deploy-frp-server.sh

#!/bin/bash

# =============================================================================
# FRP Server 自动部署脚本 (Ubuntu 24)
# 用途：在阿里云服务器上自动部署 frp 服务端
# 域名：frp.example.com (指定二级域名)
# 端口：17777 (不常见端口，避免被扫描)
# =============================================================================

set -e

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# 配置变量 - 可根据需要修改
FRP_VERSION="0.67.0"
FRP_BASE="/opt/frp"              # 基础目录（存放 tar 包、脚本）
FRP_INSTALL="${FRP_BASE}/server"  # 程序安装目录（可安全删除）
FRP_PORT="17777"                  # frpc 连接端口
VHOST_HTTP_PORT="18080"           # HTTP 虚拟主机端口（nginx 反向代理到此端口）
DASHBOARD_PORT="17778"
DASHBOARD_USER="admin"
CREDENTIALS_FILE="${FRP_BASE}/.credentials"

# 域名配置
SERVER_IP="${SERVER_IP:-47.1.1.1}"
DOMAIN="${DOMAIN:-frp.example.com}"

# 日志函数
log_info() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

log_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

log_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# 检查 root 权限
check_root() {
    if [[ $EUID -ne 0 ]]; then
        log_error "请使用 sudo 或 root 权限运行此脚本"
        exit 1
    fi
}

# 加载或生成凭据
load_or_generate_credentials() {
    mkdir -p "$FRP_BASE"

    if [[ -f "$CREDENTIALS_FILE" ]]; then
        log_info "加载已有凭据..."
        source "$CREDENTIALS_FILE"
        log_success "凭据加载成功"
    else
        log_info "生成新凭据..."
        TOKEN="$(openssl rand -base64 24)"
        DASHBOARD_PASS="$(openssl rand -base64 12)"

        # 保存凭据
        cat > "$CREDENTIALS_FILE" << EOF
TOKEN="${TOKEN}"
DASHBOARD_PASS="${DASHBOARD_PASS}"
EOF
        chmod 600 "$CREDENTIALS_FILE"
        log_success "新凭据已生成并保存"
    fi
}

# 检查现有安装
check_existing_installation() {
    if systemctl is-active --quiet frps 2>/dev/null; then
        echo ""
        log_warning "检测到 FRP 服务端已在运行"
        echo ""
        echo "请选择操作："
        echo "  1) 查看状态并退出"
        echo "  2) 重启服务"
        echo "  3) 重新配置（保留凭据）"
        echo "  4) 完全卸载并重新安装"
        echo "  5) 卸载并退出"
        echo ""
        read -rp "请输入选项 [1-5]: " choice

        case $choice in
            1)
                show_status
                exit 0
                ;;
            2)
                log_info "重启服务..."
                systemctl restart frps
                sleep 2
                show_status
                exit 0
                ;;
            3)
                log_info "重新配置..."
                systemctl stop frps 2>/dev/null || true
                return 0
                ;;
            4)
                log_info "完全卸载..."
                uninstall_frp
                # 清除凭据，让后续步骤生成新的
                rm -f "$CREDENTIALS_FILE"
                return 0
                ;;
            5)
                uninstall_frp
                exit 0
                ;;
            *)
                log_error "无效选项"
                exit 1
                ;;
        esac
    elif [[ -f "${FRP_INSTALL}/frps" ]]; then
        log_warning "检测到已安装 FRP 但服务未运行"
        read -rp "是否继续配置并启动服务? [Y/n]: " confirm
        if [[ "$confirm" =~ ^[Nn]$ ]]; then
            exit 0
        fi
    fi
}

# 显示服务状态
show_status() {
    echo ""
    echo "=========================================="
    echo -e "${BLUE}FRP 服务端状态${NC}"
    echo "=========================================="
    systemctl status frps --no-pager || true
    echo ""
    echo -e "${BLUE}最近日志:${NC}"
    journalctl -u frps -n 10 --no-pager || true
    echo ""

    if [[ -f "$CREDENTIALS_FILE" ]]; then
        source "$CREDENTIALS_FILE"
        echo -e "${BLUE}连接信息:${NC}"
        echo "  服务器: ${SERVER_IP}:${FRP_PORT}"
        echo "  Token: ${TOKEN}"
        echo "  Dashboard: http://${SERVER_IP}:${DASHBOARD_PORT}"
        echo "  用户名: ${DASHBOARD_USER}"
        echo "  密码: ${DASHBOARD_PASS}"
    fi
}

# 卸载 FRP
uninstall_frp() {
    log_info "停止并禁用服务..."
    systemctl stop frps 2>/dev/null || true
    systemctl disable frps 2>/dev/null || true

    log_info "删除服务文件..."
    rm -f /etc/systemd/system/frps.service
    systemctl daemon-reload

    log_info "删除安装目录 ${FRP_INSTALL}..."
    rm -rf "${FRP_INSTALL}"

    log_info "删除符号链接..."
    rm -f /usr/local/bin/frps /usr/local/bin/frpc

    log_info "删除日志文件..."
    rm -f /var/log/frps.log

    log_success "FRP 已完全卸载（${FRP_BASE} 目录下的 tar 包和脚本已保留）"
}

# 安装依赖
install_dependencies() {
    log_info "检查并安装必要的依赖..."

    # 检查是否已安装必要的工具
    local missing_deps=()
    for cmd in wget curl tar openssl; do
        if ! command -v $cmd &>/dev/null; then
            missing_deps+=($cmd)
        fi
    done

    if [[ ${#missing_deps[@]} -gt 0 ]]; then
        apt-get update
        apt-get install -y "${missing_deps[@]}"
    fi

    log_success "依赖检查完成"
}

# 下载并安装 FRP
download_frp() {
    # 检测系统架构
    ARCH=$(uname -m)
    case $ARCH in
        x86_64)
            FRP_ARCH="linux_amd64"
            ;;
        aarch64)
            FRP_ARCH="linux_arm64"
            ;;
        armv7l)
            FRP_ARCH="linux_arm"
            ;;
        *)
            log_error "不支持的架构: $ARCH"
            exit 1
            ;;
    esac

    SCRIPT_DIR="$(pwd)"
    LOCAL_FILE=""
    LOCAL_VERSION=""

    # 优先查找当前目录的本地 frp 包（匹配架构，取版本最新的）
    LATEST_LOCAL=$(ls -1 "${SCRIPT_DIR}"/frp_*_${FRP_ARCH}.tar.gz 2>/dev/null | sort -V | tail -1)
    if [[ -n "$LATEST_LOCAL" ]]; then
        LOCAL_FILE="$LATEST_LOCAL"
        LOCAL_VERSION=$(basename "$LOCAL_FILE" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
        log_success "找到本地安装包: $(basename "$LOCAL_FILE") (版本 ${LOCAL_VERSION})"
    fi

    # 检查是否已安装且版本匹配
    if [[ -f "${FRP_INSTALL}/frps" ]]; then
        INSTALLED_VERSION=$(${FRP_INSTALL}/frps -v 2>&1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || echo "unknown")
        # 如果有本地文件，以本地文件版本为准；否则以脚本定义的版本为准
        TARGET_VERSION="${LOCAL_VERSION:-$FRP_VERSION}"
        if [[ "$INSTALLED_VERSION" == "$TARGET_VERSION" ]]; then
            log_info "FRP v${INSTALLED_VERSION} 已安装且版本一致，跳过下载"
            FRP_VERSION="$INSTALLED_VERSION"
            return 0
        else
            log_warning "已安装版本 ${INSTALLED_VERSION}，目标版本 ${TARGET_VERSION}，将重新安装"
        fi
    fi

    # 有本地文件则优先使用
    if [[ -n "$LOCAL_FILE" ]]; then
        FRP_VERSION="$LOCAL_VERSION"
        FRP_FILE="frp_${FRP_VERSION}_${FRP_ARCH}.tar.gz"
        log_info "使用本地安装包: $(basename "$LOCAL_FILE")"
        cp "$LOCAL_FILE" "/tmp/${FRP_FILE}"
    else
        # 本地没有，从网络下载
        FRP_FILE="frp_${FRP_VERSION}_${FRP_ARCH}.tar.gz"
        log_info "本地未找到安装包，从网络下载 FRP v${FRP_VERSION}..."
        DOWNLOAD_URL="https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/${FRP_FILE}"

        cd /tmp
        if ! wget --timeout=30 -q --show-progress "$DOWNLOAD_URL" 2>/dev/null; then
            log_warning "GitHub 下载失败，尝试镜像..."
            MIRROR_URLS=(
                "https://ghproxy.com/https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/${FRP_FILE}"
                "https://mirror.ghproxy.com/https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/${FRP_FILE}"
            )

            DOWNLOAD_SUCCESS=false
            for MIRROR_URL in "${MIRROR_URLS[@]}"; do
                log_info "尝试: $MIRROR_URL"
                if wget --timeout=60 -q --show-progress "$MIRROR_URL" 2>/dev/null; then
                    DOWNLOAD_SUCCESS=true
                    break
                fi
            done

            if [[ "$DOWNLOAD_SUCCESS" != true ]]; then
                log_error "下载失败，请手动下载 ${FRP_FILE} 放在脚本同目录后重试"
                exit 1
            fi
        fi
    fi

    cd /tmp
    log_info "解压 FRP v${FRP_VERSION}..."
    tar -xzf "$FRP_FILE"

    log_info "安装到 $FRP_INSTALL..."
    mkdir -p "$FRP_INSTALL"
    cp -r "frp_${FRP_VERSION}_${FRP_ARCH}"/* "$FRP_INSTALL/"

    # 创建符号链接
    ln -sf "$FRP_INSTALL/frps" /usr/local/bin/frps
    ln -sf "$FRP_INSTALL/frpc" /usr/local/bin/frpc

    # 清理临时文件
    rm -rf "/tmp/frp_${FRP_VERSION}_${FRP_ARCH}" "/tmp/${FRP_FILE}"

    log_success "FRP v${FRP_VERSION} 安装完成"
}

# 创建配置文件
create_config() {
    log_info "创建 FRP 服务端配置..."

    cat > "${FRP_INSTALL}/frps.toml" << EOF
# FRP Server 配置 (v${FRP_VERSION})
# 官方文档: https://gofrp.org/zh-cn/docs/reference/server-config/

# 基础配置
bindPort = ${FRP_PORT}
vhostHTTPPort = ${VHOST_HTTP_PORT}
subDomainHost = "example.com"

# 允许代理的端口范围
allowPorts = [
    { start = 10000, end = 20000 }
]

# 鉴权配置
auth.method = "token"
auth.token = "${TOKEN}"

# Web 管理面板
webServer.addr = "0.0.0.0"
webServer.port = ${DASHBOARD_PORT}
webServer.user = "${DASHBOARD_USER}"
webServer.password = "${DASHBOARD_PASS}"

# 网络层配置
transport.heartbeatTimeout = 90
transport.maxPoolCount = 50

# 日志配置
log.to = "/var/log/frps.log"
log.level = "info"
log.maxDays = 30
EOF

    log_success "配置文件创建完成: ${FRP_INSTALL}/frps.toml"
}

# 生成 nginx 配置
generate_nginx_config() {
    log_info "生成 nginx 配置文件..."

    cat > "${FRP_INSTALL}/nginx-frp.conf" << 'EOF'
# Nginx 配置 - FRP HTTP 代理
# 将此文件复制到 /etc/nginx/conf.d/ 或 include 到 nginx.conf
# 然后执行: nginx -t && systemctl reload nginx

server {
    listen 80;
    server_name frp.example.com *.frp.example.com;

    location / {
        proxy_pass http://127.0.0.1:VHOST_HTTP_PORT;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket 支持
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # 超时设置
        proxy_connect_timeout 60s;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
    }
}
EOF

    # 替换端口变量
    sed -i "s/VHOST_HTTP_PORT/${VHOST_HTTP_PORT}/g" "${FRP_INSTALL}/nginx-frp.conf"

    log_success "nginx 配置已生成: ${FRP_INSTALL}/nginx-frp.conf"
}

# 配置防火墙
setup_firewall() {
    log_info "配置防火墙规则..."

    if command -v ufw &>/dev/null && ufw status | grep -q "Status: active"; then
        ufw allow ${FRP_PORT}/tcp comment "FRP Server" 2>/dev/null || true
        ufw allow ${DASHBOARD_PORT}/tcp comment "FRP Dashboard" 2>/dev/null || true
        log_success "UFW 防火墙规则已添加"
    else
        log_warning "UFW 未启用，跳过防火墙配置"
    fi

    echo ""
    log_warning "请确保在阿里云安全组中放行以下端口："
    echo "  - TCP ${FRP_PORT} (FRP 客户端连接端口)"
    echo "  - TCP ${VHOST_HTTP_PORT} (HTTP 虚拟主机端口，或用 nginx 反代)"
    echo "  - TCP ${DASHBOARD_PORT} (FRP 仪表盘)"
    echo "  - TCP 10000-20000 (TCP 代理端口范围，按需开放)"
}

# 创建 systemd 服务
create_systemd_service() {
    log_info "创建 systemd 服务..."

    cat > /etc/systemd/system/frps.service << EOF
[Unit]
Description=FRP Server Service
After=network.target

[Service]
Type=simple
User=root
Restart=on-failure
RestartSec=5s
ExecStart=${FRP_INSTALL}/frps -c ${FRP_INSTALL}/frps.toml
ExecReload=/bin/kill -HUP \$MAINPID
LimitNOFILE=1048576

[Install]
WantedBy=multi-user.target
EOF

    systemctl daemon-reload
    systemctl enable frps
    log_success "systemd 服务创建完成"
}

# 启动服务
start_service() {
    log_info "启动 FRP 服务端..."
    systemctl start frps

    sleep 2
    if systemctl is-active --quiet frps; then
        log_success "FRP 服务端启动成功"
    else
        log_error "FRP 服务端启动失败"
        echo ""
        echo "错误日志："
        journalctl -u frps -n 20 --no-pager
        exit 1
    fi
}

# 生成客户端配置模板
generate_client_config() {
    log_info "生成客户端配置模板..."

    cat > "${FRP_INSTALL}/frpc-template.toml" << EOF
# FRP 客户端配置模板
# 请将此文件复制到本地电脑使用

serverAddr = "${SERVER_IP}"
serverPort = ${FRP_PORT}
auth.token = "${TOKEN}"

# 日志配置
log.to = "./frpc.log"
log.level = "info"
log.maxDays = 7

# ========== Web 服务示例 ==========
[[proxies]]
name = "web-local"
type = "http"
localPort = 3000
subdomain = "frp"

# ========== SSH 服务示例 ==========
[[proxies]]
name = "ssh-local"
type = "tcp"
localPort = 22
remotePort = 10022
EOF

    log_success "客户端配置模板: ${FRP_INSTALL}/frpc-template.toml"
}

# 显示完成信息
show_completion_info() {
    echo ""
    echo "=========================================="
    echo -e "${GREEN}FRP 服务端部署完成${NC}"
    echo "=========================================="
    echo ""
    echo -e "${BLUE}连接信息:${NC}"
    echo "  服务器地址: ${SERVER_IP}"
    echo "  服务端口: ${FRP_PORT}"
    echo "  认证令牌: ${TOKEN}"
    echo ""
    echo -e "${BLUE}仪表盘:${NC}"
    echo "  地址: http://${SERVER_IP}:${DASHBOARD_PORT}"
    echo "  用户名: ${DASHBOARD_USER}"
    echo "  密码: ${DASHBOARD_PASS}"
    echo ""
    echo -e "${BLUE}配置路径:${NC}"
    echo "  服务端配置: ${FRP_INSTALL}/frps.toml"
    echo "  客户端模板: ${FRP_INSTALL}/frpc-template.toml"
    echo "  nginx 配置: ${FRP_INSTALL}/nginx-frp.conf"
    echo "  凭据文件: ${CREDENTIALS_FILE}"
    echo ""
    echo -e "${BLUE}常用命令:${NC}"
    echo "  查看状态: systemctl status frps"
    echo "  查看日志: journalctl -u frps -f"
    echo "  重启服务: systemctl restart frps"
    echo "  停止服务: systemctl stop frps"
    echo ""
    echo -e "${YELLOW}重要 - 配置 Nginx:${NC}"
    echo "  FRP HTTP 端口: ${VHOST_HTTP_PORT}"
    echo "  执行以下命令启用 nginx 反向代理:"
    echo "    cp ${FRP_INSTALL}/nginx-frp.conf /etc/nginx/conf.d/"
    echo "    nginx -t && systemctl reload nginx"
    echo ""
    echo -e "${YELLOW}其他提醒:${NC}"
    echo "  1. 确保阿里云安全组已放行端口 ${FRP_PORT} 和 ${DASHBOARD_PORT}"
    echo "  2. 确保 DNS 已配置 ${DOMAIN} -> ${SERVER_IP}"
    echo "=========================================="
}

# 主函数
main() {
    echo "=========================================="
    echo -e "${GREEN}FRP Server 自动部署脚本${NC}"
    echo "=========================================="
    echo ""

    check_root
    check_existing_installation
    load_or_generate_credentials
    install_dependencies
    download_frp
    create_config
    generate_nginx_config
    setup_firewall
    create_systemd_service
    start_service
    generate_client_config
    show_completion_info

    log_success "部署完成"
}

# 执行主函数
main "$@"