis.sh"
if [ ! -f "$REDIS_START" ]; then
$SUDO_CMD tee "$REDIS_START" > /dev/null << 'REDIS_SCRIPT_EOF'
#!/bin/sh
set -e

REDIS_ENABLE_AUTH=${REDIS_ENABLE_AUTH:-false}
REDIS_PASSWORD=${REDIS_PASSWORD:-jiasion602}

mkdir -p /tmp/redis
cp /usr/local/etc/redis/redis.conf /tmp/redis/redis.conf

if [ "$REDIS_ENABLE_AUTH" = "true" ]; then
    echo "启用 Redis 认证模式..."
    echo "requirepass $REDIS_PASSWORD" >> /tmp/redis/redis.conf
else
    echo "禁用 Redis 认证模式..."
    sed -i '/^requirepass/d' /tmp/redis/redis.conf || true
fi

chown -R redis:redis /data

echo "启动 Redis..."
exec redis-server /tmp/redis/redis.conf
REDIS_SCRIPT_EOF
    $SUDO_CMD chmod +x "$REDIS_START"
    echo "  创建: $REDIS_START"
else
    echo "  已存在: $REDIS_START"
fi

echo -e "${GREEN}Redis 启动脚本检查完成${NC}"

# =============================================================================
# [8/13] 创建 MQTT 启动脚本（如果不存在）
# =============================================================================
echo -e "${BLUE}[8/13] 检查并创建 MQTT 启动脚本...${NC}"

MQTT_START="/home/mosquitto/config/start-mosquitto.sh"
if [ ! -f "$MQTT_START" ]; then
$SUDO_CMD tee "$MQTT_START" > /dev/null << 'MQTT_SCRIPT_EOF'
#!/bin/sh
set -e

MQTT_ENABLE_AUTH=${MQTT_ENABLE_AUTH:-false}
MQTT_USERNAME=${MQTT_USERNAME:-jiasion}
MQTT_PASSWORD=${MQTT_PASSWORD:-jiasion1057}

cat > /mosquitto/config/mosquitto.conf <<EOF
listener 1883
protocol mqtt
listener 9001
protocol websockets
persistence true
persistence_location /mosquitto/data/
log_dest file /mosquitto/log/mosquitto.log
log_dest stdout
# 消息大小限制配置
# max_packet_size: 限制整个 MQTT 数据包大小（含头部），Mosquitto 2.1+ 默认 2MB
# 设为 268435455 字节（约 256MB，MQTT 协议最大值）以支持大消息传输
max_packet_size 268435455
message_size_limit 0  # 消息负载(payload)大小限制，0 表示无限制
EOF

if [ "$MQTT_ENABLE_AUTH" = "true" ]; then
    echo "启用 MQTT 认证模式..."
    echo "allow_anonymous false" >> /mosquitto/config/mosquitto.conf
    echo "password_file /mosquitto/config/passwd" >> /mosquitto/config/mosquitto.conf
    
    touch /mosquitto/config/passwd
    mosquitto_passwd -b /mosquitto/config/passwd "$MQTT_USERNAME" "$MQTT_PASSWORD"
    echo "MQTT 用户已创建: $MQTT_USERNAME"
else
    echo "禁用 MQTT 认证模式（允许匿名访问）..."
    echo "allow_anonymous true" >> /mosquitto/config/mosquitto.conf
fi

mkdir -p /mosquitto/data /mosquitto/log
chown -R mosquitto:mosquitto /mosquitto/data /mosquitto/log

echo "启动 Mosquitto..."
exec mosquitto -c /mosquitto/config/mosquitto.conf
MQTT_SCRIPT_EOF
    $SUDO_CMD chmod +x "$MQTT_START"
    echo "  创建: $MQTT_START"
else
    echo "  已存在: $MQTT_START"
fi

echo -e "${GREEN}MQTT 启动脚本检查完成${NC}"

# =============================================================================
# [9/13] 创建 NTP 配置文件（如果不存在）
# =============================================================================
echo -e "${BLUE}[9/13] 检查并创建 NTP 配置文件...${NC}"

NTP_CONF="/home/ntp/config/chrony.conf"
if [ ! -f "$NTP_CONF" ]; then
$SUDO_CMD tee "$NTP_CONF" > /dev/null << 'NTP_CONF_EOF'
# Chrony NTP 服务器配置文件

# 允许所有客户端同步时间
allow 0.0.0.0/0

# 使用国内 NTP 服务器作为上游时间源
pool ntp.aliyun.com iburst maxsources 4
pool ntp.tencent.com iburst maxsources 2
server ntp1.aliyun.com iburst
server ntp2.aliyun.com iburst
server time1.cloud.tencent.com iburst

# 记录时钟漂移
driftfile /var/lib/chrony/drift

# 日志配置
logdir /var/log/chrony
log measurements statistics tracking

# 允许客户端查询
bindcmdaddress 0.0.0.0

# 设置本地时钟为 stratum 5（降低 stratum 使客户端更愿意同步）
local stratum 5

# 最小化启动时间
makestep 1.0 3

# 启用 NTP 服务（监听所有接口）
port 123
bindaddress 0.0.0.0

# 允许的最大校时偏差（秒）
maxupdateskew 100.0

# 硬件时钟同步
hwclockfile /etc/adjtime
NTP_CONF_EOF
    echo "  创建: $NTP_CONF"
else
    echo "  已存在: $NTP_CONF"
fi

echo -e "${GREEN}NTP 配置文件检查完成${NC}"

# =============================================================================
# [10/13] 创建 .env 文件
# =============================================================================
echo -e "${BLUE}[10/13] 创建环境变量配置文件...${NC}"
$SUDO_CMD tee "$SCRIPT_DIR/.env" > /dev/null << EOF
# Docker Compose 环境变量配置

# 主机IP地址
HOST_IP=$HOST_IP

IMAGE_TAG=$IMAGE_TAG
IMAGE_TRDPART_TAG=2.1.1.202605121730

MONGO_ENABLE_AUTH=$MONGO_ENABLE_AUTH
REDIS_ENABLE_AUTH=$REDIS_ENABLE_AUTH
MQTT_ENABLE_AUTH=$MQTT_ENABLE_AUTH

MONGO_ROOT_USERNAME=$MONGO_ROOT_USERNAME
MONGO_ROOT_PASSWORD=$MONGO_ROOT_PASSWORD
MONGO_USER=$MONGO_USER
MONGO_PASSWORD=$MONGO_PASSWORD
MONGO_DATABASE=$MONGO_DATABASE

REDIS_PASSWORD=$REDIS_PASSWORD

MQTT_USERNAME=$MQTT_USERNAME
MQTT_PASSWORD=$MQTT_PASSWORD
EOF
echo -e "${GREEN}.env 文件创建完成${NC}"

# =============================================================================
# [11/13] 设置目录权限
# =============================================================================
echo -e "${BLUE}[11/13] 设置目录权限...${NC}"
$SUDO_CMD chown -R 999:999 /home/mongodb/ 2>/dev/null || true
$SUDO_CMD chown -R 999:999 /home/redis/ 2>/dev/null || true
$SUDO_CMD chown -R 1883:1883 /home/mosquitto/ 2>/dev/null || true
echo -e "${GREEN}权限设置完成${NC}"

cd "$SCRIPT_DIR"
$SUDO_CMD "$DOCKER_COMPOSE_BIN" -f "$SCRIPT_DIR/docker-compose-deploy.yml" down --remove-orphans 2>/dev/null || true
echo "  旧容器已停止"
# =============================================================================
# [12/13] 生成应用配置文件（在文件导出后执行，确保配置正确）
# =============================================================================
echo -e "${BLUE}[12/13] 生成应用配置文件...${NC}"

if [ "$MONGO_ENABLE_AUTH" = "true" ]; then
    DB_USER="$MONGO_USER"
    DB_PASSWORD="$MONGO_PASSWORD"
else
    DB_USER=""
    DB_PASSWORD=""
fi

if [ "$REDIS_ENABLE_AUTH" = "true" ]; then
    REDIS_PWD_CONFIG="$REDIS_PASSWORD"
    REDIS_PWD="$REDIS_PASSWORD"
else
    REDIS_PWD_CONFIG=""
    REDIS_PWD=""
fi

if [ "$MQTT_ENABLE_AUTH" = "true" ]; then
    MQTT_USER_CONFIG="$MQTT_USERNAME"
    MQTT_PWD_CONFIG="$MQTT_PASSWORD"
else
    MQTT_USER_CONFIG=""
    MQTT_PWD_CONFIG=""
fi

$SUDO_CMD tee /home/jsserver/config.yaml > /dev/null << EOF
data:
  mongodb:
    host: '$HOST_IP'
    port: 27017
    username: '$DB_USER'
    password: '$DB_PASSWORD'
    auth_db: 'admin'
    database: 'jsctrl'
    max_pool_size: 32
    connect_timeout: 5s
    operation_timeout: 60s
  redis:
    host: '$HOST_IP'
    port: 6379
    password: '$REDIS_PWD_CONFIG'
    db: 0
    read_timeout: 0.2s
    write_timeout: 0.2s
  mosquitto:
    addr: '$HOST_IP:1883'
    username: '$MQTT_USER_CONFIG'
    password: '$MQTT_PWD_CONFIG'
    max_open: 100
    max_idle_life_time: 300s
    client_id_prefix: jsmqp-
    certFile:
    keyFile:
  work_wechat:
    app_id: ''
    agent_id: ''
    app_secret: ''
  cas_setting:
    base: ''
    qrcode_en: false
    qrcode_base: ''
  cls:
    endpoint: ''
    access_key_id: ''
    access_key_secret: ''
  websockify:
    port: 10000
  webrtc:
    rtsp_stream_source: 'server'
    rtsp_mode: 'rtsp'
    port_min: 50000
    port_max: 50100
    host_ip: ''
  env: 'dev'
  host_ip: ''
  jwt:
    sign-key: 'jwt@jiasion'
server:
  users:
    http:
      addr: '$HOST_IP:8100'
      timeout: 1s
    grpc:
      addr: '$HOST_IP:9100'
      timeout: 1s
  system:
    http:
      addr: '$HOST_IP:8101'
      timeout: 1s
    grpc:
      addr: '$HOST_IP:9101'
      timeout: 1s
  devices:
    http:
      addr: '$HOST_IP:8103'
      timeout: 1s
    grpc:
      addr: '$HOST_IP:9103'
      timeout: 1s
  tasks:
    http:
      addr: '$HOST_IP:8104'
      timeout: 1s
    grpc:
      addr: '$HOST_IP:9104'
      timeout: 1s
  medias:
    http:
      addr: '$HOST_IP:8105'
      timeout: 1s
    grpc:
      addr: '$HOST_IP:20000'
      timeout: 1s
  scenario:
    http:
      addr: '$HOST_IP:8105'
      timeout: 1s
    grpc:
      addr: '$HOST_IP:20000'
      timeout: 1s
  webskt:
    http:
      addr: '$HOST_IP:8105'
      timeout: 1s
    grpc:
      addr: '$HOST_IP:20000'
      timeout: 1s
  plugins:
    http:
      addr: '$HOST_IP:8106'
      timeout: 10s
    grpc:
      addr: '$HOST_IP:9106'
      timeout: 10s
adapters:
EOF

$SUDO_CMD tee /home/jsserver/jsserver.conf > /dev/null << EOF
{
    "env": "dev",
    "api-port": 8800,
    "firmware-port": 8000,
    "static-file-port": 9000,
    "db": "$HOST_IP",
    "db-port": 27017,
    "db-user": "$DB_USER",
    "db-password": "$DB_PASSWORD",
    "auth-db": "admin",
    "mq-server": "$HOST_IP",
    "mq-port": 1883,
    "mq-username": "$MQTT_USER_CONFIG",
    "mq-password": "$MQTT_PWD_CONFIG",
    "mq-tls-enable": false,
    "redis-config": {
        "url": "$HOST_IP",
        "port": 6379,
        "password": "$REDIS_PWD",
        "db": 0
    }
}
EOF

echo -e "${GREEN}应用配置文件生成完成${NC}"

# =============================================================================
# [13/13] 启动 Docker 服务
# =============================================================================
echo -e "${BLUE}[13/13] 启动 Docker 服务...${NC}"

$SUDO_CMD tee "$SCRIPT_DIR/docker-compose-deploy.yml" > /dev/null << 'EOF'
services:
  # MongoDB 服务
  js_mongodb:
    image: docker.jiasion.net/jiasion/mongodb:6.0.26
    container_name: js_mongodb
    restart: always
    ports:
      - "27017:27017"
    volumes:
      - /home/mongodb/data:/data/db
      - /home/mongodb/logs:/var/log/mongodb
      - /home/mongodb/config:/data/configdb
      - /home/mongodb/scripts/docker-entrypoint.sh:/home/mongodb/scripts/docker-entrypoint.sh:ro
    environment:
      TZ: Asia/Shanghai 
      MONGO_ROOT_USERNAME: ${MONGO_ROOT_USERNAME:-admin}
      MONGO_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD:-jiasion602}
      MONGO_USER: ${MONGO_USER:-jiasion}
      MONGO_PASSWORD: ${MONGO_PASSWORD:-jiasion602}
      MONGO_DATABASE: ${MONGO_DATABASE:-jsctrl}
      MONGO_ENABLE_AUTH: ${MONGO_ENABLE_AUTH:-false}
    # 使用自定义 entrypoint 脚本处理认证配置
    entrypoint: ["/home/mongodb/scripts/docker-entrypoint.sh"]
    command: []  # 清空默认命令，由 entrypoint 处理
    networks:
      - jiasion-net
    extra_hosts:
      - "host-local:${HOST_IP}"
    ulimits:
      nofile:
        soft: 65535
        hard: 65535
  # Redis 服务
  js_redis:
    image: docker.jiasion.net/jiasion/redis:7-alpine
    container_name: js_redis
    restart: always
    ports:
      - "6379:6379"
    volumes:
      - /home/redis/data:/data
      - /home/redis/config/redis.conf:/usr/local/etc/redis/redis.conf:ro
      - /home/redis/scripts/start-redis.sh:/usr/local/bin/start-redis.sh:ro
    environment:
      TZ: Asia/Shanghai
      REDIS_PASSWORD: ${REDIS_PASSWORD:-jiasion602}
      REDIS_ENABLE_AUTH: ${REDIS_ENABLE_AUTH:-false}
    # 使用自定义启动脚本处理认证配置
    command: /usr/local/bin/start-redis.sh
    networks:
      - jiasion-net
    extra_hosts:
      - "host-local:${HOST_IP}"
  # MQTT (Mosquitto) 服务
  js_mosquitto:
    image: docker.jiasion.net/jiasion/mqtt:2
    container_name: js_mosquitto
    restart: always
    ports:
      - "1883:1883"
      - "9001:9001"
    volumes:
      - /home/mosquitto/config:/mosquitto/config
      - /home/mosquitto/data:/mosquitto/data
      - /home/mosquitto/logs:/mosquitto/logs
    ulimits:
      nofile:
        soft: 65535
        hard: 65535
    environment:
      TZ: Asia/Shanghai 
      MQTT_ENABLE_AUTH: ${MQTT_ENABLE_AUTH:-false}
      MQTT_USERNAME: ${MQTT_USERNAME:-jiasion}
      MQTT_PASSWORD: ${MQTT_PASSWORD:-jiasion1057}
    command: /mosquitto/config/start-mosquitto.sh
    networks:
      - jiasion-net
    extra_hosts:
      - "host-local:${HOST_IP}"
  # NTP (Chrony) 时间同步服务
  js_ntp:
    image: docker.jiasion.net/jiasion/ntp:latest
    container_name: js_ntp
    restart: always
    network_mode: "host"
    volumes:
      - /home/ntp/config/chrony.conf:/etc/chrony/chrony.conf
      - /home/ntp/data:/var/lib/chrony
      - /home/ntp/logs:/var/log/chrony
    environment:
      - NTP_SERVERS=ntp.aliyun.com,ntp.tencent.com
      - TZ=Asia/Shanghai 
    cap_add:
      - SYS_TIME
    entrypoint: ["/bin/sh", "-c"]
    command: ["chown -R chrony:chrony /run/chrony /var/lib/chrony /var/log/chrony 2>/dev/null; rm -f /var/run/chrony/chronyd.pid /var/lib/chrony/chrony.drift 2>/dev/null; exec /usr/sbin/chronyd -u chrony -d -L 0"]
  # js_logsrv 服务（主服务）
  js_logsrv:
    image: docker.jiasion.net/jiasion/server:${IMAGE_TAG:-latest}
    container_name: js_logsrv
    restart: always
    network_mode: "host"
    volumes:
      - /home/jsserver:/home/jsserver:rw
      - /usr/local/jiasion:/usr/local/jiasion:rw
      - /etc/nginx/conf.d:/etc/nginx/conf.d:rw
      - /etc/machine-id:/etc/machine-id:ro
    extra_hosts:
      - "host-local:${HOST_IP}"
    entrypoint: ["/home/jsserver/server_docker-entrypoint.sh"]
    command: []
    depends_on:
      js_mongodb:
        condition: service_started
      js_redis:
        condition: service_started
      js_mosquitto:
        condition: service_started 
      js_ntp:
        condition: service_started 
  # js_system 服务 - 使用桥接网络
  js_system:
    image: docker.jiasion.net/jiasion/system:${IMAGE_TAG:-latest}
    container_name: js_system
    restart: always
    ports:
      - "8101:8101"
      - "9101:9101"
    volumes:
      - /home/jsserver:/home/jsserver:rw
      - /etc/machine-id:/etc/machine-id:ro
    networks:
      - jiasion-net
    extra_hosts:
      - "host-local:${HOST_IP}"
    command: >
      sh -c '
        echo "js_logsrv 已启动成功，等待 5 秒后启动 js_system...";
        sleep 5;
        exec /app/system -conf /home/jsserver/config.yaml
      '
    depends_on:
      js_mongodb:
        condition: service_started
      js_redis:
        condition: service_started
      js_mosquitto:
        condition: service_started
      js_ntp:
        condition: service_started
      js_logsrv:
        condition: service_started
  # js_users 服务 - 使用桥接网络
  js_users:
    image: docker.jiasion.net/jiasion/users:${IMAGE_TAG:-latest}
    container_name: js_users
    restart: always
    ports:
      - "8100:8100"
      - "9100:9100"
    volumes:
      - /home/jsserver:/home/jsserver:rw
      - /root/BitAnswer:/root/BitAnswer:rw
      - /etc/machine-id:/etc/machine-id:ro
      - /home/dface/dface_sdk:/usr/local/dface_sdk:ro
      - /home/dface/dface_sdk/cxx/include/dface:/usr/local/include/dface:ro
    networks:
      - jiasion-net
    extra_hosts:
      - "host-local:${HOST_IP}"
    command: ["/app/users", "-conf", "/home/jsserver/config.yaml"]
    depends_on:
      js_mongodb:
        condition: service_started
      js_redis:
        condition: service_started
      js_mosquitto:
        condition: service_started
      js_ntp:
        condition: service_started
      js_logsrv:
        condition: service_started
  # js_devices 服务 - 使用 host 网络
  js_devices:
    image: docker.jiasion.net/jiasion/devices:${IMAGE_TAG:-latest}
    container_name: js_devices
    restart: always
    network_mode: "host"
    volumes:
      - /home/jsserver:/home/jsserver:rw
      - /etc/machine-id:/etc/machine-id:ro
      - /root/BitAnswer:/root/BitAnswer:rw
      - /home/dface/dface_sdk:/usr/local/dface_sdk:ro
      - /home/dface/dface_sdk/cxx/include/dface:/usr/local/include/dface:ro
      - /usr/local/jiasion/ssl:/usr/local/jiasion/ssl:ro
    extra_hosts:
      - "host-local:${HOST_IP}"
    command: >
      sh -c '
        echo "js_system 已启动成功，等待 5 秒后启动 js_devices...";
        sleep 5;
        echo "启动 websockify...";
         /usr/bin/python3 /usr/bin/websockify --key=/usr/local/jiasion/ssl/jiasion.net.key --cert=/usr/local/jiasion/ssl/jiasion.net.pem --target-config=/etc/jsvnc.conf 10000 &
        echo "websockify 已在后台启动，现在启动 js_devices...";
        exec /app/devices -conf /home/jsserver/config.yaml
      '
    depends_on:
      js_mongodb:
        condition: service_started
      js_redis:
        condition: service_started
      js_mosquitto:
        condition: service_started
      js_ntp:
        condition: service_started
      js_logsrv:
        condition: service_started
      js_system:
        condition: service_started
      js_users:
        condition: service_started
  # js_tasks 服务 - 使用 host 网络
  js_tasks:
    image: docker.jiasion.net/jiasion/tasks:${IMAGE_TAG:-latest}
    container_name: js_tasks
    restart: always
    network_mode: "host"
    volumes:
      - /home/jsserver:/home/jsserver:rw
      - /etc/machine-id:/etc/machine-id:ro
    extra_hosts:
      - "host-local:${HOST_IP}"
    command: ["/app/tasks", "-conf", "/home/jsserver/config.yaml"]
    depends_on:
      js_mongodb:
        condition: service_started
      js_redis:
        condition: service_started
      js_mosquitto:
        condition: service_started
      js_ntp:
        condition: service_started
      js_logsrv:
        condition: service_started
  #  js_plugin 服务 - 使用桥接网络
  js_plugin:
    image: docker.jiasion.net/jiasion/plugin:${IMAGE_TAG:-latest}
    container_name: js_plugin
    restart: always
    ports:
      - "8106:8106"
      - "9106:9106"
    volumes:
      - /home/jsserver:/home/jsserver:rw
      - /etc/machine-id:/etc/machine-id:ro
    networks:
      - jiasion-net
    extra_hosts:
      - "host-local:${HOST_IP}"
    command: ["/app/plugin", "-conf", "/home/jsserver/config.yaml"]
    depends_on:
      js_mongodb:
        condition: service_started
      js_redis:
        condition: service_started
      js_mosquitto:
        condition: service_started
      js_ntp:
        condition: service_started
      js_logsrv:
        condition: service_started
networks:
  jiasion-net:
    driver: bridge
EOF

$SUDO_CMD "$DOCKER_COMPOSE_BIN" -f "$SCRIPT_DIR/docker-compose-deploy.yml" --env-file "$SCRIPT_DIR/.env" up -d
echo "  新容器已启动"

# 测试 Nginx 配置
echo "测试 Nginx 配置..."
if $SUDO_CMD nginx -t; then
    echo -e "${GREEN}Nginx 配置测试通过${NC}"
    # 启动或重启 Nginx
    echo "启动 Nginx 服务..."
    $SUDO_CMD systemctl enable nginx
    if $SUDO_CMD systemctl is-active --quiet nginx 2>/dev/null; then
        $SUDO_CMD systemctl restart nginx
        echo -e "${GREEN}Nginx 服务已重启${NC}"
    else
        $SUDO_CMD systemctl start nginx
        echo -e "${GREEN}Nginx 服务已启动${NC}"
    fi
else
    echo -e "${RED}Nginx 配置测试失败，请检查配置文件${NC}"
fi

echo -e "${BLUE}==========================================${NC}"
echo -e "${BLUE}  容器运行状态${NC}"
echo -e "${BLUE}==========================================${NC}"
$SUDO_CMD "$DOCKER_COMPOSE_BIN" -f "$SCRIPT_DIR/docker-compose-deploy.yml" ps

echo -e "${BLUE}==========================================${NC}"
echo -e "${GREEN}  部署完成！${NC}"
echo -e "${BLUE}==========================================${NC}"