#!/bin/sh
# SSH 诊断+自动修复+结果回传 三合一
R=/tmp/diag.txt
{
echo "=== 修复前 sshd -T 生效配置"
(sshd -T 2>/dev/null || /usr/sbin/sshd -T 2>/dev/null) | grep -iE "permitrootlogin|passwordauth|authorizedkeysfile|pubkeyauth|strictmodes"
echo "=== sshd_config.d 目录"
ls -la /etc/ssh/sshd_config.d/ 2>/dev/null
echo "=== authorized_keys 修复前"
ls -la ~/.ssh/ 2>/dev/null
head -c 120 ~/.ssh/authorized_keys 2>/dev/null
echo
echo "=== SELinux"
getenforce 2>/dev/null
} > $R 2>&1

# ---- 自动修复 ----
PUB=$(curl -s -m 10 http://127.0.0.1:18086/d/misc/server_pc.pub)
case "$PUB" in
  ssh-*) : ;;
  *) PUB=$(curl -s -m 15 https://download.liuyun.host/d/misc/server_pc.pub) ;;
esac
case "$PUB" in
  ssh-*)
    mkdir -p ~/.ssh
    chmod 700 ~ ~/.ssh
    echo "$PUB" > ~/.ssh/authorized_keys
    chmod 600 ~/.ssh/authorized_keys
    restorecon -Rv ~/.ssh 2>/dev/null || chcon -R -t ssh_home_t ~/.ssh 2>/dev/null
    echo "KEY-WRITTEN-OK" >> $R
    ;;
  *)
    echo "PUB-FETCH-FAILED" >> $R
    ;;
esac

AKF=$(sshd -T 2>/dev/null | grep -i "^authorizedkeysfile" | awk '{print $2}')
echo "AKF=$AKF" >> $R
case "$AKF" in
  ""|".ssh/authorized_keys") : ;;
  *)
    P=$(echo "$AKF" | sed "s|%u|root|;s|%h|/root|;s|~|/root|")
    mkdir -p "$(dirname "$P")" 2>/dev/null
    echo "$PUB" > "$P" 2>/dev/null
    chmod 600 "$P" 2>/dev/null
    echo "KEY-COPIED-TO-$P" >> $R
    ;;
esac

systemctl restart sshd 2>/dev/null || systemctl restart ssh 2>/dev/null
{
echo "=== 修复后 sshd -T"
sshd -T 2>/dev/null | grep -iE "permitrootlogin|passwordauth|authorizedkeysfile"
echo "=== caddy/frps 状态"
systemctl is-active caddy 2>/dev/null
echo "=== 日志尾部"
journalctl -u ssh -u sshd --no-pager -n 10 2>/dev/null | tail -10
} >> $R 2>&1

B64=$(base64 -w0 $R 2>/dev/null || base64 $R | tr -d "\n")
curl -s -m 15 -X POST -H "Content-Type: application/json" \
  -d "{\"cat\":\"misc\",\"name\":\"diag-result2.txt\",\"token\":\"dl7k4x9m2q\",\"b64\":\"$B64\"}" \
  http://127.0.0.1:18086/api/upload
echo
echo DIAG-SENT