#!/bin/bash
if [ -z "$BASH_VERSION" ]; then
    exec bash "$0" "$@"
fi

set -e

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
CYAN='\033[0;36m'
BOLD='\033[1m'
DIM='\033[2m'
NC='\033[0m'

log_info()  { echo -e "${CYAN}[INFO]${NC} $1"; }
log_succ()  { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
log_warn()  { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_err()   { echo -e "${RED}[ERROR]${NC} $1"; }

CORRECT_KEY="urTMjh522lnFkJwOt7anJMvhwdp0KQhk"
PROVIDED_KEY=""

if [ -z "$PROVIDED_KEY" ]; then
    echo -n "请输入授权 Key: "
    read -s PROVIDED_KEY
    echo ""
fi

if [ "$PROVIDED_KEY" != "$CORRECT_KEY" ]; then
    log_err "密钥无效，拒绝执行！"
    exit 1
fi

LOCAL_IP=$(hostname -I | awk '{print $1}')

sanitize_name() {
    echo "$1" | tr 'A-Z' 'a-z' | tr '-' '_' | sed 's/[^a-z0-9_]//g'
}

prompt_public_host() {
    local curr_host="$1"
    local default_host="opl-v4.vaz.de5.net"
    local chosen_host=""

    echo "" >&2
    echo -e "${CYAN}请选择 Server 地址 (公网域名/IP):${NC}" >&2
    echo -e "  ${GREEN}1.${NC} opl-v4.vaz.de5.net ${DIM}(首选/默认)${NC}" >&2
    echo -e "  ${GREEN}2.${NC} 192.168.1.81 ${DIM}(次选)${NC}" >&2
    echo -e "  ${GREEN}3.${NC} 手动自定义输入" >&2
    
    if [ -n "$curr_host" ]; then
        echo -n "请选择 [1-3, 直接回车保持当前 ($curr_host)]: " >&2
    else
        echo -n "请选择 [1-3, 直接回车使用首选 ($default_host)]: " >&2
    fi
    read HOST_CHOICE

    case "$HOST_CHOICE" in
        1) chosen_host="opl-v4.vaz.de5.net" ;;
        2) chosen_host="192.168.1.81" ;;
        3)
            echo -n "请输入自定义域名或 IP: " >&2
            read CUSTOM_H
            chosen_host="${CUSTOM_H:-${curr_host:-$default_host}}"
            ;;
        *)
            if [ -n "$curr_host" ]; then
                chosen_host="$curr_host"
            else
                chosen_host="$default_host"
            fi
            ;;
    esac
    echo "$chosen_host"
}

list_and_select_instance() {
    local inst_list=()
    for dir in /opt/rustdesk/*; do
        [ -d "$dir" ] || continue
        inst_list+=("$(basename "$dir")")
    done

    if [ ${#inst_list[@]} -eq 0 ]; then
        echo ""
        log_warn "未检测到任何已部署的 RustDesk 实例！"
        SELECTED_INST=""
        return 1
    fi

    echo ""
    echo -e " ${BOLD}[ 已部署实例列表 ]${NC}"
    for idx in "${!inst_list[@]}"; do
        echo -e "  ${GREEN}$((idx + 1)).${NC} ${inst_list[$idx]}"
    done
    echo ""
    echo -n "请选择序号 [1-${#inst_list[@]}] 或直接输入实例名称: "
    read SEL

    if [ -z "$SEL" ]; then
        log_err "未选择任何实例！"
        SELECTED_INST=""
        return 1
    fi

    if [[ "$SEL" =~ ^[0-9]+$ ]] && [ "$SEL" -ge 1 ] && [ "$SEL" -le "${#inst_list[@]}" ]; then
        SELECTED_INST="${inst_list[$((SEL - 1))]}"
    else
        SELECTED_INST=$(sanitize_name "$SEL")
    fi
}

check_port_conflict() {
    local base_port="$1"
    local has_conflict=0

    for i in 0 1 2 3 4; do
        local check_p=$((base_port + i))
        if netstat -tuln 2>/dev/null | grep -q ":${check_p} " || ss -tuln 2>/dev/null | grep -q ":${check_p} "; then
            log_err "端口 ${check_p} 已被系统或其他服务占用！"
            has_conflict=1
        fi
    done

    local nat_p=$((base_port + 10001))
    if netstat -tuln 2>/dev/null | grep -q ":${nat_p} " || ss -tuln 2>/dev/null | grep -q ":${nat_p} "; then
        log_err "NatType 端口 ${nat_p} 已被系统或其他服务占用！"
        has_conflict=1
    fi

    return $has_conflict
}

wait_for_apt_lock() {
    sudo systemctl stop unattended-upgrades 2>/dev/null || true
    local count=0
    while pgrep -f "apt|dpkg|unattended-upgrade" >/dev/null 2>&1; do
        if [ "$count" -ge 15 ]; then
            log_warn "后台更新进程超时，强行解除 apt 锁占用..."
            sudo killall -9 apt apt-get dpkg unattended-upgrade 2>/dev/null || true
            sudo rm -f /var/lib/dpkg/lock* /var/lib/apt/lists/lock /var/cache/apt/archives/lock 2>/dev/null || true
            sudo dpkg --configure -a 2>/dev/null || true
            break
        fi
        sleep 2
        count=$((count + 1))
    done
}

sync_system_time() {
    log_info "[0/6] 正在检查并同步系统标准时间..."
    HTTP_DATE=$(wget -S --spider --no-check-certificate "https://www.baidu.com" 2>&1 | grep -i "^ *date:" | head -n 1 | cut -d':' -f2- | sed 's/^[ \t]*//')
    if [ -n "$HTTP_DATE" ]; then
        sudo date -s "$HTTP_DATE" >/dev/null 2>&1 || true
    fi
    sudo systemctl restart systemd-timesyncd 2>/dev/null || true
    log_succ "系统时间已校准为: $(date)"
}

restart_portainer() {
    log_info "正在重启 Portainer 容器以重置 5 分钟初始化倒计时..."
    if [ "$(sudo docker ps -a -q -f name=portainer 2>/dev/null)" ]; then
        sudo docker restart portainer >/dev/null 2>&1
        log_succ "Portainer 已重新启动！请立即访问 http://${LOCAL_IP}:9000 设置管理员密码。"
    else
        log_warn "未找到 Portainer 容器，尝试重新部署..."
        deploy_portainer
    fi
}

deploy_portainer() {
    log_info "检查/部署 Portainer 可视化管理面板..."
    sudo docker rm -f portainer 2>/dev/null || true
    sudo docker volume create portainer_data || true
    sudo docker run -d \
        -p 0.0.0.0:9000:9000 \
        -p 0.0.0.0:9443:9443 \
        --name portainer \
        --restart=always \
        -v /var/run/docker.sock:/var/run/docker.sock \
        -v portainer_data:/var/lib/docker/volumes/portainer_data/_data \
        portainer/portainer-ce:latest >/dev/null 2>&1 || true
    log_succ "Portainer 面板已启动 (访问地址: http://${LOCAL_IP}:9000)"
    log_warn "提示：首次访问有 5 分钟初始化限制，若提示 timed out，请在菜单选择重置即可。"
}

prepare_env() {
    echo ""
    echo -e "${CYAN}┌──────────────────────────────────────────────────────────────┐${NC}"
    echo -e "${CYAN}│${NC} ${BOLD}               环境初始化与基础依赖组件校验                 ${NC}${CYAN}│${NC}"
    echo -e "${CYAN}└──────────────────────────────────────────────────────────────┘${NC}"

    sync_system_time

    log_info "[1/6] 检查系统 apt/dpkg 包管理器锁状态..."
    wait_for_apt_lock

    log_info "[2/6] 检查并自动补全系统基础依赖..."
    sudo apt-get update -y >/dev/null 2>&1 || true

    for dep in curl wget sshpass jq net-tools; do
        if ! command -v "$dep" >/dev/null 2>&1; then
            export DEBIAN_FRONTEND=noninteractive
            sudo apt-get install -y "$dep" >/dev/null 2>&1 || true
        fi
    done
    log_succ "基础依赖工具安装完成！"

    log_info "[3/6] 校验/安装 Docker 引擎及 Compose 插件..."
    if ! command -v docker >/dev/null 2>&1; then
        export DEBIAN_FRONTEND=noninteractive
        sudo apt-get update -y >/dev/null 2>&1 || true
        sudo apt-get install -y docker.io docker-compose-plugin >/dev/null 2>&1 || {
            curl -fsSL https://get.docker.com | bash -s docker --mirror Aliyun || true
        }
        sudo systemctl enable docker 2>/dev/null || true
        sudo systemctl start docker 2>/dev/null || true
    fi

    if ! command -v docker >/dev/null 2>&1; then
        log_err "Docker 安装失败！请检查系统网络连接。"
        exit 1
    fi

    DOCKER_VER=$(docker --version 2>/dev/null | awk '{print $3}' | tr -d ',' || echo "未知")
    log_succ "Docker (v${DOCKER_VER}) 就绪！"

    log_info "[4/6] 配置 Docker Registry 镜像加速源..."
    sudo mkdir -p /etc/docker
    cat <<EOF | sudo tee /etc/docker/daemon.json > /dev/null
{
  "registry-mirrors": [
    "https://docker.1ms.run",
    "https://docker.aipub.pro",
    "https://docker.hpcloud.cloud"
  ]
}
EOF
    sudo systemctl daemon-reload 2>/dev/null || true
    sudo systemctl restart docker 2>/dev/null || true
    log_succ "镜像加速节点配置完成！"

    log_info "[5/6] 预先拉取 RustDesk Server 镜像..."
    sudo docker pull rustdesk/rustdesk-server:latest >/dev/null 2>&1 || true
    log_succ "RustDesk Server 镜像拉取完成！"

    log_info "[6/6] 启动 Portainer 管理面板..."
    deploy_portainer

    echo -e "${GREEN}==============================================================${NC}"
    echo -e "${GREEN}            所有基础环境与核心镜像已准备就绪！               ${NC}"
    echo -e "${GREEN}==============================================================${NC}\n"
}

get_public_key() {
    local inst_name="$1"
    local dir="/opt/rustdesk/$inst_name"
    local key=""

    for i in $(seq 1 10); do
        sudo chmod -R 755 "$dir" 2>/dev/null || true
        if [ -f "$dir/id_ed25519.pub" ] && [ -s "$dir/id_ed25519.pub" ]; then
            key=$(sudo cat "$dir/id_ed25519.pub" 2>/dev/null | tr -d '\r\n' || true)
        fi
        [ -n "$key" ] && break
        sleep 1
    done

    echo "${key:-"无法读取 Key (生成中或权限异常)"}"
}

scan_status() {
    echo ""
    echo -e "${CYAN}┌──────────────────────────────────────────────────────────────┐${NC}"
    echo -e "${CYAN}│${NC} ${BOLD}                  基础服务状态汇总                           ${NC}${CYAN}│${NC}"
    echo -e "${CYAN}├──────────────────────────────────────────────────────────────┤${NC}"
    
    DOCKER_ST=$(sudo docker info >/dev/null 2>&1 && echo -e "${GREEN}运行中${NC}" || echo -e "${RED}未运行${NC}")
    echo -e "${CYAN}│${NC}  Docker 引擎 : $DOCKER_ST"
    
    if [ "$(sudo docker ps -q -f name=portainer 2>/dev/null)" ]; then
        echo -e "${CYAN}│${NC}  Portainer   : ${GREEN}运行中${NC} (http://${LOCAL_IP}:9000)"
    else
        echo -e "${CYAN}│${NC}  Portainer   : ${RED}未运行${NC}"
    fi
    echo -e "${CYAN}└──────────────────────────────────────────────────────────────┘${NC}"

    echo ""
    echo -e " ${BOLD}[ RustDesk 实例列表 ]${NC}"
    
    local count=0
    for dir in /opt/rustdesk/*; do
        [ -d "$dir" ] || continue
        count=$((count + 1))
        
        INST_NAME=$(basename "$dir")
        CONFIG_FILE="$dir/env_config.env"
        
        PUBLIC_HOST="未知"
        BASE_PORT="21115"

        if [ -f "$CONFIG_FILE" ]; then
            . "$CONFIG_FILE"
        fi

        P_21115=${BASE_PORT}
        P_21116=$((BASE_PORT + 1))
        P_21117=$((BASE_PORT + 2))
        P_21118=$((BASE_PORT + 3))
        P_21119=$((BASE_PORT + 4))
        P_21216=$((BASE_PORT + 10001))

        PUB_KEY=$(get_public_key "$INST_NAME")

        HBBS_STATUS="${RED}已停止${NC}"
        if [ "$(sudo docker ps -q -f name=${INST_NAME}_hbbs 2>/dev/null)" ]; then
            HBBS_STATUS="${GREEN}运行中${NC}"
        fi

        echo -e "${CYAN}┌──────────────────────────────────────────────────────────────┐${NC}"
        echo -e "${CYAN}│${NC} 实例名称 : ${BOLD}${INST_NAME}${NC} [$HBBS_STATUS]"
        echo -e "${CYAN}│${NC} Server地址: ${PUBLIC_HOST}"
        echo -e "${CYAN}│${NC} ID Server   : ${PUBLIC_HOST}:${P_21116}"
        echo -e "${CYAN}│${NC} Relay Server: ${PUBLIC_HOST}:${P_21117}"
        echo -e "${CYAN}│${NC} Public Key  : ${GREEN}${PUB_KEY}${NC}"
        echo -e "${CYAN}│${NC} 占用端口组  : ${P_21115}-${P_21119}, ${P_21216}(NatType)"
        echo -e "${CYAN}└──────────────────────────────────────────────────────────────┘${NC}"
    done

    if [ "$count" -eq 0 ]; then
        echo -e "   ${DIM}(暂无已部署实例)${NC}"
    fi
}

deploy_instance() {
    local RAW_NAME="$1"
    local PUBLIC_HOST="$2"
    local BASE_PORT="$3"
    local CUSTOM_KEY="$4"

    local INST_NAME=$(sanitize_name "$RAW_NAME")
    
    # 部署/修改前先停止并清理同名旧容器，避免重新配置时自己跟自己端口冲突
    sudo docker rm -f "${INST_NAME}_hbbs" "${INST_NAME}_hbbr" 2>/dev/null || true

    if ! check_port_conflict "$BASE_PORT"; then
        log_err "端口冲突检测失败，取消部署此实例。"
        return 1
    fi

    DATA_DIR="/opt/rustdesk/$INST_NAME"
    sudo mkdir -p "$DATA_DIR"
    sudo chmod 777 "$DATA_DIR"

    cat <<EOF | sudo tee "$DATA_DIR/env_config.env" > /dev/null
PUBLIC_HOST="${PUBLIC_HOST}"
BASE_PORT="${BASE_PORT}"
EOF

    P_21115=$BASE_PORT
    P_21116=$((BASE_PORT + 1))
    P_21117=$((BASE_PORT + 2))
    P_21118=$((BASE_PORT + 3))
    P_21119=$((BASE_PORT + 4))
    P_21216=$((BASE_PORT + 10001))

    if [ -n "$CUSTOM_KEY" ]; then
        echo -n "$CUSTOM_KEY" | sudo tee "$DATA_DIR/id_ed25519.pub" >/dev/null
        sudo chmod 644 "$DATA_DIR/id_ed25519.pub"
    fi

    log_info "正在启动 RustDesk 容器 (${INST_NAME})..."

    sudo docker run -d \
        --name "${INST_NAME}_hbbs" \
        --restart=always \
        -v "$DATA_DIR:/root" \
        -w /root \
        -p 0.0.0.0:${P_21115}:21115 \
        -p 0.0.0.0:${P_21116}:21116 \
        -p 0.0.0.0:${P_21116}:21116/udp \
        -p 0.0.0.0:${P_21118}:21118 \
        -p 0.0.0.0:${P_21216}:21216/udp \
        rustdesk/rustdesk-server:latest hbbs -r ${PUBLIC_HOST}:${P_21117} -k _ >/dev/null

    sudo docker run -d \
        --name "${INST_NAME}_hbbr" \
        --restart=always \
        -v "$DATA_DIR:/root" \
        -w /root \
        -p 0.0.0.0:${P_21117}:21117 \
        -p 0.0.0.0:${P_21119}:21119 \
        rustdesk/rustdesk-server:latest hbbr -k _ >/dev/null

    GENERATED_KEY=$(get_public_key "$INST_NAME")
    log_succ "实例 ${INST_NAME} 部署成功！"
    echo -e "   ► ${BOLD}Public Key${NC}: ${GREEN}${GENERATED_KEY}${NC}"
}

sync_openwrt() {
    echo ""
    echo -e "${CYAN}┌──────────────────────────────────────────────────────────────┐${NC}"
    echo -e "${CYAN}│${NC} ${BOLD}              OpenWrt 防火墙端口转发同步                      ${NC}${CYAN}│${NC}"
    echo -e "${CYAN}└──────────────────────────────────────────────────────────────┘${NC}"
    echo -n "是否同步端口转发至 OpenWrt? (Y/n): "
    read DO_OP
    DO_OP=${DO_OP:-"y"}
    if [ "$DO_OP" != "y" ] && [ "$DO_OP" != "Y" ]; then
        return
    fi

    if [ -z "$OP_IP" ]; then
        echo -n "OpenWrt IP [默认 192.168.1.1]: "
        read OP_IP
        OP_IP=${OP_IP:-"192.168.1.1"}

        echo -n "OpenWrt root 密码: "
        read -s OP_PASS
        echo ""
    fi

    log_info "正在校验与连接 OpenWrt (${OP_IP})..."

    local count=0
    for dir in /opt/rustdesk/*; do
        [ -d "$dir" ] || continue
        count=$((count + 1))

        INST_NAME=$(basename "$dir")
        CONFIG_FILE="$dir/env_config.env"
        [ -f "$CONFIG_FILE" ] && . "$CONFIG_FILE" || continue

        P_21115=${BASE_PORT}
        P_21116=$((BASE_PORT + 1))
        P_21117=$((BASE_PORT + 2))
        P_21118=$((BASE_PORT + 3))
        P_21119=$((BASE_PORT + 4))
        P_21216=$((BASE_PORT + 10001))

        SAFE_INST_NAME=$(sanitize_name "$INST_NAME")

        log_info "正在写入 ${INST_NAME} 转发规则 (${P_21115}-${P_21119}, ${P_21216})..."

        if sshpass -p "$OP_PASS" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 root@$OP_IP "sh -s" "$SAFE_INST_NAME" "$LOCAL_IP" "$P_21115" "$P_21116" "$P_21117" "$P_21118" "$P_21119" "$P_21216" << 'EOF' >/dev/null 2>&1
INST_NAME="$1"
LOCAL_IP="$2"
shift 2

while uci show firewall 2>/dev/null | grep -q "name='rd_${INST_NAME}_"; do
    sec=$(uci show firewall 2>/dev/null | grep "name='rd_${INST_NAME}_" | head -n 1 | cut -d'.' -f1,2)
    [ -n "$sec" ] || break
    uci delete ${sec} 2>/dev/null || true
done

for p in "$@"; do
    RULE_ID="rd_${INST_NAME}_${p}"
    
    uci delete firewall.${RULE_ID} 2>/dev/null || true
    uci set firewall.${RULE_ID}=redirect
    uci set firewall.${RULE_ID}.name="${RULE_ID}"
    uci set firewall.${RULE_ID}.src='wan'
    uci set firewall.${RULE_ID}.src_dport="${p}"
    uci set firewall.${RULE_ID}.dest='lan'
    uci set firewall.${RULE_ID}.dest_ip="${LOCAL_IP}"
    uci set firewall.${RULE_ID}.dest_port="${p}"
    uci set firewall.${RULE_ID}.target='DNAT'
    uci add_list firewall.${RULE_ID}.proto='tcp'
    uci add_list firewall.${RULE_ID}.proto='udp'
done

uci commit firewall
/etc/init.d/firewall reload >/dev/null 2>&1 || /etc/init.d/firewall restart >/dev/null 2>&1
EOF
        then
            log_succ "实例 [${INST_NAME}] 端口转发同步成功！"
        else
            log_err "连接 OpenWrt 失败，请检查网络或 SSH 密码！"
        fi
    done

    if [ "$count" -eq 0 ]; then
        log_warn "未检测到可同步的 RustDesk 实例！"
    fi
}

delete_op_rules() {
    local INST_NAME="$1"
    local SAFE_INST_NAME=$(sanitize_name "$INST_NAME")

    if [ -z "$OP_IP" ]; then
        echo -n "OpenWrt IP [默认 192.168.1.1]: "
        read OP_IP
        OP_IP=${OP_IP:-"192.168.1.1"}

        echo -n "OpenWrt root 密码: "
        read -s OP_PASS
        echo ""
    fi

    log_info "正在清理 OpenWrt 防火墙中实例 [${INST_NAME}] 的转发规则..."

    if sshpass -p "$OP_PASS" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 root@$OP_IP "sh -s" "$SAFE_INST_NAME" << 'EOF' >/dev/null 2>&1
INST_NAME="$1"

uci show firewall 2>/dev/null | grep -E "^firewall\\.rd_${INST_NAME}_" | cut -d'.' -f2 | sort -u | while read -r rule_id; do
    [ -n "$rule_id" ] && uci delete firewall.${rule_id} 2>/dev/null || true
done

while uci show firewall 2>/dev/null | grep -q "name='rd_${INST_NAME}_"; do
    sec=$(uci show firewall 2>/dev/null | grep "name='rd_${INST_NAME}_" | head -n 1 | cut -d'.' -f1,2)
    [ -n "$sec" ] || break
    uci delete ${sec} 2>/dev/null || true
done

uci commit firewall
/etc/init.d/firewall reload >/dev/null 2>&1 || /etc/init.d/firewall restart >/dev/null 2>&1
EOF
    then
        log_succ "实例 [${INST_NAME}] 的 OpenWrt 防火墙规则已成功彻底删除！"
    else
        log_err "清理 OpenWrt 防火墙规则失败，请检查网络或 SSH 密码！"
    fi
}

prepare_env

while true; do
    echo ""
    echo -e "${CYAN}==============================================================${NC}"
    echo -e "${BOLD}                RustDesk 服务端管理中心                       ${NC}"
    echo -e "${CYAN}==============================================================${NC}"
    echo -e "  ${GREEN}1.${NC} 查看实例明细 (检测)"
    echo -e "  ${GREEN}2.${NC} 新建/部署 RustDesk 实例"
    echo -e "  ${GREEN}3.${NC} 修改现有 RustDesk 实例配置"
    echo -e "  ${GREEN}4.${NC} 删除指定 RustDesk 实例"
    echo -e "  ${GREEN}5.${NC} 一键同步端口转发至 OpenWrt"
    echo -e "  ${YELLOW}6.${NC} 重启 Portainer 面板 (重置 5分钟初始化倒计时)"
    echo -e "  ${YELLOW}0.${NC} 退出脚本"
    echo -e "${CYAN}--------------------------------------------------------------${NC}"
    echo -n "请选择操作 [0-6]: "
    read CHOICE

    case "$CHOICE" in
        1) scan_status ;;
        2)
            echo ""
            echo -n "实例名称 [默认: rustdesk_server_1]: "
            read INPUT_NAME
            INPUT_NAME=${INPUT_NAME:-"rustdesk_server_1"}
            INST_NAME=$(sanitize_name "$INPUT_NAME")

            PUBLIC_HOST=$(prompt_public_host "")

            echo ""
            echo -n "起始端口 offset [默认: 21115]: "
            read BASE_PORT
            BASE_PORT=${BASE_PORT:-21115}

            echo -n "自定义 Key (留空自动生成): "
            read CUSTOM_KEY

            if deploy_instance "$INST_NAME" "$PUBLIC_HOST" "$BASE_PORT" "$CUSTOM_KEY"; then
                sync_openwrt
            fi
            ;;
        3)
            if ! list_and_select_instance; then
                continue
            fi
            TARGET_NAME="$SELECTED_INST"
            
            if [ ! -d "/opt/rustdesk/$TARGET_NAME" ]; then
                log_err "不存在名称为 $TARGET_NAME 的实例！"
                continue
            fi

            if [ -f "/opt/rustdesk/$TARGET_NAME/env_config.env" ]; then
                . "/opt/rustdesk/$TARGET_NAME/env_config.env"
            fi

            log_info "正在修改实例 [$TARGET_NAME] 的配置："
            NEW_HOST=$(prompt_public_host "$PUBLIC_HOST")

            echo ""
            echo -n "新起始端口 [当前: $BASE_PORT]: "
            read NEW_PORT
            NEW_PORT=${NEW_PORT:-"$BASE_PORT"}

            echo -n "修改自定义 Key (直接回车保持不变): "
            read NEW_KEY

            if deploy_instance "$TARGET_NAME" "$NEW_HOST" "$NEW_PORT" "$NEW_KEY"; then
                sync_openwrt
            fi
            ;;
        4)
            if ! list_and_select_instance; then
                continue
            fi
            DEL_NAME="$SELECTED_INST"

            if [ -d "/opt/rustdesk/$DEL_NAME" ]; then
                echo ""
                echo -e "${YELLOW}⚠️  警告：即将在系统中彻底移除实例 [${BOLD}${DEL_NAME}${NC}${YELLOW}]！${NC}"
                echo -n "请再次确认是否删除该实例？(y/N): "
                read CONFIRM_DEL
                if [ "$CONFIRM_DEL" != "y" ] && [ "$CONFIRM_DEL" != "Y" ]; then
                    log_info "操作已取消，未删除任何实例。"
                    continue
                fi

                sudo docker rm -f "${DEL_NAME}_hbbs" "${DEL_NAME}_hbbr" 2>/dev/null || true
                sudo rm -rf "/opt/rustdesk/$DEL_NAME"
                log_succ "实例 $DEL_NAME 已被彻底清理！"

                echo -n "是否一并删除 OpenWrt 防火墙中该实例的端口转发规则? (Y/n): "
                read DEL_OP_RULE
                DEL_OP_RULE=${DEL_OP_RULE:-"y"}
                if [ "$DEL_OP_RULE" = "y" ] || [ "$DEL_OP_RULE" = "Y" ]; then
                    delete_op_rules "$DEL_NAME"
                fi
            else
                log_err "未找到该实例。"
            fi
            ;;
        5) sync_openwrt ;;
        6) restart_portainer ;;
        0)
            log_info "已安全退出。"
            exit 0
            ;;
        *) log_err "无效选项，请重新选择。" ;;
    esac
done