import base64
import binascii
import hashlib
import json
import os
import fcntl
import re
import shutil
import socket
import subprocess
import sys
import time
import datetime
from pathlib import Path

import requests

APACHE_CONF_DIRS = [
    "/www/server/panel/vhost/apache"
]

def is_ipv4(ip):
    '''
        @name 是否是IPV4地址
        @author hwliang
        @param ip<string> IP地址
        @return True/False
    '''
    # 验证基本格式
    if not re.match(r"^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$", ip):
        return False

    # 验证每个段是否在合理范围
    try:
        socket.inet_pton(socket.AF_INET, ip)
    except AttributeError:
        try:
            socket.inet_aton(ip)
        except socket.error:
            return False
    except socket.error:
        return False
    return True


def is_ipv6(ip):
    '''
        @name 是否为IPv6地址
        @author hwliang
        @param ip<string> 地址
        @return True/False
    '''
    # 验证基本格式
    if not re.match(r"^[\w:]+$", ip):
        return False

    # 验证IPv6地址
    try:
        socket.inet_pton(socket.AF_INET6, ip)
    except socket.error:
        return False
    return True


def check_ip(ip):
    return is_ipv4(ip) or is_ipv6(ip)

def find_apache_conf_files(keyword):
    """查找 Apache 主配置和 vhost 文件"""
    files = set()
    for base in APACHE_CONF_DIRS:
        base_path = Path(base)
        if not base_path.exists():
            continue
        for f in base_path.rglob("*.conf"):
            with open(f, "r") as file:
                content = file.read()
                # 检查是否包含 ServerName 或 ServerAlias 指令
                if keyword in content:
                    files.add(str(f))
    return list(files)


def insert_location_into_vhost(file_path, keyword, verify_file):
    LOCATION_BLOCK = [
        "    <Location /.well-known/acme-challenge/{}>\n".format(verify_file),
        "        Require all granted\n",
        "        Header set Content-Type \"text/plain\"\n",
        "    </Location>\n",
        "    Alias /.well-known/acme-challenge/{} /tmp/{}\n".format(verify_file, verify_file),
    ]

    path = Path(file_path)
    backup = path.with_suffix(path.suffix + ".bak")
    shutil.copy(path, backup)

    with open(path, "r") as f:
        lines = f.readlines()

    new_lines = []
    in_vhost = False
    hit_vhost = False
    location_exists = False

    for line in lines:
        stripped = line.strip()

        if stripped.lower().startswith("<virtualhost"):
            in_vhost = True
            hit_vhost = False
            location_exists = False

        if in_vhost:
            low = stripped.lower()
            if (low.startswith("servername") or low.startswith("serveralias")) and keyword in stripped:
                hit_vhost = True

            if "<location /.well-known/acme-challenge/>" in low:
                location_exists = True

            if stripped.lower() == "</virtualhost>":
                if hit_vhost and not location_exists:
                    new_lines.extend(LOCATION_BLOCK)
                in_vhost = False

        new_lines.append(line)

    with open(path, "w") as f:
        f.writelines(new_lines)

    return True

def find_nginx_files_by_servername(keyword):
    """通过 nginx -T 找到包含 server_name 的配置文件"""
    result = subprocess.run(
        ["nginx", "-T"],
        stderr=subprocess.STDOUT,
        stdout=subprocess.PIPE,
        text=True,
        check=True
    )

    files = set()
    current_file = None

    for line in result.stdout.splitlines():
        if line.startswith("# configuration file"):
            current_file = line.split()[-1].rstrip(":")
        if "server_name" in line and keyword in line:
            if current_file:
                files.add(current_file)

    return list(files)

def insert_location_into_server(file_path, keyword, verify_file, verify_content):
    path = Path(file_path)
    backup = path.with_suffix(path.suffix + ".bak")

    shutil.copy(path, backup)

    with open(path, "r") as f:
        lines = f.readlines()

    new_lines = []
    brace_level = 0
    in_server = False
    hit_server = False
    location_exists = False

    LOCATION_BLOCK = [
        "    location = /.well-known/acme-challenge/{} {{\n".format(verify_file),
        "        default_type text/plain;\n",
        "        return 200 \"{}\";\n".format(verify_content),
        "    }\n"
    ]

    for i, line in enumerate(lines):
        stripped = line.strip()

        # server 开始
        if stripped.startswith("server"):
            in_server = True
            hit_server = False
            location_exists = False

        if in_server:
            brace_level += line.count("{")
            brace_level -= line.count("}")

            if "server_name" in line and keyword in line:
                hit_server = True

            if "location /.well-known/acme-challenge/" in line:
                location_exists = True

            # server 结束
            if brace_level == 0:
                if hit_server and not location_exists:
                    new_lines.extend(LOCATION_BLOCK)
                in_server = False

        new_lines.append(line)

    with open(path, "w") as f:
        f.writelines(new_lines)

    return True

class AutoApplyIPSSL:
    # 请求到ACME接口
    def __init__(self):
        self._wait_time = 5
        self._max_check_num = 15
        self._url = 'https://acme-v02.api.letsencrypt.org/directory'
        self._bits = 2048
        self._conf_file_v2 = '/www/server/panel/config/letsencrypt_v2.json'
        self._apis = None
        self._replay_nonce = None
        self._config = self.read_config()


    # 取接口目录
    def get_apis(self):
        if not self._apis:
            # 尝试从配置文件中获取
            api_index = "Production"
            if not 'apis' in self._config:
                self._config['apis'] = {}
            if api_index in self._config['apis']:
                if 'expires' in self._config['apis'][api_index] and 'directory' in self._config['apis'][api_index]:
                    if time.time() < self._config['apis'][api_index]['expires']:
                        self._apis = self._config['apis'][api_index]['directory']
                        return self._apis

            # 尝试从云端获取
            res = requests.get(self._url)
            if not res.status_code in [200, 201]:
                result = res.json()
                if "type" in result:
                    if result['type'] == 'urn:acme:error:serverInternal':
                        raise Exception('Service is closed for maintenance or internal error occurred, check <a href="https://letsencrypt.status.io/" target="_blank" class="btlink">https://letsencrypt.status.io/</a> .')
                raise Exception(res.content)
            s_body = res.json()
            self._apis = {}
            self._apis['newAccount'] = s_body['newAccount']
            self._apis['newNonce'] = s_body['newNonce']
            self._apis['newOrder'] = s_body['newOrder']
            self._apis['revokeCert'] = s_body['revokeCert']
            self._apis['keyChange'] = s_body['keyChange']

            # 保存到配置文件
            self._config['apis'][api_index] = {}
            self._config['apis'][api_index]['directory'] = self._apis
            self._config['apis'][api_index]['expires'] = time.time() + \
                86400  # 24小时后过期
            self.save_config()
        return self._apis

    def acme_request(self, url, payload):
        headers = {}
        payload = self.stringfy_items(payload)

        if payload == "":
            payload64 = payload
        else:
            payload64 = self.calculate_safe_base64(json.dumps(payload))
        protected = self.get_acme_header(url)
        protected64 = self.calculate_safe_base64(json.dumps(protected))
        signature = self.sign_message(
            message="{0}.{1}".format(protected64, payload64))  # bytes
        signature64 = self.calculate_safe_base64(signature)  # str
        data = json.dumps(
            {"protected": protected64, "payload": payload64,
                "signature": signature64}
        )
        headers.update({"Content-Type": "application/jose+json"})
        response = requests.post(url, data=data.encode("utf8"), headers=headers)
        # 更新随机数
        self.update_replay_nonce(response)
        return response

    # 更新随机数
    def update_replay_nonce(self, res):
        replay_nonce = res.headers.get('Replay-Nonce')
        if replay_nonce:
            self._replay_nonce = replay_nonce

    def stringfy_items(self, payload):
        if isinstance(payload, str):
            return payload

        for k, v in payload.items():
            if isinstance(k, bytes):
                k = k.decode("utf-8")
            if isinstance(v, bytes):
                v = v.decode("utf-8")
            payload[k] = v
        return payload

    # 转为无填充的Base64
    def calculate_safe_base64(self, un_encoded_data):
        if sys.version_info[0] == 3:
            if isinstance(un_encoded_data, str):
                un_encoded_data = un_encoded_data.encode("utf8")
        r = base64.urlsafe_b64encode(un_encoded_data).rstrip(b"=")
        return r.decode("utf8")

    # 获请ACME请求头
    def get_acme_header(self, url):
        header = {"alg": "RS256", "nonce": self.get_nonce(), "url": url}
        if url in [self._apis['newAccount'], 'GET_THUMBPRINT']:
            from cryptography.hazmat.backends import default_backend
            from cryptography.hazmat.primitives import serialization
            private_key = serialization.load_pem_private_key(
                self.get_account_key().encode(),
                password=None,
                backend=default_backend(),
            )
            public_key_public_numbers = private_key.public_key().public_numbers()

            exponent = "{0:x}".format(public_key_public_numbers.e)
            exponent = "0{0}".format(exponent) if len(
                exponent) % 2 else exponent
            modulus = "{0:x}".format(public_key_public_numbers.n)
            jwk = {
                "kty": "RSA",
                "e": self.calculate_safe_base64(binascii.unhexlify(exponent)),
                "n": self.calculate_safe_base64(binascii.unhexlify(modulus)),
            }
            header["jwk"] = jwk
        else:
            header["kid"] = self.get_kid()
        return header

    def get_nonce(self, force=False):
        # 如果没有保存上一次的随机数或force=True时则重新获取新的随机数
        if not self._replay_nonce or force:
            response = requests.get(
                self._apis['newNonce'],
            )
            self._replay_nonce = response.headers["Replay-Nonce"]
        return self._replay_nonce

    def analysis_private_key(self, key_pem, password=None):
        """
        解析私钥
        :param key_pem: 私钥内容
        :param password: 私钥密码
        :return: 私钥对象
        """
        try:
            from cryptography.hazmat.backends import default_backend
            from cryptography.hazmat.primitives import serialization
            private_key = serialization.load_pem_private_key(
                key_pem.encode(),
                password=password,
                backend=default_backend()
            )
            return private_key
        except:
            return None

    def sign_message(self, message):
        from cryptography.hazmat.primitives import hashes
        from cryptography.hazmat.primitives.asymmetric import padding

        pk = self.analysis_private_key(self.get_account_key())
        return pk.sign(message.encode("utf8"), padding.PKCS1v15(), hashes.SHA256())

    # 获用户取密钥对
    def get_account_key(self):
        if not 'account' in self._config:
            self._config['account'] = {}
        k = "Production"
        if not k in self._config['account']:
            self._config['account'][k] = {}

        if not 'key' in self._config['account'][k]:
            self._config['account'][k]['key'] = self.create_key()
            if type(self._config['account'][k]['key']) == bytes:
                self._config['account'][k]['key'] = self._config['account'][k]['key'].decode()
            self.save_config()
        return self._config['account'][k]['key']

    def create_key(self, key_type='RSA'):
        from cryptography.hazmat.primitives import serialization
        from cryptography.hazmat.primitives.asymmetric import rsa, ec, ed25519

        if key_type == 'RSA':
            private_key = rsa.generate_private_key(
                public_exponent=65537,
                key_size=self._bits
            )
        elif key_type == 'EC':
            private_key = ec.generate_private_key(ec.SECP256R1())
        elif key_type == 'ED25519':
            private_key = ed25519.Ed25519PrivateKey.generate()
        else:
            raise ValueError(f"Unsupported key type: {key_type}")

        private_key_pem = private_key.private_bytes(
            encoding=serialization.Encoding.PEM,
            format=serialization.PrivateFormat.PKCS8,
            encryption_algorithm=serialization.NoEncryption()
        )
        return private_key_pem

    def get_kid(self, force=False):
        #如果配置文件中不存在kid或force = True时则重新注册新的acme帐户
        if not 'account' in self._config:
            self._config['account'] = {}
        k = "Production"
        if not k in self._config['account']:
            self._config['account'][k] = {}

        if not 'kid' in self._config['account'][k]:
            self._config['account'][k]['kid'] = self.register()
            self.save_config()
            time.sleep(3)
            self._config = self.read_config()
        return self._config['account'][k]['kid']

    # 读配置文件
    def read_config(self):
        if not os.path.exists(self._conf_file_v2):
            self._config = {'orders': {}, 'account': {}, 'apis': {}, 'email': None}
            self.save_config()
            return self._config
        with open(self._conf_file_v2, 'r') as f:
            fcntl.flock(f, fcntl.LOCK_SH)  # 加锁
            tmp_config = f.read()
            fcntl.flock(f, fcntl.LOCK_UN)  # 解锁
            f.close()
        if not tmp_config:
            return self._config
        try:
            self._config = json.loads(tmp_config)
        except:
            self.save_config()
            return self._config
        return self._config

    # 写配置文件
    def save_config(self):
        fp = open(self._conf_file_v2, 'w+')
        fcntl.flock(fp, fcntl.LOCK_EX)  # 加锁
        fp.write(json.dumps(self._config))
        fcntl.flock(fp, fcntl.LOCK_UN)  # 解锁
        fp.close()
        return True

    # 注册acme帐户
    def register(self, existing=False):
        if not 'email' in self._config:
            self._config['email'] = 'demo@yakpanel.com'
        if existing:
            payload = {"onlyReturnExisting": True}
        elif self._config['email']:
            payload = {
                "termsOfServiceAgreed": True,
                "contact": ["mailto:{0}".format(self._config['email'])],
            }
        else:
            payload = {"termsOfServiceAgreed": True}

        res = self.acme_request(url=self._apis['newAccount'], payload=payload)

        if res.status_code not in [201, 200, 409]:
            raise Exception("Failed to register ACME account: {}".format(res.json()))
        kid = res.headers["Location"]
        return kid

    def create_csr(self, ips):
        from cryptography import x509
        from cryptography.x509.oid import NameOID
        from cryptography.hazmat.primitives.asymmetric import rsa
        from cryptography.hazmat.primitives import hashes
        from cryptography.hazmat.primitives import serialization
        import ipaddress


        # 生成私钥
        pk = self.create_key()
        private_key = serialization.load_pem_private_key(pk, password=None)

        # IP证书不需要CN
        csr_builder = x509.CertificateSigningRequestBuilder().subject_name(x509.Name([]))
        # 添加 subjectAltName 扩展
        alt_names = [x509.IPAddress(ipaddress.ip_address(ip)) for ip in ips]


        csr_builder = csr_builder.add_extension(
            x509.SubjectAlternativeName(alt_names),
            critical=False
        )

        # 签署 CSR
        csr = csr_builder.sign(private_key, hashes.SHA256())

        # 返回 CSR (ASN1 格式)
        return csr.public_bytes(serialization.Encoding.DER), pk

    def apply_ip_ssl(self, ips, email, webroot=None, mode=None, path=None):
        print("Starting to apply for Let's Encrypt IP SSL certificate...")
        print("Retrieving ACME API directory...")
        self.get_apis()
        self._config['email'] = email
        print("Creating order...")
        order_data = self.create_order(ips)
        if not order_data:
            raise Exception("Failed to create order!")
        print("Order created successfully")
        print("Performing domain verification...")
        try:
            self.get_and_set_authorizations(order_data, webroot, mode, ips)
        except Exception as e:
            raise Exception("Domain verification failed! {}".format(e))
        # 完成订单
        print("Creating CSR...")
        csr, private_key = self.create_csr(ips)
        print("Sending CSR and completing order...")
        res = self.acme_request(order_data['finalize'], payload={
            "csr": self.calculate_safe_base64(csr)
        })
        if res.status_code not in [200, 201]:
            raise Exception("Failed to complete order! {}".format(res.json()))
        # 获取证书
        print("Retrieving certificate...")
        cert_url = res.json().get('certificate')
        if not cert_url:
            raise Exception("Failed to retrieve certificate URL!")
        cert_res = self.acme_request(cert_url, payload="")
        if cert_res.status_code not in [200, 201]:
            raise Exception("Failed to retrieve certificate! {}".format(cert_res.json()))
        print("Certificate retrieved successfully!")
        cert_pem = cert_res.content.decode()
        # 保存证书和私钥
        if not path:
            path = "/www/server/panel/ssl"
        if not os.path.exists(path):
            os.makedirs(path)
        cert_path = os.path.join(path, 'certificate.pem')
        key_path = os.path.join(path, 'privateKey.pem')
        with open(cert_path, 'w') as f:
            f.write(cert_pem)
        with open(key_path, 'w') as f:
            f.write(private_key.decode())
        return cert_path, key_path

    def create_order(self, ips):
        identifiers = []
        for ip in ips:
            identifiers.append({"type": "ip", "value": ip})
        payload = {"identifiers": identifiers, "profile": "shortlived"}
        print("Create order, domain name list:{}".format(','.join(ips)))
        res = self.acme_request(self._apis['newOrder'], payload)
        if not res.status_code in [201,200]:  # 如果创建失败
            print("Failed to create order, attempting to fix error...")
            e_body = res.json()
            if 'type' in e_body:
                # 如果随机数失效
                if e_body['type'].find('error:badNonce') != -1:
                    print("Nonce invalid, retrieving new nonce and retrying...")
                    self.get_nonce(force=True)
                    res = self.acme_request(self._apis['newOrder'], payload)
                # 如果帐户失效
                if e_body['detail'].find('KeyID header contained an invalid account URL') != -1:
                    print("Account invalid, re-registering account and retrying...")
                    k = "Production"
                    del(self._config['account'][k])
                    self.get_kid()
                    self.get_nonce(force=True)
                    res = self.acme_request(self._apis['newOrder'], payload)
            if not res.status_code in [201,200]:
                print(res.json())
                # 2025/12/25 yakpanel
                raise Exception(str(res.json()))
                # return {}
        return res.json()

    # UTC时间转时间戳
    def utc_to_time(self, utc_string):
        try:
            utc_string = utc_string.split('.')[0]
            utc_date = datetime.datetime.strptime(
                utc_string, "%Y-%m-%dT%H:%M:%S")
            # 按北京时间返回
            return int(time.mktime(utc_date.timetuple())) + (3600 * 8)
        except:
            return int(time.time() + 86400 * 7)

    def get_keyauthorization(self, token):
        acme_header_jwk_json = json.dumps(
            self.get_acme_header("GET_THUMBPRINT")["jwk"], sort_keys=True, separators=(",", ":")
        )
        acme_thumbprint = self.calculate_safe_base64(
            hashlib.sha256(acme_header_jwk_json.encode("utf8")).digest()
        )
        acme_keyauthorization = "{0}.{1}".format(token, acme_thumbprint)
        base64_of_acme_keyauthorization = self.calculate_safe_base64(
            hashlib.sha256(acme_keyauthorization.encode("utf8")).digest()
        )

        return acme_keyauthorization, base64_of_acme_keyauthorization

    # 获取并设置验证信息
    def get_and_set_authorizations(self, order_data, webroot=None, mode=None, ips=None):
        import os

        if 'authorizations' not in order_data:
            raise Exception("Abnormal order data, missing authorization information!")
        for auth_url in order_data['authorizations']:
            res = self.acme_request(auth_url, payload="")
            if not res.status_code in [200, 201]:
                raise Exception("Failed to get authorization information! {}".format(res.json()))
            s_body = res.json()
            if 'status' in s_body:
                if s_body['status'] in ['invalid']:
                    raise Exception("Invalid order, current order status is verification failed!")
                if s_body['status'] in ['valid']:  # 跳过无需验证的域名
                    continue
            for challenge in s_body['challenges']:
                if challenge['type'] == "http-01":
                    break
            if challenge['type'] != "http-01":
                raise Exception("http-01 verification method not found, cannot continue applying for certificate!")
            # 检查是否需要验证
            check_auth_data = self.check_auth_status(challenge['url'])
            if check_auth_data.json()['status'] == 'invalid':
                raise Exception('Domain verification failed, please try applying again!')
            if check_auth_data.json()['status'] == 'valid':
                continue

            acme_keyauthorization, auth_value = self.get_keyauthorization(
                challenge['token'])
            print(challenge)

            if mode:
                if mode == 'standalone':
                    from http.server import HTTPServer, SimpleHTTPRequestHandler
                    import threading
                    import os

                    class ACMERequestHandler(SimpleHTTPRequestHandler):
                        def log_message(self, format, *args):
                            # 屏蔽默认的请求日志输出
                            return

                        def do_GET(self):
                            if self.path == '/.well-known/acme-challenge/{}'.format(challenge['token']):
                                self.send_response(200)
                                self.send_header('Content-type', 'text/plain')
                                self.end_headers()
                                self.wfile.write(acme_keyauthorization.encode())
                            else:
                                self.send_response(404)
                                self.end_headers()

                    server_address = ('', 80)
                    httpd = HTTPServer(server_address, ACMERequestHandler)

                    def start_server():
                        httpd.serve_forever()

                    server_thread = threading.Thread(target=start_server)
                    server_thread.daemon = True
                    server_thread.start()


                    # 2025/12/26 yakpanel
                    time.sleep(2)  # 等待服务器启动
                    try:
                        # ========================= 校验服务 ==================================
                        server_started = False
                        challenge_local = f"http://127.0.0.1/.well-known/acme-challenge/{challenge['token']}"
                        for i in range(10): # 最大尝试时间5秒
                            try:
                                # 临时检查80 打印
                                with socket.create_connection(("127.0.0.1", 80), timeout=0.2):
                                    print("Temporary server started on port 80.")

                                response = requests.get(challenge_local, timeout=0.5)
                                if response.status_code == 200 and response.text == acme_keyauthorization:
                                    print("Temporary server started and responding correctly challenge token on port 80.")
                                    server_started = True
                                    break
                                else:
                                    print("Temporary server response incorrect, retrying...")
                                    time.sleep(0.5)
                            except Exception:
                                time.sleep(0.5)

                        if not server_started:
                            # raise Exception("Failed to start temporary HTTP server on port 80 in 5 seconds.")
                            print("Failed to start temporary HTTP server on port 80 in 5 seconds.")

                        # =========================   通知ACME服务器进行验证 ===============================
                        self.acme_request(challenge['url'], payload={"keyAuthorization": "{0}".format(acme_keyauthorization)})
                        self.check_auth_status(challenge['url'], [
                            'valid', 'invalid'])
                    finally:
                        httpd.shutdown()
                        server_thread.join()
                elif mode == 'nginx':
                    tmp_path = '/www/server/panel/vhost/nginx/tmp_apply_ip_ssl.conf'
                    files = find_nginx_files_by_servername(ips[0])
                    if not files:
                        print("No related Nginx configuration files found, attempting to create temporary configuration file...")
                        if not os.path.exists('/www/server/panel/vhost/nginx'):
                            raise Exception("No Nginx configuration files found, and Nginx configuration directory does not exist!")
                        # 如果没有找到相关配置文件，则创建一个临时配置文件
                        with open(tmp_path, 'w') as f:
                            f.write("""server
{{
    listen 80;
    server_name {0};
    location /.well-known/acme-challenge/{1} {{
        default_type text/plain;
        return 200 "{2}";
    }}
}}
""".format(ips[0], challenge['token'], acme_keyauthorization))
                    try:
                        for file in files:
                            print("Modifying Nginx configuration file: {}".format(file))
                            insert_location_into_server(file, ips[0], verify_file=challenge['token'], verify_content=acme_keyauthorization)
                        # 重新加载Nginx配置
                        subprocess.run(["nginx", "-t"], check=True)
                        subprocess.run(["nginx", "-s", "reload"], check=True)

                        # 通知ACME服务器进行验证
                        self.acme_request(challenge['url'],
                                          payload={"keyAuthorization": "{0}".format(acme_keyauthorization)})
                        self.check_auth_status(challenge['url'], [
                            'valid', 'invalid'])
                    finally:
                        for file in files:
                            print("Restoring Nginx configuration file: {}".format(file))
                            # 恢复备份文件
                            backup_file = file + ".bak"
                            if os.path.exists(backup_file):
                                shutil.move(backup_file, file)
                        if not files:
                            print("Deleting temporary Nginx configuration file...")
                            # 删除临时配置文件
                            os.remove(tmp_path)
                        # 重新加载Nginx配置
                        subprocess.run(["nginx", "-t"], check=True)
                        subprocess.run(["nginx", "-s", "reload"], check=True)

                elif mode == 'apache':
                    tmp_path = '/www/server/panel/vhost/apache/tmp_apply_ip_ssl.conf'
                    files = find_apache_conf_files(ips[0])
                    if not files:
                        print("No related Apache configuration files found, attempting to create temporary configuration file...")
                        if not os.path.exists('/www/server/panel/vhost/apache'):
                            raise Exception("No Apache configuration files found, and Apache configuration directory does not exist!")
                        # 如果没有找到相关配置文件，则创建一个临时配置文件
                        with open(tmp_path, 'w') as f:
                            f.write("""<VirtualHost *:80>
    ServerName {0}
    <Location /.well-known/acme-challenge/{1}>
        Require all granted
        Header set Content-Type "text/plain"
    </Location>
    Alias /.well-known/acme-challenge/{1} /tmp/{1}
</VirtualHost>
""".format(ips[0], challenge['token']))
                    try:
                        for file in files:
                            print("Modifying Apache configuration file: {}".format(file))
                            insert_location_into_vhost(file, ips[0], verify_file=challenge['token'])
                        # 写入验证文件
                        with open('/tmp/{}'.format(challenge['token']), 'w') as f:
                            f.write(acme_keyauthorization)
                        # 重新加载Apache配置
                        subprocess.run(["/etc/init.d/httpd", "reload"], check=True)

                        # 通知ACME服务器进行验证
                        self.acme_request(challenge['url'],
                                          payload={"keyAuthorization": "{0}".format(acme_keyauthorization)})
                        self.check_auth_status(challenge['url'], [
                            'valid', 'invalid'])
                    finally:
                        for file in files:
                            print("Restoring Apache configuration file: {}".format(file))
                            # 恢复备份文件
                            backup_file = file + ".bak"
                            if os.path.exists(backup_file):
                                shutil.move(backup_file, file)
                        if not files:
                            print("Deleting temporary Apache configuration file...")
                            # 删除临时配置文件
                            os.remove(tmp_path)
                        # 重新加载Apache配置
                        subprocess.run(["systemctl", "restart", "httpd"], check=True)
            else:
                # 使用webroot方式验证
                challenge_path = os.path.join(
                    webroot, '.well-known', 'acme-challenge')
                if not os.path.exists(challenge_path):
                    os.makedirs(challenge_path)
                file_path = os.path.join(challenge_path, challenge['token'])
                with open(file_path, 'w') as f:
                    f.write(acme_keyauthorization)

                try:
                    # 通知ACME服务器进行验证
                    self.acme_request(challenge['url'], payload={"keyAuthorization": "{0}".format(acme_keyauthorization)})
                    self.check_auth_status(challenge['url'], [
                        'valid', 'invalid'])
                finally:
                    os.remove(file_path)

    # 检查验证状态
    def check_auth_status(self, url, desired_status=None):
        desired_status = desired_status or ["pending", "valid", "invalid"]
        number_of_checks = 0
        authorization_status = "pending"
        while True:
            print("|- {} checking verification result...".format(number_of_checks + 1))
            if desired_status == ['valid', 'invalid']:
                time.sleep(self._wait_time)
            check_authorization_status_response = self.acme_request(url, "")
            a_auth = check_authorization_status_response.json()
            if not isinstance(a_auth, dict):
                continue
            authorization_status = a_auth["status"]
            number_of_checks += 1
            if authorization_status in desired_status:
                if authorization_status == "invalid":
                    try:
                        if 'error' in a_auth['challenges'][0]:
                            ret_title = a_auth['challenges'][0]['error']['detail']
                        elif 'error' in a_auth['challenges'][1]:
                            ret_title = a_auth['challenges'][1]['error']['detail']
                        elif 'error' in a_auth['challenges'][2]:
                            ret_title = a_auth['challenges'][2]['error']['detail']
                        else:
                            ret_title = str(a_auth)
                    except:
                        ret_title = str(a_auth)
                    raise StopIteration(
                        "{0} >>>> {1}".format(
                            ret_title,
                            json.dumps(a_auth)
                        )
                    )
                break

            if number_of_checks == self._max_check_num:
                raise StopIteration(
                    "Error: Verification attempted {0} times. Maximum verification attempts: {1}. Verification interval: {2} seconds.".format(
                        number_of_checks,
                        self._max_check_num,
                        self._wait_time
                    )
                )
        print("|-Verification result: {}".format(authorization_status))
        return check_authorization_status_response


if __name__ == '__main__':
    import argparse
    # 解析命令行参数
    parser = argparse.ArgumentParser(description='Auto-apply IP SSL certificate script')
    parser.add_argument('-ips', type=str, required=True, help='IP addresses to apply SSL certificate for', dest='ips')
    parser.add_argument('-email', type=str, required=False, help='Email for SSL certificate application', dest='email')
    parser.add_argument('-w', type=str, help='Website root directory', dest='webroot')
    parser.add_argument('--standalone', help='Apply certificate using standalone mode', dest='standalone', action='store_true')
    parser.add_argument('--nginx', help='Apply certificate using nginx mode', dest='nginx', action='store_true')
    parser.add_argument('--apache', help='Apply certificate using apache mode', dest='apache', action='store_true')
    parser.add_argument('-path', type=str, help='Certificate save path', dest='path')
    args = parser.parse_args()

    if not args.standalone and not args.webroot and not args.nginx and not args.apache:
        print("No verification mode detected, will attempt to auto-select verification mode!")
        # 自动选择验证模式
        # 判断80端口是否被占用
        use_80 = False
        result = subprocess.run(
            ["lsof", "-i:80"],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            text=True
        )
        if result.stdout:
            result = subprocess.run(
                ["netstat", "-lntup", "|", "grep", "80"],
                stdout=subprocess.PIPE,
                stderr=subprocess.PIPE,
                text=True
            )
            if result.stdout:
                use_80 = True
        if use_80:
            print("It is detected that port 80 is occupied, try to use Nginx or Apache mode to verify...")
            # 检查是否安装Nginx
            if os.path.exists('/www/server/nginx/sbin/nginx'):
                args.nginx = True
                print("Selected Nginx mode for verification...")
            elif os.path.exists('/www/server/apache/bin/httpd'):
                args.apache = True
                print("Selected Apache mode for verification...")
            else:
                print("[ERROR] Nginx or Apache installation not detected, cannot use Nginx or Apache mode for verification! Please release port 80 and try again.")
                exit(1)
        else:
            args.standalone = True
            print("Port 80 not occupied, selected standalone mode for verification...")

    if not args.email:
        # 使用默认邮箱
        email = "demo@yakpanel.com"
    else:
        email = args.email

    ips = args.ips.split(',')
    # 先只支持单个IP申请
    if len(ips) > 1 and not args.standalone:
        print("[ERROR] Multiple IP SSL certificate application not supported in non-standalone mode!")
        exit(1)
    # 先只支持IPv4
    if not is_ipv4(ips[0]):
        print("[ERROR] Only IPv4 addresses are supported for SSL certificate application at this time!")
        exit(1)
    auto_ssl = AutoApplyIPSSL()
    mode = None
    if args.standalone:
        mode = 'standalone'
    elif args.nginx:
        mode = 'nginx'
    elif args.apache:
        mode = 'apache'
    try:
        cert_path, key_path = auto_ssl.apply_ip_ssl(ips, email, webroot=args.webroot, mode=mode, path=args.path)
    except Exception as e:
        # 2025/12/25 yakpanel
        print(f"[ERROR] Certificate application failed! Error details: {e}", file=sys.stderr)
        exit(1)
    exit(0)