#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
生成私有定制规则集（自建规则库的核心资产）

这些规则不属于任何公共规则库，是你的专属资产：
  - 法院隔离网（等保合规要求，流量不得出网代理）
  - Tailscale 组网（100.64.0.0/10）
  - 自建服务域名（HK / 上海 VPS）
  - 规则源自身（保证规则能更新）

输出：
  Clash/PrivateDirect.yaml   behavior: classical（IP-CIDR + DOMAIN-SUFFIX 混合）
  Loon/PrivateDirect.list
"""
import os
from datetime import datetime, timezone, timedelta

OUT = os.path.join(os.path.dirname(os.path.abspath(__file__)))
CST = timezone(timedelta(hours=8))

# ============ 私有内网（最高优先级，硬直连）============
# 法院隔离网 10.10.8.0/21 已含在 10.0.0.0/8
PRIVATE_CIDR = [
    '10.0.0.0/8',          # 含隔离网 10.10.8.0/21
    '172.16.0.0/12',
    '192.168.0.0/16',
    '127.0.0.0/8',
    '169.254.0.0/16',
    '100.64.0.0/10',       # Tailscale
    '224.0.0.0/4',
    '0.0.0.0/8',
]
PRIVATE_CIDR6 = [
    'fc00::/7',
    'fe80::/10',
    '::1/128',
]

# ============ 自建服务域名 ============
PRIVATE_DOMAIN = [
    'xianglong.link',           # HK / 上海 VPS 全部自建站
    'local',
    'home.arpa',
    'lan',
    'internal',
]

# ============ 规则源自身（保证规则集能更新）============
SOURCE_DOMAIN = [
    'jsdelivr.net',             # 实测直连可用，raw.githubusercontent 不通
]

STAMP = datetime.now(CST).strftime('%Y-%m-%d %H:%M:%S')


def build_clash():
    payload = []
    payload += [f'IP-CIDR,{c},no-resolve' for c in PRIVATE_CIDR]
    payload += [f'IP-CIDR6,{c},no-resolve' for c in PRIVATE_CIDR6]
    payload += [f'DOMAIN-SUFFIX,{d}' for d in PRIVATE_DOMAIN]
    payload += [f'DOMAIN-SUFFIX,{d}' for d in SOURCE_DOMAIN]

    lines = [
        '# 自建私有规则集· 法院隔离网 + Tailscale + 自建服务',
        '# 此文件为手工维护，不从上游同步',
        f'# 生成时间: {STAMP} (UTC+8)',
        f'# 规则数: {len(payload)}',
        '# 全部须走 DIRECT：隔离网流量出网违反等保合规要求',
        'payload:',
    ]
    lines += [f"  - '{p}'" for p in payload]
    path = os.path.join(OUT, 'Clash', 'PrivateDirect.yaml')
    with open(path, 'w', encoding='utf-8', newline='\n') as f:
        f.write('\n'.join(lines) + '\n')
    return path, len(payload)


def build_loon():
    lines = [
        '# 自建私有规则集 · 法院隔离网 + Tailscale + 自建服务',
        '# 此文件为手工维护，不从上游同步',
        f'# 生成时间: {STAMP} (UTC+8)',
        '# 全部须走 DIRECT：隔离网流量出网违反等保合规要求',
    ]
    body = []
    body += [f'IP-CIDR,{c},DIRECT,no-resolve' for c in PRIVATE_CIDR]
    body += [f'IP-CIDR6,{c},DIRECT,no-resolve' for c in PRIVATE_CIDR6]
    body += [f'DOMAIN-SUFFIX,{d},DIRECT' for d in PRIVATE_DOMAIN]
    body += [f'DOMAIN-SUFFIX,{d},DIRECT' for d in SOURCE_DOMAIN]
    path = os.path.join(OUT, 'Loon', 'PrivateDirect.list')
    with open(path, 'w', encoding='utf-8', newline='\n') as f:
        f.write('\n'.join(lines + body) + '\n')
    return path, len(body)


if __name__ == '__main__':
    p1, n1 = build_clash()
    p2, n2 = build_loon()
    print(f'Clash 私有规则: {n1} 条 -> {p1}')
    print(f'Loon  私有规则: {n2} 条 -> {p2}')