#!/bin/bash
# ============================================================
#   OpenCloudOS 9 OpenVPN 一键部署脚本  v5.0 (稳定兼容版)
#   日期：2026-10-30
#
#   【核心设计】
#   - TCP 443 穿透（几乎不被运营商拦截）
#   - ECDSA P-256 证书（握手包小，稳定）
#   - tls-crypt 静态密钥（抗扫描）
#   - server.conf 自动补全 data-ciphers-fallback（兼容 2.4/2.5/2.6 客户端）
#   - 客户端 ovpn 用保守语法（无 data-ciphers、无 block-outside-dns，跨平台 FATAL 全删）
#
#   【两种运行模式】
#   1. 快速路径（推荐）：检测到已有完整环境 → 只生成客户端证书 + ovpn，10 秒搞定
#   2. 全新安装：OpenVPN + easy-rsa + PKI + server.conf + tls-crypt 全套
#
#   【用法】
#   bash co9-sos-w-443.sh <客户端名> [公网IP]
#   bash co9-sos-w-443.sh pc0 43.133.186.127
# ============================================================
set -e

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
NC='\033[0m'

# ==================== 参数 ====================
CLIENT_NAME="${1:-pc0}"
PUB_IP_PARM="${2:-}"
VPN_PORT="443"
PROTOCOL="tcp"
SERVER_CN="vpn-server"
NETWORK="10.8.0.0"
DNS1="119.29.29.29"
DNS2="223.5.5.5"
MAX_CLIENTS="50"

EASYRSA_DIR="/etc/openvpn/easy-rsa"
PKI_DIR="$EASYRSA_DIR/pki"
SERVER_DIR="/etc/openvpn/server"
CLIENT_DIR="/etc/openvpn/client"

echo -e "${GREEN}==============================================${NC}"
echo -e "${GREEN}  OpenCloudOS 9 OpenVPN 一键部署 v5.0${NC}"
echo -e "${GREEN}  TCP 443 / ECDSA P-256 / 兼容 2.4-2.7${NC}"
echo -e "${GREEN}==============================================${NC}"

if [ "$(id -u)" != "0" ]; then
    echo -e "${RED}✗ 必须 root 用户执行${NC}"; exit 1
fi

# ==================== 公网IP ====================
if [ -n "$PUB_IP_PARM" ] && echo "$PUB_IP_PARM" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
    PUBLIC_IP="$PUB_IP_PARM"
else
    echo -e "${CYAN}探测公网IP...${NC}"
    PUBLIC_IP=""
    for src in "https://api.ipify.org" "https://ifconfig.me" "https://ipinfo.io/ip" "https://ip.sb" "https://checkip.amazonaws.com"; do
        PUBLIC_IP=$(curl -s --connect-timeout 4 "$src" 2>/dev/null | tr -d '[:space:]')
        echo "$PUBLIC_IP" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' && break
    done
    if ! echo "$PUBLIC_IP" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
        PUBLIC_IP=$(curl -s --connect-timeout 3 http://169.254.0.23/latest/meta-data/public-ipv4 2>/dev/null | tr -d '[:space:]')
    fi
    if ! echo "$PUBLIC_IP" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
        PUBLIC_IP=$(hostname -I 2>/dev/null | awk '{print $1}')
    fi
fi
if ! echo "$PUBLIC_IP" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
    echo -e "${RED}✗ 取不到公网IP${NC}"; exit 1
fi
echo -e "  公网IP: ${GREEN}$PUBLIC_IP${NC}"
echo -e "  客户端名: ${GREEN}$CLIENT_NAME${NC}"
echo ""

# ==================== 快速路径检测 ====================
FAST_PATH=false
FAST_REASONS=""

check() { test -e "$1" && echo "OK" || echo "MISSING"; }

echo -e "${YELLOW}[0] 检测现有环境...${NC}"
echo "  server.conf:    $(check $SERVER_DIR/server.conf)"
echo "  CA证书:          $(check $SERVER_DIR/ca.crt)"
echo "  服务器证书:      $(check $SERVER_DIR/${SERVER_CN}.crt)"
echo "  tls-crypt.key:   $(check $SERVER_DIR/tls-crypt.key)"
echo "  easy-rsa:        $(check $PKI_DIR)"
echo "  OpenVPN active:  $(systemctl is-active openvpn-server@server 2>/dev/null || echo MISSING)"

if [ -f $SERVER_DIR/server.conf ] \
   && [ -f $SERVER_DIR/ca.crt ] \
   && [ -f $SERVER_DIR/${SERVER_CN}.crt ] \
   && [ -f $SERVER_DIR/tls-crypt.key ] \
   && [ -d $PKI_DIR ] \
   && [ "$(systemctl is-active openvpn-server@server 2>/dev/null)" = "active" ]; then
    FAST_PATH=true
    echo -e "  ${GREEN}✓ 完整环境已存在 → 快速路径（跳过安装步骤）${NC}"
else
    echo -e "  ${YELLOW}快速路径条件不满足 → 完整安装流程${NC}"
fi

# ==================== 快速路径 ====================
if $FAST_PATH; then
    echo ""
    echo -e "${CYAN}========== 快速路径 ==========${NC}"

    # --- 1. server.conf 补全兼容性 ---
    echo -e "${YELLOW}[补] 检查 server.conf 兼容性...${NC}"

    HAS_DC=$(grep -c "^data-ciphers " $SERVER_DIR/server.conf 2>/dev/null || echo 0)
    HAS_DCFB=$(grep -c "^data-ciphers-fallback " $SERVER_DIR/server.conf 2>/dev/null || echo 0)
    HAS_TLSCRYPT=$(grep -c "^tls-crypt " $SERVER_DIR/server.conf 2>/dev/null || echo 0)
    HAS_ECDH=$(grep -c "^ecdh-curve " $SERVER_DIR/server.conf 2>/dev/null || echo 0)

    if [ "$HAS_DC" -eq 0 ]; then
        echo -e "  ${CYAN}加 data-ciphers AES-256-CBC${NC}"
        sed -i '/^cipher /a data-ciphers AES-256-CBC' $SERVER_DIR/server.conf
    else
        echo -e "  ${GREEN}✓ data-ciphers 存在${NC}"
    fi

    if [ "$HAS_DCFB" -eq 0 ]; then
        echo -e "  ${CYAN}加 data-ciphers-fallback AES-256-CBC (兼容 2.4 客户端)${NC}"
        sed -i '/^data-ciphers AES-256-CBC$/a data-ciphers-fallback AES-256-CBC' $SERVER_DIR/server.conf
    else
        echo -e "  ${GREEN}✓ data-ciphers-fallback 存在${NC}"
    fi

    if [ "$HAS_TLSCRYPT" -eq 0 ]; then
        echo -e "  ${YELLOW}⚠ server.conf 缺 tls-crypt 指令${NC}"
    else
        echo -e "  ${GREEN}✓ tls-crypt 存在${NC}"
    fi

    # --- 2. easy-rsa 确认 ---
    if [ ! -d "$EASYRSA_DIR" ]; then
        echo -e "${YELLOW}easy-rsa 目录不在 /etc/openvpn/easy-rsa，搜索中...${NC}"
        for d in /usr/share/easy-rsa/3 /usr/share/easy-rsa; do
            if [ -f "$d/easyrsa" ]; then
                mkdir -p $EASYRSA_DIR
                cp -r $d/* $EASYRSA_DIR/
                break
            fi
        done
    fi
    EASYRSA_CMD="$EASYRSA_DIR/easyrsa"
    if [ ! -f "$EASYRSA_CMD" ]; then
        echo -e "${RED}✗ easyrsa 命令找不到${NC}"; exit 1
    fi

    # --- 3. 签客户端证书 ---
    echo ""
    echo -e "${YELLOW}[补] 签客户端证书 [CN=$CLIENT_NAME]...${NC}"
    cd $EASYRSA_DIR
    export EASYRSA_BATCH=1

    if [ ! -f pki/issued/$CLIENT_NAME.crt ]; then
        yes | $EASYRSA_CMD --batch gen-req "$CLIENT_NAME" nopass 2>&1 | tail -3
        yes | $EASYRSA_CMD --batch sign-req client "$CLIENT_NAME" 2>&1 | tail -3
        echo -e "  ${GREEN}✓ 新签发${NC}"
    else
        echo -e "  ${CYAN}已存在, 覆盖重建${NC}"
        yes | $EASYRSA_CMD --batch gen-req "$CLIENT_NAME" nopass 2>&1 | tail -3
        yes | $EASYRSA_CMD --batch sign-req client "$CLIENT_NAME" 2>&1 | tail -3
        echo -e "  ${GREEN}✓ 重新签发${NC}"
    fi

    # --- 4. 复制到运行目录 ---
    cp -f pki/ca.crt $SERVER_DIR/ca.crt
    cp -f pki/ca.crt $CLIENT_DIR/ca.crt
    cp -f pki/issued/$CLIENT_NAME.crt $CLIENT_DIR/$CLIENT_NAME.crt
    cp -f pki/private/$CLIENT_NAME.key $CLIENT_DIR/$CLIENT_NAME.key
    cp -f $SERVER_DIR/tls-crypt.key $CLIENT_DIR/tls-crypt.key
    chmod 600 $CLIENT_DIR/$CLIENT_NAME.key $CLIENT_DIR/tls-crypt.key 2>/dev/null || true
    chmod 644 $CLIENT_DIR/$CLIENT_NAME.crt $CLIENT_DIR/ca.crt 2>/dev/null || true

    # --- 5. 重启 OpenVPN 应用新配置 ---
    echo -e "${YELLOW}[补] 重启 OpenVPN...${NC}"
    systemctl restart openvpn-server@server
    sleep 2
    if systemctl is-active openvpn-server@server >/dev/null 2>&1; then
        echo -e "  ${GREEN}✓ OpenVPN 运行中${NC}"
    else
        echo -e "  ${RED}✗ OpenVPN 启动失败, 查看: journalctl -u openvpn-server@server -n 30${NC}"
        journalctl -u openvpn-server@server --no-pager -n 10
        exit 1
    fi
fi

# ==================== 全新安装 ====================
if ! $FAST_PATH; then
    echo ""
    echo -e "${CYAN}========== 全新安装 ==========${NC}"

    # 停旧服务
    systemctl stop openvpn-server@server 2>/dev/null || true
    systemctl stop openvpn@server 2>/dev/null || true
    pkill -f "openvpn.*server" 2>/dev/null || true
    sleep 1
    rm -f /etc/systemd/system/openvpn-server@*.service 2>/dev/null || true
    rm -f /etc/systemd/system/openvpn@*.service 2>/dev/null || true
    systemctl daemon-reload 2>/dev/null || true

    # 包管理器
    if command -v dnf &>/dev/null; then PKG_MGR="dnf"
    elif command -v yum &>/dev/null; then PKG_MGR="yum"
    else echo -e "${RED}✗ 没 dnf/yum${NC}"; exit 1; fi

    echo -e "${YELLOW}[1/7] 安装包...${NC}"
    $PKG_MGR install -y epel-release 2>/dev/null || true
    $PKG_MGR install -y curl wget net-tools iptables iptables-services openssl openssh-server iproute firewalld lzo 2>/dev/null || true
    $PKG_MGR install -y easy-rsa 2>/dev/null || true
    if ! $PKG_MGR install -y openvpn; then
        $PKG_MGR config-manager --set-enabled crb 2>/dev/null || true
        $PKG_MGR config-manager --set-enabled plus 2>/dev/null || true
        $PKG_MGR update -y 2>/dev/null || true
        $PKG_MGR install -y openvpn || { echo -e "${RED}✗ openvpn 装不上${NC}"; exit 1; }
    fi

    # SELinux
    if command -v getenforce &>/dev/null && [ "$(getenforce 2>/dev/null)" = "Enforcing" ]; then
        setenforce 0 2>/dev/null || true
        sed -i 's/^SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config 2>/dev/null || true
    fi

    # 内核
    sed -i '/^net.ipv4.ip_forward/d; /^net.core.rmem_max/d; /^net.core.wmem_max/d; /^net.ipv4.tcp_rmem/d; /^net.ipv4.tcp_wmem/d; /^net.ipv4.tcp_congestion_control/d; /^net.core.default_qdisc/d' /etc/sysctl.conf 2>/dev/null || true
    cat >> /etc/sysctl.conf << SYSCTLEOF
net.ipv4.ip_forward = 1
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864
net.ipv4.tcp_rmem = 4096 87380 67108864
net.ipv4.tcp_wmem = 4096 65536 67108864
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
SYSCTLEOF
    sysctl -p >/dev/null 2>&1 || true

    # EasyRSA
    echo -e "${YELLOW}[2/7] EasyRSA...${NC}"
    mkdir -p $EASYRSA_DIR
    if [ -f /usr/share/easy-rsa/3/easyrsa ]; then
        cp -r /usr/share/easy-rsa/3/* $EASYRSA_DIR/
    elif [ -f /usr/share/easy-rsa/easyrsa ]; then
        cp -r /usr/share/easy-rsa/* $EASYRSA_DIR/
    else
        cd /tmp && rm -rf EasyRSA-3.1.2*
        wget -q --no-check-certificate https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.2/EasyRSA-3.1.2.tgz
        tar -xzf EasyRSA-3.1.2.tgz
        cp -r EasyRSA-3.1.2/* $EASYRSA_DIR/
    fi
    chmod +x $EASYRSA_DIR/easyrsa
    EASYRSA_CMD="$EASYRSA_DIR/easyrsa"

    # PKI
    echo -e "${YELLOW}[3/7] PKI 初始化...${NC}"
    mkdir -p $SERVER_DIR $CLIENT_DIR
    cd $EASYRSA_DIR
    export EASYRSA_BATCH=1
    cat > vars << VARS
set_var EASYRSA_BATCH 1
set_var EASYRSA_REQ_COUNTRY "CN"
set_var EASYRSA_REQ_PROVINCE "Beijing"
set_var EASYRSA_REQ_CITY "Beijing"
set_var EASYRSA_REQ_ORG "PiNode"
set_var EASYRSA_ALGO ec
set_var EASYRSA_CURVE prime256v1
set_var EASYRSA_CA_EXPIRE 3650
set_var EASYRSA_CERT_EXPIRE 3650
set_var EASYRSA_DIGEST "sha512"
VARS

    if [ -d pki ] && [ -f pki/ca.crt ]; then
        echo -e "  ${CYAN}已有 PKI, 复用${NC}"
    else
        yes | $EASYRSA_CMD init-pki 2>&1 | tail -2
    fi
    [ -f pki/ca.crt ] || yes | $EASYRSA_CMD --batch build-ca nopass 2>&1 | tail -2
    [ -f pki/issued/$SERVER_CN.crt ] || yes | $EASYRSA_CMD --batch gen-req "$SERVER_CN" nopass 2>&1 | tail -2
    [ -f pki/issued/$SERVER_CN.crt ] || yes | $EASYRSA_CMD --batch sign-req server "$SERVER_CN" 2>&1 | tail -2

    # tls-crypt
    if [ ! -f $SERVER_DIR/tls-crypt.key ]; then
        openvpn --genkey secret $SERVER_DIR/tls-crypt.key 2>/dev/null || \
        openvpn --genkey --secret $SERVER_DIR/tls-crypt.key 2>/dev/null
    fi
    cp $SERVER_DIR/tls-crypt.key $CLIENT_DIR/tls-crypt.key

    # 复制证书
    cp pki/ca.crt $SERVER_DIR/ca.crt
    cp pki/issued/$SERVER_CN.crt $SERVER_DIR/$SERVER_CN.crt
    cp pki/private/$SERVER_CN.key $SERVER_DIR/$SERVER_CN.key
    cp pki/ca.crt $CLIENT_DIR/ca.crt
    chmod 600 $SERVER_DIR/$SERVER_CN.key $SERVER_DIR/tls-crypt.key $CLIENT_DIR/tls-crypt.key
    chmod 644 $SERVER_DIR/ca.crt $SERVER_DIR/$SERVER_CN.crt $CLIENT_DIR/ca.crt

    # server.conf
    echo -e "${YELLOW}[4/7] 生成 server.conf...${NC}"
    cat > $SERVER_DIR/server.conf << SERVEREOF
port $VPN_PORT
proto tcp-server
dev tun
ca $SERVER_DIR/ca.crt
cert $SERVER_DIR/$SERVER_CN.crt
key $SERVER_DIR/$SERVER_CN.key
ecdh-curve prime256v1
tls-crypt $SERVER_DIR/tls-crypt.key
topology subnet
server $NETWORK 255.255.255.0
ifconfig-pool-persist $SERVER_DIR/ipp.txt
keepalive 10 60
reneg-sec 0
max-clients $MAX_CLIENTS
duplicate-cn
cipher AES-256-CBC
auth SHA512
data-ciphers AES-256-CBC
data-ciphers-fallback AES-256-CBC
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS $DNS1"
push "dhcp-option DNS $DNS2"
verify-client-cert require
remote-cert-tls client
tls-version-min 1.2
user nobody
group nobody
status $SERVER_DIR/status.log
log-append $SERVER_DIR/openvpn.log
verb 3
mute 20
SERVEREOF

    # systemd service
    cat > /etc/systemd/system/openvpn-server@.service << 'SYSTEMDEOF'
[Unit]
Description=OpenVPN Server Service (OC9-SOS TCP 443)
After=network.target

[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn
ExecStart=/usr/sbin/openvpn --config /etc/openvpn/server/%i.conf
RestartSec=5
Restart=on-failure
LimitNOFILE=4096

[Install]
WantedBy=multi-user.target
SYSTEMDEOF

    systemctl daemon-reload
    systemctl enable openvpn-server@server

    # 防火墙
    if command -v firewall-cmd &>/dev/null; then
        firewall-cmd --permanent --add-service=openvpn 2>/dev/null || true
        firewall-cmd --permanent --add-port=$VPN_PORT/tcp 2>/dev/null || true
        firewall-cmd --reload 2>/dev/null || true
    fi

    # 启动
    echo -e "${YELLOW}[5/7] 启动 OpenVPN...${NC}"
    systemctl restart openvpn-server@server
    sleep 2
    if ! systemctl is-active openvpn-server@server >/dev/null 2>&1; then
        echo -e "${RED}✗ 启动失败${NC}"
        journalctl -u openvpn-server@server --no-pager -n 20
        exit 1
    fi
    echo -e "  ${GREEN}✓ OpenVPN 运行中${NC}"

    # 签客户端
    echo -e "${YELLOW}[6/7] 签客户端证书 [CN=$CLIENT_NAME]...${NC}"
    cd $EASYRSA_DIR
    export EASYRSA_BATCH=1
    yes | $EASYRSA_CMD --batch gen-req "$CLIENT_NAME" nopass 2>&1 | tail -3
    yes | $EASYRSA_CMD --batch sign-req client "$CLIENT_NAME" 2>&1 | tail -3
    cp pki/ca.crt $CLIENT_DIR/ca.crt
    cp pki/issued/$CLIENT_NAME.crt $CLIENT_DIR/$CLIENT_NAME.crt
    cp pki/private/$CLIENT_NAME.key $CLIENT_DIR/$CLIENT_NAME.key
    chmod 600 $CLIENT_DIR/$CLIENT_NAME.key $CLIENT_DIR/tls-crypt.key
    chmod 644 $CLIENT_DIR/$CLIENT_NAME.crt $CLIENT_DIR/ca.crt
    echo -e "  ${GREEN}✓ 客户端证书已签发${NC}"
fi

# ==================== 生成客户端 ovpn（两种模式都要跑） ====================
echo ""
echo -e "${CYAN}========== 生成客户端 ovpn ==========${NC}"

cd $EASYRSA_DIR
export EASYRSA_BATCH=1

CA_CRT=$(sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' pki/ca.crt)
CLI_CRT=$(sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' pki/issued/$CLIENT_NAME.crt)
CLI_KEY=$(sed -n '/-----BEGIN \(RSA \)\?PRIVATE KEY-----/,/-----END \(RSA \)\?PRIVATE KEY-----/p' pki/private/$CLIENT_NAME.key)
TLS_KEY=$(cat $SERVER_DIR/tls-crypt.key)

if [ -z "$CA_CRT" ] || [ -z "$CLI_CRT" ] || [ -z "$CLI_KEY" ] || [ -z "$TLS_KEY" ]; then
    echo -e "${RED}✗ 证书内容提取失败${NC}"; exit 1
fi

# --- 保守兼容模板 ---
# 不写 data-ciphers（2.4 不认识会 FATAL），但服务端有 data-ciphers-fallback
# 不写 block-outside-dns（Linux/Mac/Android 解析即 FATAL）
# 不写 ignore-unknown-option
# 保留 cipher + auth（所有版本通用）
cat > $CLIENT_DIR/$CLIENT_NAME.ovpn << OVPNoEOF
client
dev tun
proto tcp-client
remote $PUBLIC_IP $VPN_PORT
resolv-retry 60
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name $SERVER_CN name
ping 10
ping-restart 60
connect-retry 3
connect-timeout 10
auth-nocache
cipher AES-256-CBC
auth SHA512
verb 3
redirect-gateway def1 bypass-dhcp
dhcp-option DNS $DNS1
dhcp-option DNS $DNS2

<ca>
$CA_CRT
</ca>
<cert>
$CLI_CRT
</cert>
<key>
$CLI_KEY
</key>
<tls-crypt>
$TLS_KEY
</tls-crypt>
OVPNoEOF

# 复制到 /root 便于下载
cp -f $CLIENT_DIR/$CLIENT_NAME.ovpn /root/$CLIENT_NAME.ovpn

# 验证
OVPN_SIZE=$(wc -c < /root/$CLIENT_NAME.ovpn)
if grep -q "BEGIN CERTIFICATE" /root/$CLIENT_NAME.ovpn && \
   grep -q "<tls-crypt>" /root/$CLIENT_NAME.ovpn && \
   [ "$OVPN_SIZE" -gt 1000 ]; then
    echo -e "  ${GREEN}✓ /root/$CLIENT_NAME.ovpn (${OVPN_SIZE} bytes)${NC}"
else
    echo -e "${RED}✗ ovpn 文件验证失败${NC}"; exit 1
fi

# ==================== 80 端口下载 ====================
echo ""
echo -e "${CYAN}========== 80 端口下载服务 ==========${NC}"

# 清理旧 python http.server
pkill -f "python.*http.server.*80" 2>/dev/null || true
sleep 1

cd /root
nohup python3 -m http.server 80 > /tmp/http80.log 2>&1 &
sleep 1

if curl -s -o /dev/null -w "%{http_code}" --connect-timeout 2 http://127.0.0.1/$CLIENT_NAME.ovpn | grep -q "200"; then
    echo -e "  ${GREEN}✓ http://$PUBLIC_IP/$CLIENT_NAME.ovpn 可下载${NC}"
else
    echo -e "  ${YELLOW}⚠ 80 端口下载服务未就绪, 但 /root/$CLIENT_NAME.ovpn 已生成${NC}"
fi

# ==================== 完成 ====================
echo ""
echo -e "${GREEN}==============================================${NC}"
echo -e "${GREEN}  部署完成 ✅${NC}"
echo -e "${GREEN}==============================================${NC}"
echo -e "  OpenVPN:   TCP $VPN_PORT (active)"
echo -e "  公网IP:    $PUBLIC_IP"
echo -e "  客户端:    $CLIENT_NAME"
echo -e "  ovpn路径:  /root/$CLIENT_NAME.ovpn"
echo -e "  下载URL:   http://$PUBLIC_IP/$CLIENT_NAME.ovpn"
echo -e ""
echo -e "  ${CYAN}兼容说明:${NC}"
echo -e "  - 此 ovpn 不写 data-ciphers / block-outside-dns"
echo -e "  - 2.4 / 2.5 / 2.6 / 2.7 客户端都能用"
echo -e "  - 服务端已配 data-ciphers-fallback 自动协商"