#!/bin/bash

# Proxy-Core - Advanced VPN & Proxy Panel Auto-Installer
# Version: 2.1.1
# Author: houseassassin
# GitHub: https://github.com/houseassassin/proxy-core
#
# Supports: WireGuard, 3x-ui, Remnawave, Hysteria2, MTProxy
# Reverse Proxy: Nginx, Caddy
# Features: Selfsteal templates

set -euo pipefail

SCRIPT_VERSION="2.1.1"
PROJECT_DIR="/opt/proxy-core"
LANG_FILE="${PROJECT_DIR}/.selected_language"
REPO_ARCHIVE_URL="https://github.com/houseassassin/proxy-core/archive/refs/heads/main.tar.gz"
THREEXUI_INSTALL_URL="https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh"
WG_PORT_MIN=51820
WG_PORT_MAX=51900
HYSTERIA_PORT_MIN=36712
HYSTERIA_PORT_MAX=36800
MTPROXY_PORT_DEFAULT=8443

# Colors and styles
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
MAGENTA='\033[0;35m'
CYAN='\033[0;36m'
GRAY='\033[0;90m'
WHITE='\033[1;37m'
NC='\033[0m'

# Styles
BOLD='\033[1m'
DIM='\033[2m'
UNDERLINE='\033[4m'
BLINK='\033[5m'

# Background colors
BG_RED='\033[41m'
BG_GREEN='\033[42m'
BG_BLUE='\033[44m'
BG_MAGENTA='\033[45m'
BG_CYAN='\033[46m'

USE_UNICODE=1
if ! locale charmap 2>/dev/null | grep -qi "utf-8"; then
    USE_UNICODE=0
fi

if [ ! -t 1 ] || [ "${TERM:-}" = "dumb" ] || [ "${NO_COLOR:-}" = "1" ]; then
    RED=""
    GREEN=""
    YELLOW=""
    BLUE=""
    MAGENTA=""
    CYAN=""
    GRAY=""
    WHITE=""
    NC=""
    BOLD=""
    DIM=""
    UNDERLINE=""
    BLINK=""
    BG_RED=""
    BG_GREEN=""
    BG_BLUE=""
    BG_MAGENTA=""
    BG_CYAN=""
fi

if [ "$USE_UNICODE" -eq 1 ]; then
    SYM_INFO="ℹ"
    SYM_WARN="⚠"
    SYM_ERR="✗"
    SYM_OK="✓"
else
    SYM_INFO="i"
    SYM_WARN="!"
    SYM_ERR="x"
    SYM_OK="+"
fi

# Logging
LOGFILE="/tmp/proxy-core-installer.log"

log() {
    echo -e "  ${CYAN}${SYM_INFO}${NC} ${WHITE}$1${NC}"
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [INFO] $1" >> "$LOGFILE" 2>/dev/null
}

warn() {
    echo -e "  ${YELLOW}${SYM_WARN}${NC} ${YELLOW}$1${NC}"
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [WARN] $1" >> "$LOGFILE" 2>/dev/null
}

error() {
    echo -e "  ${RED}${SYM_ERR}${NC} ${RED}$1${NC}"
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [ERROR] $1" >> "$LOGFILE" 2>/dev/null
}

success() {
    echo -e "  ${GREEN}${SYM_OK}${NC} ${GREEN}$1${NC}"
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [SUCCESS] $1" >> "$LOGFILE" 2>/dev/null
}

# Spinner animation
spinner() {
    local pid=$1
    local text=$2
    local frames=("|" "/" "-" "\\")
    if [ "$USE_UNICODE" -eq 1 ]; then
        frames=("⠋" "⠙" "⠹" "⠸" "⠼" "⠴" "⠦" "⠧" "⠇" "⠏")
    fi

    while kill -0 "$pid" 2>/dev/null; do
        for frame in "${frames[@]}"; do
            printf "\r  ${CYAN}${frame}${NC} ${WHITE}%s${NC}" "$text"
            sleep 0.1
        done
    done
    printf "\r  ${GREEN}${SYM_OK}${NC} ${WHITE}%s${NC}\n" "$text"
}

MENU_LANG="en"

load_language() {
    if [ -f "$LANG_FILE" ]; then
        MENU_LANG=$(cat "$LANG_FILE" 2>/dev/null | tr -d '[:space:]')
    fi
}

save_language() {
    mkdir -p "$(dirname "$LANG_FILE")"
    echo "$1" > "$LANG_FILE"
    MENU_LANG="$1"
}

L() {
    local key="$1"
    case "$MENU_LANG:$key" in
        "ru:SELECT_REVERSE_PROXY") echo "Выберите Reverse Proxy" ;;
        "ru:NGINX") echo "Nginx" ;;
        "ru:CADDY") echo "Caddy" ;;
        "en:SELECT_REVERSE_PROXY") echo "Select Reverse Proxy" ;;
        "en:NGINX") echo "Nginx" ;;
        "en:CADDY") echo "Caddy" ;;
        *) echo "$key" ;;
    esac
}

# System checks
check_root() {
    if [[ $EUID -ne 0 ]]; then
        error "Этот скрипт должен быть запущен с правами root"
        exit 1
    fi
}

detect_os() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        OS=$ID
        VER=$VERSION_ID
    else
        error "Не удалось определить операционную систему"
        exit 1
    fi
    log "Обнаружена ОС: $OS $VER"
}

reload_firewall() {
    if command -v firewall-cmd >/dev/null 2>&1; then
        firewall-cmd --reload >/dev/null 2>&1 || true
    fi
}

open_firewall_port() {
    local port=$1
    local protocol=$2

    if command -v ufw >/dev/null 2>&1; then
        ufw allow "${port}/${protocol}" >/dev/null 2>&1 || true
        return 0
    fi

    if command -v firewall-cmd >/dev/null 2>&1; then
        firewall-cmd --permanent --add-port="${port}/${protocol}" >/dev/null 2>&1 || true
        reload_firewall
    fi
}

run_remote_script() {
    local url=$1
    local tmp_script
    tmp_script="$(mktemp /tmp/proxy-core-remote.XXXXXX.sh)"
    curl -fsSL "$url" -o "$tmp_script"
    chmod 700 "$tmp_script"
    bash "$tmp_script"
    rm -f "$tmp_script"
}

ensure_project_files() {
    mkdir -p "$PROJECT_DIR"
    LOGFILE="${PROJECT_DIR}/installer.log"

    local need_bootstrap=0
    local required_files=(
        "manage.sh"
        "wg-manager.sh"
        "update.sh"
        "mtproxy-manager.sh"
        "reverse-proxy-manager.sh"
        "banner.sh"
    )

    for file in "${required_files[@]}"; do
        if [ ! -f "$PROJECT_DIR/$file" ]; then
            need_bootstrap=1
            break
        fi
    done

    if [ "$need_bootstrap" -eq 0 ] && [ -d "$PROJECT_DIR/lib" ] && [ -d "$PROJECT_DIR/config" ]; then
        return 0
    fi

    local script_dir
    script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
    if [ -f "$script_dir/manage.sh" ] && [ -d "$script_dir/lib" ] && [ -d "$script_dir/config" ]; then
        cp -f "$script_dir/"*.sh "$PROJECT_DIR/" 2>/dev/null || true
        cp -rf "$script_dir/lib" "$PROJECT_DIR/"
        cp -rf "$script_dir/config" "$PROJECT_DIR/"
        chmod +x "$PROJECT_DIR/"*.sh 2>/dev/null || true
        return 0
    fi

    log "Загружаем файлы проекта в $PROJECT_DIR..."
    local archive
    archive="$(mktemp /tmp/proxy-core-src.XXXXXX.tar.gz)"
    curl -fsSL "$REPO_ARCHIVE_URL" -o "$archive"
    tar -xzf "$archive" --strip-components=1 -C "$PROJECT_DIR"
    rm -f "$archive"
    chmod +x "$PROJECT_DIR/"*.sh 2>/dev/null || true
}

run_project_script() {
    local script_name=$1
    if [ -f "$PROJECT_DIR/$script_name" ]; then
        bash "$PROJECT_DIR/$script_name"
    else
        error "$script_name не найден в $PROJECT_DIR"
        return 1
    fi
}

load_defaults() {
    local defaults_path=""
    local script_dir
    script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
    if [ -f "$PROJECT_DIR/config/defaults.conf" ]; then
        defaults_path="$PROJECT_DIR/config/defaults.conf"
    elif [ -f "$script_dir/config/defaults.conf" ]; then
        defaults_path="$script_dir/config/defaults.conf"
    fi

    if [ -n "$defaults_path" ]; then
        source "$defaults_path"
        log "Загружены настройки по умолчанию: $defaults_path"
    fi
}

check_memory() {
    local mem_mb=$(free -m | grep Mem: | awk '{print $2}')
    if [ $mem_mb -lt 2000 ]; then
        local swap_mb=$(free -m | grep Swap: | awk '{print $2}')
        if [ $swap_mb -eq 0 ]; then
            warn "Мало RAM ($mem_mb MB), создаём swap 2GB..."
            fallocate -l 2G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=2048
            chmod 600 /swapfile
            mkswap /swapfile
            swapon /swapfile
            echo '/swapfile none swap sw 0 0' >> /etc/fstab
            success "Swap создан"
        fi
    fi
}

# Network utilities
get_server_ip() {
    curl -s -4 ifconfig.me || curl -s -4 api.ipify.org || curl -s -4 ipinfo.io/ip
}

get_random_port() {
    local MIN=${1:-3000}
    local MAX=${2:-6999}

    while :; do
        PORT=$(shuf -i "$MIN-$MAX" -n 1)
        if ! ss -ltun | awk '{print $4}' | grep -q ":$PORT\$"; then
            echo "$PORT"
            return
        fi
    done
}

# Docker management
install_docker() {
    if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
        log "Docker уже установлен"
        return 0
    fi

    log "Установка Docker..."
    local docker_installer
    docker_installer="$(mktemp /tmp/get-docker.XXXXXX.sh)"
    curl -fsSL https://get.docker.com -o "$docker_installer"
    sh "$docker_installer"
    rm -f "$docker_installer"

    systemctl enable docker
    systemctl start docker

    success "Docker установлен"
}

# System packages
install_packages() {
    log "Установка системных пакетов..."

    case $OS in
        ubuntu|debian)
            apt-get update -y
            apt-get install -y curl wget git sudo ufw certbot \
                ca-certificates jq openssl tar net-tools \
                qrencode python3-certbot-dns-cloudflare \
                unattended-upgrades locales dnsutils coreutils \
                grep gawk python3-pip cron nginx
            ;;
        centos|rhel|fedora)
            yum update -y
            yum install -y curl wget git sudo firewalld certbot \
                ca-certificates jq openssl tar net-tools qrencode nginx
            ;;
    esac

    # BBR
    if ! grep -q "net.core.default_qdisc = fq" /etc/sysctl.conf; then
        echo "net.core.default_qdisc = fq" >> /etc/sysctl.conf
    fi
    if ! grep -q "net.ipv4.tcp_congestion_control = bbr" /etc/sysctl.conf; then
        echo "net.ipv4.tcp_congestion_control = bbr" >> /etc/sysctl.conf
    fi
    sysctl -p >/dev/null

    # UFW
    if command -v ufw >/dev/null 2>&1; then
        ufw allow 22/tcp comment 'SSH' >/dev/null 2>&1
        ufw allow 443/tcp comment 'HTTPS' >/dev/null 2>&1
        ufw --force enable >/dev/null 2>&1
    fi

    if command -v firewall-cmd >/dev/null 2>&1; then
        systemctl enable firewalld >/dev/null 2>&1 || true
        systemctl start firewalld >/dev/null 2>&1 || true
        firewall-cmd --permanent --add-service=ssh >/dev/null 2>&1 || true
        firewall-cmd --permanent --add-service=https >/dev/null 2>&1 || true
        reload_firewall
    fi

    success "Системные пакеты установлены"
}

# WireGuard installation
install_wireguard() {
    log "Установка WireGuard..."

    case $OS in
        ubuntu|debian)
            apt-get install -y wireguard wireguard-tools qrencode
            ;;
        centos|rhel|fedora)
            yum install -y wireguard-tools qrencode
            ;;
    esac

    mkdir -p /etc/wireguard
    cd /etc/wireguard
    wg genkey | tee server_private.key | wg pubkey > server_public.key
    chmod 600 server_private.key

    SERVER_PRIVATE_KEY=$(cat server_private.key)
    SERVER_PUBLIC_KEY=$(cat server_public.key)
    SERVER_IP=$(get_server_ip)
    WG_PORT=$(get_random_port "$WG_PORT_MIN" "$WG_PORT_MAX")

    cat > /etc/wireguard/wg0.conf <<EOF
[Interface]
PrivateKey = $SERVER_PRIVATE_KEY
Address = 10.0.0.1/24
ListenPort = $WG_PORT
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
EOF

    echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
    sysctl -p >/dev/null 2>&1

    systemctl enable wg-quick@wg0
    systemctl start wg-quick@wg0

    open_firewall_port "$WG_PORT" "udp"

    success "WireGuard установлен на порту $WG_PORT"

    read -p "Создать первого клиента? (Y/n): " create_client
    if [[ "$create_client" != "n" && "$create_client" != "N" ]]; then
        bash "$PROJECT_DIR/wg-manager.sh" 2>/dev/null || log "Запустите wg-manager.sh для создания клиентов"
    fi
}

# 3x-ui installation
install_3xui() {
    log "Установка 3x-ui..."
    run_remote_script "$THREEXUI_INSTALL_URL"
    success "3x-ui установлен"
}

# Remnawave installation
install_remnawave() {
    log "Установка Remnawave..."

    install_docker

    cd /opt
    if [ -d "remnawave" ]; then
        warn "Remnawave уже установлен, обновляем..."
        cd remnawave
        docker compose down
        cd /opt
        rm -rf remnawave
    fi

    git clone https://github.com/remnawave/backend.git remnawave
    cd remnawave

    DB_PASSWORD=$(openssl rand -base64 32)
    ADMIN_PASSWORD=$(openssl rand -base64 16)

    cat > .env <<EOF
DATABASE_URL="postgresql://remnawave:${DB_PASSWORD}@postgres:5432/remnawave"
ADMIN_USERNAME=admin
ADMIN_PASSWORD=${ADMIN_PASSWORD}
JWT_SECRET=$(openssl rand -base64 32)
EOF

    docker compose up -d

    success "Remnawave установлен"
    echo ""
    echo -e "  ${CYAN}${SYM_INFO}${NC} ${WHITE}Админ логин: admin${NC}"
    echo -e "  ${CYAN}${SYM_INFO}${NC} ${WHITE}Админ пароль: ${ADMIN_PASSWORD}${NC}"
    warn "Сохраните эти данные!"
}

# Hysteria2 installation
install_hysteria2() {
    log "Установка Hysteria2..."

    HYSTERIA_VERSION=$(curl -s https://api.github.com/repos/apernet/hysteria/releases/latest | grep tag_name | cut -d '"' -f 4)
    local hysteria_bin
    hysteria_bin="$(mktemp /tmp/hysteria.XXXXXX)"
    wget -O "$hysteria_bin" "https://github.com/apernet/hysteria/releases/download/${HYSTERIA_VERSION}/hysteria-linux-amd64"
    chmod +x "$hysteria_bin"
    mv "$hysteria_bin" /usr/local/bin/hysteria

    mkdir -p /etc/hysteria

    HYSTERIA_PASSWORD=$(openssl rand -base64 32)
    HYSTERIA_PORT=$(get_random_port "$HYSTERIA_PORT_MIN" "$HYSTERIA_PORT_MAX")

    cat > /etc/hysteria/config.yaml <<EOF
listen: :$HYSTERIA_PORT

tls:
  cert: /etc/hysteria/cert.pem
  key: /etc/hysteria/key.pem

auth:
  type: password
  password: $HYSTERIA_PASSWORD

masquerade:
  type: proxy
  proxy:
    url: https://www.bing.com
    rewriteHost: true
EOF

    openssl req -x509 -nodes -newkey rsa:4096 -keyout /etc/hysteria/key.pem \
        -out /etc/hysteria/cert.pem -days 365 -subj "/CN=www.example.com" 2>/dev/null

    cat > /etc/systemd/system/hysteria-server.service <<EOF
[Unit]
Description=Hysteria Server
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/hysteria server -c /etc/hysteria/config.yaml
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

    systemctl daemon-reload
    systemctl enable hysteria-server
    systemctl start hysteria-server

    open_firewall_port "$HYSTERIA_PORT" "udp"

    success "Hysteria2 установлен"
    echo ""
    log "Порт: $HYSTERIA_PORT"
    echo -e "  ${CYAN}${SYM_INFO}${NC} ${WHITE}Пароль: ${HYSTERIA_PASSWORD}${NC}"
    warn "Сохраните эти данные!"
}

# MTProxy installation
install_mtproxy() {
    log "Установка MTProxy для Telegram..."

    case $OS in
        ubuntu|debian)
            apt-get install -y git build-essential libssl-dev zlib1g-dev
            ;;
        centos|rhel|fedora)
            yum install -y git gcc make openssl-devel zlib-devel
            ;;
    esac

    cd /opt
    if [ -d "MTProxy" ]; then
        rm -rf MTProxy
    fi
    git clone https://github.com/TelegramMessenger/MTProxy.git
    cd MTProxy

    make

    curl -s https://core.telegram.org/getProxySecret -o proxy-secret
    curl -s https://core.telegram.org/getProxyConfig -o proxy-multi.conf

    SECRET=$(head -c 16 /dev/urandom | xxd -ps)

    read -p "Введите порт для MTProxy (по умолчанию ${MTPROXY_PORT_DEFAULT}): " MTPROXY_PORT
    MTPROXY_PORT=${MTPROXY_PORT:-$MTPROXY_PORT_DEFAULT}
    if ! [[ "$MTPROXY_PORT" =~ ^[0-9]+$ ]] || [ "$MTPROXY_PORT" -lt 1 ] || [ "$MTPROXY_PORT" -gt 65535 ]; then
        error "Неверный порт: $MTPROXY_PORT"
        return 1
    fi

    cat > /etc/systemd/system/mtproxy.service <<EOF
[Unit]
Description=MTProxy Telegram Proxy
After=network.target

[Service]
Type=simple
WorkingDirectory=/opt/MTProxy
ExecStart=/opt/MTProxy/objs/bin/mtproto-proxy -u nobody -p $MTPROXY_PORT -H $MTPROXY_PORT -S $SECRET --aes-pwd proxy-secret proxy-multi.conf -M 1
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

    systemctl daemon-reload
    systemctl enable mtproxy
    systemctl start mtproxy

    open_firewall_port "$MTPROXY_PORT" "tcp"

    cat > /opt/MTProxy/.config <<EOF
MTPROXY_PORT=$MTPROXY_PORT
SECRET=$SECRET
EOF
    chmod 600 /opt/MTProxy/.config

    SERVER_IP=$(get_server_ip)

    success "MTProxy установлен!"
    echo ""
    log "Ссылка для подключения:"
    echo -e "${CYAN}tg://proxy?server=${SERVER_IP}&port=${MTPROXY_PORT}&secret=${SECRET}${NC}"
    echo ""
    log "Или используйте в Telegram:"
    echo -e "${YELLOW}Server: ${SERVER_IP}${NC}"
    echo -e "${YELLOW}Port: ${MTPROXY_PORT}${NC}"
    echo -e "${YELLOW}Secret: ${SECRET}${NC}"

    if command -v qrencode &> /dev/null; then
        echo ""
        log "QR-код для быстрого подключения:"
        qrencode -t ansiutf8 "tg://proxy?server=${SERVER_IP}&port=${MTPROXY_PORT}&secret=${SECRET}"
    fi
}

# Reverse Proxy selection
select_reverse_proxy() {
    echo ""
    echo -e "${GREEN}$(L SELECT_REVERSE_PROXY)${NC}"
    echo ""
    echo -e "${YELLOW}1.${NC} $(L NGINX)"
    echo -e "${YELLOW}2.${NC} $(L CADDY)"
    echo ""
    read -p "Выберите / Select [1-2]: " PROXY_CHOICE

    case $PROXY_CHOICE in
        1)
            REVERSE_PROXY="nginx"
            install_nginx
            ;;
        2)
            REVERSE_PROXY="caddy"
            install_caddy
            ;;
        *)
            warn "Неверный выбор, используется Nginx"
            REVERSE_PROXY="nginx"
            install_nginx
            ;;
    esac
}

# Nginx installation
install_nginx() {
    if command -v nginx >/dev/null 2>&1; then
        log "Nginx уже установлен"
        return 0
    fi

    log "Установка Nginx..."

    case $OS in
        ubuntu|debian)
            apt-get install -y nginx
            ;;
        centos|rhel|fedora)
            yum install -y nginx
            ;;
    esac

    systemctl enable nginx
    systemctl start nginx

    success "Nginx установлен"
}

# Caddy installation
install_caddy() {
    if command -v caddy >/dev/null 2>&1; then
        log "Caddy уже установлен"
        return 0
    fi

    log "Установка Caddy..."

    case $OS in
        ubuntu|debian)
            apt-get install -y debian-keyring debian-archive-keyring apt-transport-https
            curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
            curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list
            apt-get update
            apt-get install -y caddy
            ;;
        centos|rhel|fedora)
            yum install -y yum-plugin-copr
            yum copr enable @caddy/caddy -y
            yum install -y caddy
            ;;
    esac

    systemctl enable caddy
    systemctl start caddy

    success "Caddy установлен"
}

# Selfsteal template installation
install_selfsteal() {
    log "Установка Selfsteal шаблона..."

    # Определяем директорию
    if [ -d "/opt/remnawave" ]; then
        INSTALL_DIR="/opt/remnawave"
    elif [ -d "/opt/remnanode" ]; then
        INSTALL_DIR="/opt/remnanode"
    else
        error "Remnawave или Remnanode должны быть установлены для selfsteal"
        return 1
    fi

    # Устанавливаем REVERSE_PROXY если не задан
    if [ -z "${REVERSE_PROXY:-}" ]; then
        if command -v nginx >/dev/null 2>&1; then
            REVERSE_PROXY="nginx"
            log "Используется установленный Nginx"
        elif command -v caddy >/dev/null 2>&1; then
            REVERSE_PROXY="caddy"
            log "Используется установленный Caddy"
        else
            warn "Reverse proxy не найден, устанавливаем Nginx..."
            install_nginx
            REVERSE_PROXY="nginx"
        fi
    fi

    echo ""
    echo -e "${GREEN}Выберите тип selfsteal шаблона:${NC}"
    echo ""
    echo -e "${YELLOW}1.${NC} Случайный сайт"
    echo -e "${YELLOW}2.${NC} Пользовательский URL"
    echo -e "${YELLOW}3.${NC} Локальный HTML файл"
    echo ""
    read -p "Выберите [1-3]: " SELFSTEAL_TYPE

    case $SELFSTEAL_TYPE in
        1)
            # Список популярных сайтов
            SITES=(
                "https://www.wikipedia.org"
                "https://www.github.com"
                "https://www.stackoverflow.com"
                "https://www.reddit.com"
                "https://www.medium.com"
            )
            RANDOM_SITE=${SITES[$RANDOM % ${#SITES[@]}]}
            log "Используется случайный сайт: $RANDOM_SITE"

            # Скачиваем страницу
            curl -sL "$RANDOM_SITE" > "$INSTALL_DIR/selfsteal.html"
            ;;
        2)
            read -p "Введите URL сайта: " CUSTOM_URL
            log "Скачивание $CUSTOM_URL..."
            curl -sL "$CUSTOM_URL" > "$INSTALL_DIR/selfsteal.html"
            ;;
        3)
            read -p "Введите путь к HTML файлу: " HTML_PATH
            if [ -f "$HTML_PATH" ]; then
                cp "$HTML_PATH" "$INSTALL_DIR/selfsteal.html"
            else
                error "Файл не найден: $HTML_PATH"
            fi
            ;;
        *)
            warn "Неверный выбор"
            return 1
            ;;
    esac

    # Настройка Nginx для selfsteal
    if [ "$REVERSE_PROXY" = "nginx" ]; then
        cat > /etc/nginx/sites-available/selfsteal <<EOF
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root $INSTALL_DIR;
    index selfsteal.html;

    location / {
        try_files \$uri \$uri/ /selfsteal.html;
    }
}
EOF
        ln -sf /etc/nginx/sites-available/selfsteal /etc/nginx/sites-enabled/
        nginx -t && systemctl reload nginx
    fi

    success "Selfsteal шаблон установлен"
}

backup_configs() {
    local backup_dir="/root/proxy-core-backup-$(date +%Y%m%d-%H%M%S)"
    mkdir -p "$backup_dir"

    [ -d "/etc/wireguard" ] && cp -r /etc/wireguard "$backup_dir/"
    [ -d "/etc/hysteria" ] && cp -r /etc/hysteria "$backup_dir/"
    [ -d "/opt/MTProxy" ] && cp -r /opt/MTProxy/.config "$backup_dir/mtproxy.config" 2>/dev/null || true
    [ -f "/etc/systemd/system/mtproxy.service" ] && cp /etc/systemd/system/mtproxy.service "$backup_dir/"
    [ -f "/etc/systemd/system/hysteria-server.service" ] && cp /etc/systemd/system/hysteria-server.service "$backup_dir/"
    [ -d "/opt/remnawave" ] && cp -r /opt/remnawave "$backup_dir/remnawave" 2>/dev/null || true

    success "Резервная копия создана: $backup_dir"
}

uninstall_panels_menu() {
    echo ""
    echo -e "${YELLOW}Выберите компонент для удаления:${NC}"
    echo "1) WireGuard"
    echo "2) 3x-ui"
    echo "3) Remnawave"
    echo "4) Hysteria2"
    echo "5) MTProxy"
    echo "6) Удалить всё"
    echo "0) Назад"
    echo ""
    read -p "Ваш выбор: " uninstall_choice

    case $uninstall_choice in
        1)
            systemctl disable --now wg-quick@wg0 >/dev/null 2>&1 || true
            rm -rf /etc/wireguard
            success "WireGuard удален"
            ;;
        2)
            if command -v x-ui >/dev/null 2>&1; then
                x-ui uninstall || warn "Не удалось выполнить x-ui uninstall, проверьте вручную"
            else
                warn "x-ui не найден, возможно уже удален"
            fi
            ;;
        3)
            if [ -d "/opt/remnawave" ]; then
                cd /opt/remnawave
                docker compose down >/dev/null 2>&1 || true
                cd /opt
                rm -rf /opt/remnawave
                success "Remnawave удален"
            else
                warn "Remnawave не найден"
            fi
            ;;
        4)
            systemctl disable --now hysteria-server >/dev/null 2>&1 || true
            rm -f /etc/systemd/system/hysteria-server.service
            systemctl daemon-reload
            rm -rf /etc/hysteria
            rm -f /usr/local/bin/hysteria
            success "Hysteria2 удален"
            ;;
        5)
            local mtproxy_port=""
            if [ -f "/opt/MTProxy/.config" ]; then
                mtproxy_port="$(grep '^MTPROXY_PORT=' /opt/MTProxy/.config | cut -d= -f2)"
            fi
            systemctl disable --now mtproxy >/dev/null 2>&1 || true
            rm -f /etc/systemd/system/mtproxy.service
            systemctl daemon-reload
            rm -rf /opt/MTProxy
            if [ -n "$mtproxy_port" ] && command -v ufw >/dev/null 2>&1; then
                ufw delete allow "${mtproxy_port}/tcp" >/dev/null 2>&1 || true
            fi
            success "MTProxy удален"
            ;;
        6)
            systemctl disable --now wg-quick@wg0 >/dev/null 2>&1 || true
            systemctl disable --now hysteria-server >/dev/null 2>&1 || true
            systemctl disable --now mtproxy >/dev/null 2>&1 || true
            rm -f /etc/systemd/system/hysteria-server.service /etc/systemd/system/mtproxy.service
            systemctl daemon-reload
            rm -rf /etc/wireguard /etc/hysteria /opt/MTProxy /opt/remnawave
            if command -v x-ui >/dev/null 2>&1; then
                x-ui uninstall >/dev/null 2>&1 || true
            fi
            success "Основные компоненты удалены"
            ;;
        0)
            return 0
            ;;
        *)
            warn "Неверный выбор"
            return 1
            ;;
    esac
}

# Main menu
show_main_menu() {
    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

    # Source banner
    if [ "$USE_UNICODE" -eq 1 ] && [ -f "$SCRIPT_DIR/banner.sh" ]; then
        source "$SCRIPT_DIR/banner.sh"
        show_gradient_banner
    else
        clear
        echo -e "${MAGENTA}╔════════════════════════════════════════╗${NC}"
        echo -e "${MAGENTA}║   Proxy-Core Installer                ║${NC}"
        echo -e "${MAGENTA}║   Version: ${SCRIPT_VERSION}                      ║${NC}"
        echo -e "${MAGENTA}╚════════════════════════════════════════╝${NC}"
        echo ""
    fi

    echo -e "  ${CYAN}╔═══════════════════════════════════════════════════════════════╗${NC}"
    echo -e "  ${CYAN}║${NC}  ${WHITE}УСТАНОВКА${NC}                                                   ${CYAN}║${NC}"
    echo -e "  ${CYAN}╚═══════════════════════════════════════════════════════════════╝${NC}"
    echo ""
    echo -e "  ${YELLOW}1.${NC} ${WHITE}Установить панель${NC}"
    echo -e "     ${GRAY}WireGuard, 3x-ui, Remnawave, Hysteria2, MTProxy${NC}"
    echo ""

    echo -e "  ${CYAN}╔═══════════════════════════════════════════════════════════════╗${NC}"
    echo -e "  ${CYAN}║${NC}  ${WHITE}УПРАВЛЕНИЕ${NC}                                                  ${CYAN}║${NC}"
    echo -e "  ${CYAN}╚═══════════════════════════════════════════════════════════════╝${NC}"
    echo ""
    echo -e "  ${YELLOW}2.${NC} ${WHITE}Управление сервисами${NC}"
    echo -e "     ${GRAY}Запуск, остановка, перезапуск панелей${NC}"
    echo ""
    echo -e "  ${YELLOW}3.${NC} ${WHITE}Резервное копирование${NC}"
    echo -e "     ${GRAY}Создание и восстановление бэкапов${NC}"
    echo ""
    echo -e "  ${YELLOW}4.${NC} ${WHITE}Обновить компоненты${NC}"
    echo -e "     ${GRAY}Обновление установленных панелей${NC}"
    echo ""

    echo -e "  ${CYAN}╔═══════════════════════════════════════════════════════════════╗${NC}"
    echo -e "  ${CYAN}║${NC}  ${WHITE}ДОПОЛНИТЕЛЬНО${NC}                                               ${CYAN}║${NC}"
    echo -e "  ${CYAN}╚═══════════════════════════════════════════════════════════════╝${NC}"
    echo ""
    echo -e "  ${YELLOW}5.${NC} ${WHITE}Удалить панель${NC}"
    echo -e "     ${GRAY}Полное удаление установленных компонентов${NC}"
    echo ""
    echo -e "  ${YELLOW}6.${NC} ${WHITE}Установить Selfsteal${NC}"
    echo -e "     ${GRAY}Маскировка трафика под обычный сайт${NC}"
    echo ""
    echo -e "  ${YELLOW}7.${NC} ${WHITE}Настроить Reverse Proxy${NC}"
    echo -e "     ${GRAY}Nginx, Caddy, HAProxy - установка и настройка${NC}"
    echo ""

    echo -e "  ${GRAY}─────────────────────────────────────────────────────────────────${NC}"
    echo ""
    echo -e "  ${YELLOW}9.${NC} ${WHITE}Сменить язык / Change language${NC}"
    echo -e "  ${YELLOW}0.${NC} ${WHITE}Выход / Exit${NC}"
    echo ""
    echo -e "  ${GRAY}─────────────────────────────────────────────────────────────────${NC}"
    echo ""
}

show_install_menu() {
    clear
    echo ""
    echo -e "  ${GREEN}╔═══════════════════════════════════════════════════════════════╗${NC}"
    echo -e "  ${GREEN}║${NC}  ${WHITE}Выберите панель для установки${NC}                             ${GREEN}║${NC}"
    echo -e "  ${GREEN}╚═══════════════════════════════════════════════════════════════╝${NC}"
    echo ""
    echo -e "  ${YELLOW}1.${NC} ${WHITE}WireGuard VPN${NC}"
    echo -e "     ${GRAY}Современный, быстрый и безопасный VPN${NC}"
    echo ""
    echo -e "  ${YELLOW}2.${NC} ${WHITE}3x-ui Panel${NC}"
    echo -e "     ${GRAY}VLESS, VMess, Trojan, Shadowsocks${NC}"
    echo ""
    echo -e "  ${YELLOW}3.${NC} ${WHITE}Remnawave Panel${NC}"
    echo -e "     ${GRAY}Современная панель с Docker${NC}"
    echo ""
    echo -e "  ${YELLOW}4.${NC} ${WHITE}Hysteria2 Proxy${NC}"
    echo -e "     ${GRAY}Высокоскоростной прокси с маскировкой${NC}"
    echo ""
    echo -e "  ${YELLOW}5.${NC} ${WHITE}MTProxy (Telegram)${NC}"
    echo -e "     ${GRAY}Официальный прокси для Telegram${NC}"
    echo ""
    echo -e "  ${GRAY}─────────────────────────────────────────────────────────────────${NC}"
    echo ""
    echo -e "  ${YELLOW}6.${NC} ${WHITE}Установить всё${NC}"
    echo -e "     ${GRAY}Последовательная установка всех панелей${NC}"
    echo ""
    echo -e "  ${YELLOW}0.${NC} ${WHITE}Назад / Back${NC}"
    echo ""
}

main() {
    check_root
    ensure_project_files
    load_defaults
    detect_os
    check_memory
    load_language

    while true; do
        show_main_menu
        read -p "Выберите опцию / Select option: " choice

        case $choice in
            1)
                show_install_menu
                read -p "Выберите / Select: " install_choice
                case $install_choice in
                    1)
                        install_packages
                        install_wireguard
                        ;;
                    2)
                        install_packages
                        install_3xui
                        ;;
                    3)
                        install_packages
                        select_reverse_proxy
                        install_remnawave
                        ;;
                    4)
                        install_packages
                        install_hysteria2
                        ;;
                    5)
                        install_packages
                        install_mtproxy
                        ;;
                    6)
                        install_packages
                        select_reverse_proxy
                        install_wireguard
                        install_3xui
                        install_remnawave
                        install_hysteria2
                        install_mtproxy
                        ;;
                    0) continue ;;
                    *) warn "Неверный выбор / Invalid choice" ;;
                esac
                read -p "Нажмите Enter / Press Enter..."
                ;;
            6)
                # Проверка перед вызовом
                if [ ! -d "/opt/remnawave" ] && [ ! -d "/opt/remnanode" ]; then
                    error "Сначала установите Remnawave (опция 1 -> 3)"
                    read -p "Нажмите Enter / Press Enter..."
                else
                    install_selfsteal
                    read -p "Нажмите Enter / Press Enter..."
                fi
                ;;
            2)
                run_project_script "manage.sh"
                ;;
            3)
                backup_configs
                read -p "Нажмите Enter / Press Enter..."
                ;;
            4)
                run_project_script "update.sh"
                ;;
            5)
                uninstall_panels_menu
                read -p "Нажмите Enter / Press Enter..."
                ;;
            7)
                # Запуск Reverse Proxy Manager
                if [ -f "$PROJECT_DIR/reverse-proxy-manager.sh" ]; then
                    bash "$PROJECT_DIR/reverse-proxy-manager.sh"
                elif [ -f "./reverse-proxy-manager.sh" ]; then
                    bash ./reverse-proxy-manager.sh
                else
                    error "reverse-proxy-manager.sh не найден"
                    read -p "Нажмите Enter / Press Enter..."
                fi
                ;;
            9)
                if [ "$MENU_LANG" = "en" ]; then
                    save_language "ru"
                else
                    save_language "en"
                fi
                ;;
            0)
                log "Выход / Exit"
                exit 0
                ;;
            *)
                warn "Неверный выбор / Invalid choice"
                sleep 1
                ;;
        esac
    done
}

main