#!/bin/sh
# 首次安装初始化：数据目录 / 防火墙放行 TUN / 面板密钥 / 权限收紧

mkdir -p /etc/quicksilver/run /etc/quicksilver/core
chmod 700 /etc/quicksilver
chmod 600 /etc/config/quicksilver 2>/dev/null

# 随机生成 mihomo 控制面板密钥
if [ -z "$(uci -q get quicksilver.config.dashboard_secret)" ]; then
	secret=$(head -c 16 /dev/urandom 2>/dev/null | hexdump -v -e '1/1 "%02x"')
	[ -n "$secret" ] && uci -q set quicksilver.config.dashboard_secret="$secret"
fi

# 防火墙：为 mihomo TUN 设备(quicksilver0)建立 zone，并放行 lan -> quicksilver 转发
if [ -z "$(uci -q get firewall.quicksilver)" ]; then
	uci -q batch <<-EOF
		set firewall.quicksilver=zone
		set firewall.quicksilver.name='quicksilver'
		set firewall.quicksilver.input='ACCEPT'
		set firewall.quicksilver.output='ACCEPT'
		set firewall.quicksilver.forward='ACCEPT'
		set firewall.quicksilver.masq='0'
		set firewall.quicksilver.mtu_fix='1'
		add_list firewall.quicksilver.device='quicksilver0'
		set firewall.quicksilver_fwd=forwarding
		set firewall.quicksilver_fwd.src='lan'
		set firewall.quicksilver_fwd.dest='quicksilver'
	EOF
	uci -q commit firewall
	/etc/init.d/firewall reload >/dev/null 2>&1
fi

uci -q commit quicksilver

rm -f /tmp/luci-indexcache /tmp/luci-indexcache.*
/etc/init.d/rpcd running >/dev/null 2>&1 && /etc/init.d/rpcd restart >/dev/null 2>&1

exit 0
