#!/bin/bash
# 按需修改
# CentOS7增强版部署脚本 - 支持多架构/安全增强/智能检测

# 全局配置
set -euo pipefail
VERSION="1.9.0"
GREEN='\e[32m'
RED='\e[31m'
RESET='\e[0m'

# 0. 系统检测
echo -e "${GREEN}[INFO] 系统初始化检测...${RESET}"
ARCH=$(uname -m)
case $ARCH in
    x86_64) ARCH="amd64";;
    aarch64) ARCH="arm64";;
    *) echo -e "${RED}[ERROR] 不支持的架构: $ARCH${RESET}"; exit 1 ;;
esac

# 1. 修复yum源（仅限CentOS）
if grep -q "CentOS" /etc/os-release; then
    echo -e "${GREEN}[INFO] 修复yum源...${RESET}"
    sudo cp /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
    sudo curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo || {
        echo -e "${RED}[ERROR] yum源更新失败${RESET}";
        exit 1;
    }
    sudo yum clean all
    sudo yum makecache
fi

# 2. 依赖检查与安装
declare -a DEPS=("wget" "tar" "openssl")
for pkg in "${DEPS[@]}"; do
    if ! command -v $pkg &> /dev/null; then
        echo -e "${GREEN}[INFO] 安装依赖: $pkg...${RESET}"
        sudo yum install -y $pkg || {
            echo -e "${RED}[ERROR] $pkg 安装失败${RESET}";
            exit 1;
        }
    fi
done

# 3. 下载并解压（多架构支持）
DOWNLOAD_URL="https://github.com/prometheus/node_exporter/releases/download/v${VERSION}/node_exporter-${VERSION}.linux-${ARCH}.tar.gz"
echo -e "${GREEN}[INFO] 下载 Node Exporter...${RESET}"
if ! wget -q -O node_exporter.tar.gz "$DOWNLOAD_URL"; then
    echo -e "${RED}[ERROR] 下载失败，请检查版本或网络${RESET}"
    exit 1
fi
tar zxf node_exporter.tar.gz || { echo -e "${RED}[ERROR] 解压失败${RESET}"; exit 1; }

# 4. 安全部署
echo -e "${GREEN}[INFO] 安全部署配置...${RESET}"
[ -d /opt/prometheus/ ] || sudo mkdir -p /opt/prometheus/
sudo mv "node_exporter-${VERSION}.linux-${ARCH}/" "/opt/prometheus/node_exporter/"
sudo mkdir -p "/opt/prometheus/node_exporter/data"


# 5. 用户权限管理
if ! id "prometheus" &>/dev/null; then
    echo -e "${GREEN}[INFO] 创建 prometheus 用户...${RESET}"
    sudo useradd -r -s /sbin/nologin prometheus || {
        echo -e "${RED}[ERROR] 用户创建失败${RESET}";
        exit 1;
    }
fi
sudo chown -R prometheus:prometheus "/opt/prometheus/node_exporter"

# 6. 服务配置（动态路径）
cat <<EOF | sudo tee /etc/systemd/system/node_exporter.service > /dev/null
[Unit]
Description=Node Exporter
Documentation=https://prometheus.io/docs/guides/node-exporter/
After=network.target

[Service]
User=prometheus
Group=prometheus
ExecStart=/opt/prometheus/node_exporter/node_exporter \
  --web.listen-address=0.0.0.0:9100 \
  --collector.systemd \
  --collector.systemd.unit-whitelist="(ssh|docker|prometheus).service"
Restart=on-failure
RestartSec=30s
LimitNOFILE=65536
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

# 7. 防火墙配置
configure_firewall() {
    if systemctl is-active --quiet firewalld; then
        sudo firewall-cmd --permanent --add-port=9100/tcp && \
        sudo firewall-cmd --reload
    elif command -v iptables &> /dev/null; then
        sudo iptables -A INPUT -p tcp --dport 9100 -j ACCEPT
        sudo service iptables save
    else
        echo -e "${RED}[WARN] 未检测到防火墙服务，请手动开放端口 9100${RESET}"
    fi
}
configure_firewall

# 8. 启动服务
sudo systemctl daemon-reload
sudo systemctl enable --now node_exporter

# 9. 部署验证
check_service() {
    if ! systemctl is-active --quiet node_exporter; then
        echo -e "${RED}[ERROR] 服务启动失败，查看日志：journalctl -u node_exporter -n 50${RESET}"
        exit 1
    fi
    echo -e "${GREEN}[SUCCESS] 服务已启动，监听端口：${RESET}"
    ss -tunlp | grep 9100
    curl -s http://localhost:9100/metrics | grep 'node_' | head -5
}
check_service