"""
Nginx 配置管理服务
负责读写 Nginx 配置文件、重载 Nginx

全局优化（在 /etc/nginx/nginx.conf http 块中）:
  - gzip + gzip_types（14种MIME）— 压缩传输
  - SSL session cache (10m) + timeout (60m) — 减少重复TLS握手
  - ssl_session_tickets off + ssl_buffer_size 4k

每个域名配置的优化:
  - listen 443 ssl http2 — HTTP/2 多路复用
  - proxy_buffering off — 边收边发，不阻塞
  - 静态资源 30天强缓存（public, immutable）
"""
import os
import re
import subprocess
import logging

logger = logging.getLogger(__name__)

# Nginx HTTP 配置模板
HTTP_TEMPLATE = """# Nginx转发规则 - {domain}
# 协议: HTTP
# 自动生成，请勿手动修改

server {{
    listen 80;
    server_name {domain};
    client_max_body_size 2048m;

    # 静态资源缓存（JS/CSS 带 hash，30天）
    location ~* \\.(js|css|svg|woff2|png|jpg|ico)$ {{
        expires 30d;
        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods \"GET, POST, PUT, DELETE, OPTIONS\" always;
        add_header Access-Control-Allow-Headers \"Content-Type, Authorization\" always;
        add_header Cache-Control \"public, immutable\";
        proxy_pass {target};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Connection \"\";
        proxy_set_header Accept-Encoding \"gzip\";
        proxy_connect_timeout 43200s;
        proxy_send_timeout 43200s;
        proxy_read_timeout 43200s;
        proxy_buffering off;
    }}

    location / {{
        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods \"GET, POST, PUT, DELETE, OPTIONS\" always;
        add_header Access-Control-Allow-Headers \"Content-Type, Authorization\" always;
        proxy_pass {target};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Connection \"\";
        proxy_set_header Accept-Encoding \"gzip\";

        proxy_connect_timeout 43200s;
        proxy_send_timeout 43200s;
        proxy_read_timeout 43200s;
        proxy_buffering off;
    }}
}}
"""

# Nginx HTTPS 配置模板
HTTPS_TEMPLATE = """# Nginx转发规则 - {domain}
# 协议: HTTPS
# 自动生成，请勿手动修改

# HTTP → HTTPS 重定向
server {{
    listen 80;
    server_name {domain};
    return 301 https://$host$request_uri;
}}

# HTTPS 服务
server {{
    listen 443 ssl http2;
    server_name {domain};

    # CORS 跨域响应头（server 级别，确保 OPTIONS 204 也带 CORS 头）
    add_header Access-Control-Allow-Origin * always;
    add_header Access-Control-Allow-Methods \"GET, POST, PUT, DELETE, OPTIONS\" always;
    add_header Access-Control-Allow-Headers \"Content-Type, Authorization\" always;

    # CORS 预检请求快速返回（避免穿透到后端）
    if ($request_method = OPTIONS) {{ return 204; }}

    ssl_certificate     {ssl_cert};
    ssl_certificate_key {ssl_key};
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # 静态资源缓存（JS/CSS 带 hash，30天）
    location ~* \\.(js|css|svg|woff2|png|jpg|ico)$ {{
        expires 30d;
        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods \"GET, POST, PUT, DELETE, OPTIONS\" always;
        add_header Access-Control-Allow-Headers \"Content-Type, Authorization\" always;
        add_header Cache-Control \"public, immutable\";
        proxy_pass {target};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Connection \"\";
        proxy_set_header Accept-Encoding \"gzip\";
        proxy_connect_timeout 43200s;
        proxy_send_timeout 43200s;
        proxy_read_timeout 43200s;
        proxy_buffering off;
    }}

    location / {{
        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods \"GET, POST, PUT, DELETE, OPTIONS\" always;
        add_header Access-Control-Allow-Headers \"Content-Type, Authorization\" always;
        proxy_pass {target};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Connection \"\";
        proxy_set_header Accept-Encoding \"gzip\";

        proxy_connect_timeout 43200s;
        proxy_send_timeout 43200s;
        proxy_read_timeout 43200s;
        proxy_buffering off;
    }}
}}
"""


class NginxService:
    """Nginx 配置管理服务"""

    def __init__(self, conf_dir='/etc/nginx/conf.d', ssl_dir='/etc/nginx/ssl'):
        self.conf_dir = conf_dir
        self.ssl_dir = ssl_dir
        # 确保目录存在
        os.makedirs(self.conf_dir, exist_ok=True)

    def create_config(self, domain, protocol, target, ssl_cert=None, ssl_key=None):
        """
        创建域名转发配置文件

        Args:
            domain: 域名
            protocol: 协议 (http/https)
            target: 转发目标地址
            ssl_cert: SSL证书路径（仅在HTTPS时需要）
            ssl_key: SSL私钥路径（仅在HTTPS时需要）

        Returns:
            config_file: 生成的配置文件路径
        """
        config_path = os.path.join(self.conf_dir, f'{domain}.conf')

        if protocol == 'https':
            content = HTTPS_TEMPLATE.format(
                domain=domain,
                target=target,
                ssl_cert=ssl_cert or f'{self.ssl_dir}/{domain}.pem',
                ssl_key=ssl_key or f'{self.ssl_dir}/{domain}.key'
            )
        else:
            content = HTTP_TEMPLATE.format(
                domain=domain,
                target=target
            )

        with open(config_path, 'w', encoding='utf-8') as f:
            f.write(content)

        logger.info(f"已创建配置文件: {config_path}")
        return config_path

    def delete_config(self, domain):
        """
        删除域名配置文件

        Args:
            domain: 域名

        Returns:
            bool: 是否成功删除
        """
        config_path = os.path.join(self.conf_dir, f'{domain}.conf')
        if os.path.exists(config_path):
            os.remove(config_path)
            logger.info(f"已删除配置文件: {config_path}")
            return True
        logger.warning(f"配置文件不存在: {config_path}")
        return False

    def list_rules(self):
        """
        解析所有 Nginx 配置文件，提取转发规则列表

        Returns:
            list[dict]: 规则列表
        """
        rules = []
        if not os.path.exists(self.conf_dir):
            return rules

        for filename in sorted(os.listdir(self.conf_dir)):
            if not filename.endswith('.conf'):
                continue

            filepath = os.path.join(self.conf_dir, filename)
            rule = self._parse_config(filepath)
            if rule:
                rules.append(rule)

        return rules

    def find_rule(self, domain):
        """
        查找指定域名的规则

        Args:
            domain: 域名

        Returns:
            dict | None: 规则信息
        """
        config_path = os.path.join(self.conf_dir, f'{domain}.conf')
        if not os.path.exists(config_path):
            return None
        return self._parse_config(config_path)

    def _parse_config(self, filepath):
        """
        解析单个 Nginx 配置文件

        Args:
            filepath: 配置文件路径

        Returns:
            dict | None: 解析出的规则信息
        """
        try:
            with open(filepath, 'r', encoding='utf-8') as f:
                content = f.read()

            rule = {
                'config_file': filepath
            }

            # 提取域名 (server_name)
            server_name_match = re.search(r'server_name\s+([^;]+);', content)
            if server_name_match:
                rule['domain'] = server_name_match.group(1).strip()

            # 提取转发目标 (proxy_pass)
            proxy_pass_match = re.search(r'proxy_pass\s+([^;]+);', content)
            if proxy_pass_match:
                rule['target'] = proxy_pass_match.group(1).strip()

            # 判断协议类型
            if 'listen 443 ssl' in content:
                rule['protocol'] = 'https'
                # 提取 SSL 证书路径
                cert_match = re.search(r'ssl_certificate\s+([^;]+);', content)
                if cert_match:
                    rule['ssl_cert'] = cert_match.group(1).strip()
                key_match = re.search(r'ssl_certificate_key\s+([^;]+);', content)
                if key_match:
                    rule['ssl_key'] = key_match.group(1).strip()
            else:
                rule['protocol'] = 'http'

            return rule
        except Exception as e:
            logger.error(f"解析配置文件失败 {filepath}: {e}")
            return None

    def check_config(self):
        """
        检查 Nginx 配置语法

        Returns:
            tuple: (是否通过, 错误信息)
        """
        try:
            result = subprocess.run(
                ['nginx', '-t'],
                stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                universal_newlines=True,
                timeout=10
            )
            if result.returncode == 0:
                return True, 'ok'
            else:
                error_msg = result.stderr.strip() or '配置语法错误'
                return False, error_msg
        except FileNotFoundError:
            return False, 'nginx 命令未找到，请确认 Nginx 已安装'
        except subprocess.TimeoutExpired:
            return False, 'nginx -t 执行超时'
        except Exception as e:
            return False, str(e)

    def reload(self):
        """
        重载 Nginx 配置

        Returns:
            tuple: (是否成功, 消息)
        """
        # 先检查配置语法
        valid, msg = self.check_config()
        if not valid:
            return False, f'配置语法检查失败: {msg}'

        # 执行 reload
        try:
            # 尝试 systemctl reload
            result = subprocess.run(
                ['systemctl', 'reload', 'nginx'],
                stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                universal_newlines=True,
                timeout=30
            )
            if result.returncode == 0:
                logger.info("Nginx 重载成功 (systemctl)")
                return True, 'Nginx 重载成功'

            # 回退到 nginx -s reload
            result = subprocess.run(
                ['nginx', '-s', 'reload'],
                stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                universal_newlines=True,
                timeout=30
            )
            if result.returncode == 0:
                logger.info("Nginx 重载成功 (nginx -s reload)")
                return True, 'Nginx 重载成功'

            error_msg = result.stderr.strip() or '未知错误'
            return False, f'重载失败: {error_msg}'
        except FileNotFoundError:
            return False, 'nginx 命令未找到'
        except subprocess.TimeoutExpired:
            return False, 'reload 执行超时'
        except Exception as e:
            return False, str(e)


    def parse_gzip_config(self, domain):
        """
        从配置文件中解析 gzip 压缩配置

        Args:
            domain: 域名

        Returns:
            dict: gzip 配置信息
        """
        config_path = os.path.join(self.conf_dir, f'{domain}.conf')
        if not os.path.exists(config_path):
            return {
                'enabled': False,
                'types': [],
                'comp_level': 6,
                'min_length': '1000'
            }

        with open(config_path, 'r', encoding='utf-8') as f:
            content = f.read()

        result = {
            'enabled': False,
            'types': [],
            'comp_level': 6,
            'min_length': '1000'
        }

        # 解析 gzip on/off
        gzip_match = re.search(r'^\s*gzip\s+(on|off)\s*;', content, re.MULTILINE)
        if gzip_match:
            result['enabled'] = gzip_match.group(1) == 'on'

        # 解析 gzip_types
        types_match = re.search(r'^\s*gzip_types\s+([^;]+);', content, re.MULTILINE)
        if types_match:
            types_str = types_match.group(1).strip()
            result['types'] = [t.strip() for t in types_str.split() if t.strip()]

        # 解析 gzip_comp_level
        level_match = re.search(r'^\s*gzip_comp_level\s+(\d+)\s*;', content, re.MULTILINE)
        if level_match:
            result['comp_level'] = int(level_match.group(1))

        # 解析 gzip_min_length
        length_match = re.search(r'^\s*gzip_min_length\s+(\S+)\s*;', content, re.MULTILINE)
        if length_match:
            result['min_length'] = length_match.group(1).strip()

        return result

    def set_gzip_config(self, domain, gzip_config):
        """
        修改配置文件中的 gzip 压缩配置（在 server 块内添加/更新 gzip 指令）

        Args:
            domain: 域名
            gzip_config: dict with keys:
                - enabled (bool): 是否开启
                - types (list[str]): MIME 类型列表
                - comp_level (int): 压缩级别 1-9
                - min_length (str): 最小压缩长度

        Returns:
            tuple: (成功, 消息)
        """
        config_path = os.path.join(self.conf_dir, f'{domain}.conf')
        if not os.path.exists(config_path):
            return False, f'域名 {domain} 的配置文件不存在'

        # 读取原内容
        with open(config_path, 'r', encoding='utf-8') as f:
            original_content = f.read()

        content = original_content

        # 1. 删除 server 块内所有已有的 gzip 指令（包括注释行）
        content = re.sub(r'^\s*#\s*内容压缩[^\n]*\n?', '', content, flags=re.MULTILINE)
        content = re.sub(r'^\s*gzip\s+(on|off)\s*;\s*\n?', '', content, flags=re.MULTILINE)
        content = re.sub(r'^\s*gzip_types\s+[^;]+;\s*\n?', '', content, flags=re.MULTILINE)
        content = re.sub(r'^\s*gzip_comp_level\s+\d+\s*;\s*\n?', '', content, flags=re.MULTILINE)
        content = re.sub(r'^\s*gzip_min_length\s+\S+\s*;\s*\n?', '', content, flags=re.MULTILINE)

        # 2. 构建新的 gzip 指令块
        gzip_lines = []
        if gzip_config.get('enabled', False):
            gzip_lines.append('    # 内容压缩（gzip）')
            gzip_lines.append('    gzip on;')

            types = gzip_config.get('types', [])
            if types:
                types_str = ' '.join(types)
                gzip_lines.append(f'    gzip_types {types_str};')

            comp_level = gzip_config.get('comp_level', 6)
            gzip_lines.append(f'    gzip_comp_level {comp_level};')

            min_length = gzip_config.get('min_length', '1000')
            gzip_lines.append(f'    gzip_min_length {min_length};')
        else:
            gzip_lines.append('    # 内容压缩（gzip）')
            gzip_lines.append('    gzip off;')

        gzip_block = '\n'.join(gzip_lines) + '\n'

        # 3. 在 server_name 行之后插入 gzip 指令块
        #    匹配 server_name xxx; 并在其后插入
        def insert_gzip(match):
            return match.group(0) + '\n' + gzip_block

        content = re.sub(
            r'^\s*server_name\s+[^;]+;\s*$',
            insert_gzip,
            content,
            flags=re.MULTILINE
        )

        # 4. 写入文件
        with open(config_path, 'w', encoding='utf-8') as f:
            f.write(content)

        logger.info(f"已更新 {domain} 的 gzip 压缩配置: enabled={gzip_config.get('enabled')}")

        # 5. 语法检查
        valid, msg = self.check_config()
        if not valid:
            # 回滚
            with open(config_path, 'w', encoding='utf-8') as f:
                f.write(original_content)
            logger.error(f"gzip 配置语法错误，已回滚: {msg}")
            return False, f'配置语法检查失败，已自动回滚: {msg}'

        # 6. 重载 Nginx
        reload_success, reload_msg = self.reload()
        if not reload_success:
            logger.warning(f"Nginx 重载失败: {reload_msg}")
            return False, f'gzip 配置已写入但重载失败: {reload_msg}'

        return True, 'gzip 压缩配置已保存并生效'

    def get_domain_logs(self, domain, lines=200):
        """
        获取指定域名的 Nginx 访问日志和错误日志

        Args:
            domain: 域名
            lines: 返回最近多少行日志（默认200）

        Returns:
            dict: access_log 和 error_log 内容
        """
        result = {
            'domain': domain,
            'access_log': '',
            'error_log': '',
            'access_log_path': '/var/log/nginx/access.log',
            'error_log_path': '/var/log/nginx/error.log'
        }

        # 访问日志 — 过滤包含域名的行
        access_log_path = '/var/log/nginx/access.log'
        if os.path.exists(access_log_path):
            try:
                # 使用 tail + grep 获取最近包含域名的日志行
                import subprocess as _sp
                proc = _sp.run(
                    ['tail', '-n', str(lines * 5), access_log_path],
                    stdout=_sp.PIPE, stderr=_sp.PIPE,
                    universal_newlines=True, timeout=10
                )
                if proc.returncode == 0:
                    all_lines = proc.stdout.splitlines()
                    matched = [l for l in all_lines if domain in l]
                    result['access_log'] = '\n'.join(matched[-lines:])
            except Exception as e:
                logger.warning(f"读取访问日志失败: {e}")
                result['access_log'] = f'[读取失败] {e}'

        # 错误日志 — 过滤包含域名的行
        error_log_path = '/var/log/nginx/error.log'
        if os.path.exists(error_log_path):
            try:
                import subprocess as _sp
                proc = _sp.run(
                    ['tail', '-n', str(lines * 5), error_log_path],
                    stdout=_sp.PIPE, stderr=_sp.PIPE,
                    universal_newlines=True, timeout=10
                )
                if proc.returncode == 0:
                    all_lines = proc.stdout.splitlines()
                    matched = [l for l in all_lines if domain in l]
                    result['error_log'] = '\n'.join(matched[-lines:])
            except Exception as e:
                logger.warning(f"读取错误日志失败: {e}")
                result['error_log'] = f'[读取失败] {e}'

        return result


def _escape_nginx(content):
    """转义 Nginx 配置中的特殊字符（模板用）"""
    return content