New-NetFirewallRule `
  -DisplayName 'Hysteria2 UDP 443' `
  -Direction Inbound -Protocol UDP -LocalPort 443 -Action Allow

New-NetFirewallRule `
  -DisplayName 'Hysteria2 ACME TCP 80' `
  -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow

$ErrorActionPreference = 'Stop'
$folder = 'D:\hysteria'
$domain = 'speedtest.20010501.xyz'
$email = (Read-Host '输入 ACME 证书邮箱').Trim()
$lanIP = (Read-Host '输入 Windows 局域网 IPv4（如 192.168.2.23）').Trim()

if ([string]::IsNullOrWhiteSpace($email)) { throw '邮箱不能为空' }
$parsedIP = $null
if (-not [System.Net.IPAddress]::TryParse($lanIP, [ref]$parsedIP) -or
    $parsedIP.AddressFamily -ne [System.Net.Sockets.AddressFamily]::InterNetwork) {
    throw '请输入有效的 IPv4 地址'
}

New-Item -ItemType Directory -Path $folder -Force | Out-Null
New-Item -ItemType Directory -Path "$folder\acme" -Force | Out-Null

# 由系统加密随机数生成器创建 32 字节随机密码
$bytes = New-Object byte[] 32
$rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
try { $rng.GetBytes($bytes) } finally { $rng.Dispose() }
$pass = -join ($bytes | ForEach-Object { $_.ToString('x2') })

# 生成服务端 YAML（密码仅由 0-9a-f 组成）
$serverConfig = @"
listen: ":443"

acme:
  domains:
    - $domain
  email: "$email"
  type: http
  dir: "D:/hysteria/acme"

auth:
  type: password
  password: "$pass"
"@

# 生成安卓 sing-box JSON
$androidConfig = @{
    log = @{ level = 'info' }
    inbounds = @(
        @{
            type = 'tun'
            tag = 'tun-in'
            address = @('172.19.0.1/30')
            auto_route = $true
            stack = 'mixed'
        }
    )
    outbounds = @(
        @{
            type = 'hysteria2'
            tag = 'hy2'
            server = $domain
            server_port = 443
            password = $pass
            tls = @{
                enabled = $true
                server_name = $domain
            }
        }
    )
    route = @{
        auto_detect_interface = $true
        final = 'hy2'
    }
}

$utf8 = New-Object System.Text.UTF8Encoding($false)
[System.IO.File]::WriteAllText("$folder\config.yaml", $serverConfig, $utf8)
[System.IO.File]::WriteAllText("$folder\android-singbox.json", `
    ($androidConfig | ConvertTo-Json -Depth 20), $utf8)

# 校验两份文件已生成，且客户端密码与本次生成的密码相同
$check = Get-Content "$folder\android-singbox.json" -Raw | ConvertFrom-Json
if ([string]::IsNullOrWhiteSpace($check.outbounds[0].password) -or
    $check.outbounds[0].password -ne $pass) {
    throw '安卓配置生成失败：密码错误或为空'
}

Write-Host '已生成两份配置文件：' -ForegroundColor Green
Write-Host "$folder\config.yaml"
Write-Host "$folder\android-singbox.json"
Write-Host "Windows 局域网 IP（稍后填入 Moonlight）：$lanIP"
Write-Host '两端已使用同一随机密码。不要公开配置文件。'

cd D:\hysteria
.\hysteria.exe server -c config.yaml

ipconfig

$action = New-ScheduledTaskAction `
  -Execute 'D:\hysteria\hysteria.exe' `
  -Argument 'server -c D:\hysteria\config.yaml' `
  -WorkingDirectory 'D:\hysteria'

$trigger = New-ScheduledTaskTrigger -AtStartup

$settings = New-ScheduledTaskSettingsSet `
  -RestartCount 3 `
  -RestartInterval (New-TimeSpan -Minutes 1) `
  -ExecutionTimeLimit ([TimeSpan]::Zero) `
  -StartWhenAvailable

$principal = New-ScheduledTaskPrincipal `
  -UserId 'SYSTEM' `
  -LogonType ServiceAccount `
  -RunLevel Highest

Register-ScheduledTask `
  -TaskName 'Hysteria2 Server' `
  -Action $action `
  -Trigger $trigger `
  -Settings $settings `
  -Principal $principal `
  -Description 'Hysteria2 server startup' `
  -Force

Start-ScheduledTask -TaskName 'Hysteria2 Server'

Get-ScheduledTask -TaskName 'Hysteria2 Server'
Get-Process hysteria -ErrorAction SilentlyContinue

# 停止
Stop-ScheduledTask -TaskName 'Hysteria2 Server'

# 启动
Start-ScheduledTask -TaskName 'Hysteria2 Server'

# 禁用开机启动
Disable-ScheduledTask -TaskName 'Hysteria2 Server'

# 恢复开机启动
Enable-ScheduledTask -TaskName 'Hysteria2 Server'