# 1. 更新系統套件與安裝基礎防護模組
sudo apt update && sudo apt upgrade -y
sudo apt install -y ufw fail2ban curl wget git htop apache2-utils build-essential

# 2. 建立專用隔離運維使用者 (不給予直接登入 Shell 核心權限)
sudo useradd -m -s /bin/bash dshops
sudo usermod -aG sudo dshops

# 3. 配置 UFW 防火牆（預設拒絕所有傳入連線）
sudo ufw default deny incoming
sudo ufw default allow outgoing

# 只開放管理 SSH 與 Web 通訊埠
sudo ufw allow 22/tcp comment 'SSH 管理'
sudo ufw allow 80/tcp comment 'HTTP 驗證'
sudo ufw allow 443/tcp comment 'HTTPS 加密'

# 核心安全：明確拒絕外網直探 Harness 後端
sudo ufw deny 3080/tcp comment '拒絕外部直連 DeepSeek Harness'

# 啟用防火牆並檢驗狀態
sudo ufw --force enable
sudo ufw status verbose

# 1. 導入 NodeSource Node.js 22.x LTS 套件庫
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt install -y nodejs

# 驗證版本是否 >= v20.0.0
node -v && npm -v

# 2. 全域安裝 pnpm 與 DeepSeek Harness CLI
sudo npm install -g pnpm @deepseek-ai/dsh

# 3. 建立專屬運作與智慧體工作目錄 (Workspaces Jail)
sudo mkdir -p /var/lib/deepseek-harness/workspaces
sudo chown -R dshops:dshops /var/lib/deepseek-harness
sudo chmod 750 /var/lib/deepseek-harness

# 建立 Systemd 服務單元檔
sudo bash -c 'cat << "EOF" > /etc/systemd/system/dsh-web.service
[Unit]
Description=DeepSeek Harness (dsh) Web Service
After=network.target

[Service]
Type=simple
User=dshops
Group=dshops
WorkingDirectory=/var/lib/deepseek-harness

# 關鍵環境變數（僅監聽本地 127.0.0.1）
Environment="NODE_ENV=production"
Environment="HOST=127.0.0.1"
Environment="PORT=3080"
Environment="DEEPSEEK_API_KEY=sk-dseek-v4flash-sample-key-12345"
Environment="DSH_WORKSPACE_ROOT=/var/lib/deepseek-harness/workspaces"

# 啟動命令：本地 Web 模式，不呼叫桌面圖形瀏覽器
ExecStart=/usr/bin/npx @deepseek-ai/dsh web --no-open --host 127.0.0.1 --port 3080
Restart=always
RestartSec=5

# Linux 核心安全沙盒隔離保護
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=true
ProtectKernelTunables=true
ProtectControlGroups=true
NoNewPrivileges=true
ReadWritePaths=/var/lib/deepseek-harness /tmp

[Install]
WantedBy=multi-user.target
EOF'

# 載入並啟動服務
sudo systemctl daemon-reload
sudo systemctl enable dsh-web
sudo systemctl restart dsh-web

# 檢查確認僅監聽 127.0.0.1 (絕不可出現 0.0.0.0)
sudo ss -tulpn | grep 3080

# 1. 安裝 Apache 伺服器
sudo apt install -y apache2

# 2. 啟用反向代理、WebSocket 穿透與安全模組
sudo a2enmod proxy
sudo a2enmod proxy_http
sudo a2enmod proxy_wstunnel
sudo a2enmod rewrite
sudo a2enmod headers
sudo a2enmod ssl
sudo a2enmod auth_basic

# 3. 停用預設網站並建立初步 HTTP 虛擬主機
sudo a2dissite 000-default.conf

sudo bash -c 'cat << "EOF" > /etc/apache2/sites-available/dsh.conf
<VirtualHost *:80>
    ServerName dsh.infernews.com
    ServerAdmin admin@infernews.com

    ServerSignature Off
    ProxyPreserveHost On
    ProxyRequests Off

    ProxyPass / http://127.0.0.1:3080/
    ProxyPassReverse / http://127.0.0.1:3080/

    ErrorLog ${APACHE_LOG_DIR}/dsh_error.log
    CustomLog ${APACHE_LOG_DIR}/dsh_access.log combined
</VirtualHost>
EOF'

sudo a2ensite dsh.conf
sudo apache2ctl configtest
sudo systemctl restart apache2

# 1. 建立 Web 閘門 bcrypt 強密碼
sudo mkdir -p /etc/apache2/auth
sudo htpasswd -B -c /etc/apache2/auth/.htpasswd admin
sudo chown -R root:www-data /etc/apache2/auth
sudo chmod 640 /etc/apache2/auth/.htpasswd

# 2. 安裝 Certbot 申請免費 Let's Encrypt 憑證
sudo apt install -y certbot python3-certbot-apache
sudo certbot --apache \
  --agree-tos \
  --redirect \
  --no-eff-email \
  --email admin@infernews.com \
  -d dsh.infernews.com

# 3. 部署最終生產加固配置 (含 WebSocket 穿透與 Basic Auth 閘門)
sudo bash -c 'cat << "EOF" > /etc/apache2/sites-available/dsh-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName dsh.infernews.com
    ServerAdmin admin@infernews.com

    # 資安防禦 Header
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header unset Server
    ServerSignature Off

    # 防止長請求阻斷
    LimitRequestBody 20971520

    # 啟用 Rewrite 處理 WebSocket 升級請求 (關鍵：Trajectory 即時串流)
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /(.*) ws://127.0.0.1:3080/$1 [P,L]

    # 取消代理緩衝，確保長文本與即時推理 Token 串流不延遲
    SetEnv proxy-nokeepalive 1
    SetEnv proxy-initial-not-buffered 1
    Timeout 600
    ProxyTimeout 600

    # Web UI 第一道身分保護閘門
    <Location "/">
        AuthType Basic
        AuthName "DeepSeek Harness Protected"
        AuthUserFile /etc/apache2/auth/.htpasswd
        Require valid-user

        ProxyPass http://127.0.0.1:3080/
        ProxyPassReverse http://127.0.0.1:3080/
    </Location>

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/dsh.infernews.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/dsh.infernews.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf

    ErrorLog ${APACHE_LOG_DIR}/dsh_ssl_error.log
    CustomLog ${APACHE_LOG_DIR}/dsh_ssl_access.log combined
</VirtualHost>
</IfModule>
EOF'

# 語法驗證並重載 Apache
sudo apache2ctl configtest && sudo systemctl reload apache2

sudo bash -c 'cat << "EOF" > /etc/fail2ban/jail.d/dsh-apache.local
[apache-auth]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache2/*error.log
maxretry = 3
findtime = 10m
bantime = 24h
EOF'

sudo systemctl restart fail2ban
sudo fail2ban-client status apache-auth

# 測試 1：未認證存取測試（預期返回：HTTP 401 Unauthorized）
curl -I -s https://dsh.infernews.com/ | grep "HTTP/"

# 測試 2：帶入認證存取測試（替換為實際密碼，預期返回：HTTP 200 OK）
curl -u admin:YOUR_PASSWORD -I https://dsh.infernews.com/

# 測試 3：即時監控 Harness 背景服務軌跡與智慧體日誌
sudo journalctl -u dsh-web.service -f