仓库 NVR
远程访问方案设计TAILSCALE + NETSH PORTPROXY · MULTI-SITE

#Requires -RunAsAdministrator
# ============================================
# 仓库 Tailscale 网关一键配置脚本（Windows 10 版）
# 功能：安装 Tailscale + 配置 NVR 端口转发 + 持久化 + 保活
# ============================================

param(
    [string]$GatewayName = "warehouse-a",
    [string]$TailscaleAuthKey = "",
    [string]$NvrConfig = "8000,192.168.1.100,80,nvr1-web;8554,192.168.1.100,554,nvr1-rtsp"
    # 格式: "本地端口,NVR内网IP,NVR端口,服务名;..."
)

$ErrorActionPreference = "Stop"

# ---------- 配置区 ----------
$InstallDir = "C:\NVR-Gateway"
$LogDir     = "$InstallDir\Logs"
$ConfigFile = "$InstallDir\config.json"

# 解析 NVR 配置
$NvrList = @()
foreach ($item in $NvrConfig -split ";") {
    $parts = $item -split ","
    $NvrList += [PSCustomObject]@{
        LocalPort = [int]$parts[0]
        NvrIp     = $parts[1]
        NvrPort   = [int]$parts[2]
        SvcName   = $parts[3]
    }
}

Write-Host "=== [$GatewayName] 网关部署开始 ===" -ForegroundColor Cyan

# 1. 创建目录
Write-Host "[1/8] 创建目录结构..." -ForegroundColor Yellow
New-Item -ItemType Directory -Path $InstallDir -Force | Out-Null
New-Item -ItemType Directory -Path $LogDir -Force | Out-Null
New-Item -ItemType Directory -Path "$InstallDir\Scripts" -Force | Out-Null

# 2. 保存配置文件（JSON，便于后续修改和读取）
Write-Host "[2/8] 保存配置文件..." -ForegroundColor Yellow
$config = @{
    GatewayName = $GatewayName
    NvrList     = $NvrList
    InstallDir  = $InstallDir
    LogDir      = $LogDir
}
$config | ConvertTo-Json -Depth 3 | Out-File -FilePath $ConfigFile -Encoding UTF8

# 3. 检查并安装 Tailscale
Write-Host "[3/8] 检查 Tailscale..." -ForegroundColor Yellow
$tsPath = "${env:ProgramFiles}\Tailscale\tailscale.exe"
if (-not (Test-Path $tsPath)) {
    Write-Host "Tailscale 未安装，请手动下载安装后重新运行脚本" -ForegroundColor Red
    Write-Host "下载地址: https://tailscale.com/download/windows" -ForegroundColor Yellow
    Start-Process "https://tailscale.com/download/windows"
    Read-Host "安装完成后按回车继续..."
    $tsPath = "${env:ProgramFiles}\Tailscale\tailscale.exe"
}

# 4. 启动/登录 Tailscale
Write-Host "[4/8] 启动 Tailscale..." -ForegroundColor Yellow
if ($TailscaleAuthKey) {
    & $tsPath up --authkey="$TailscaleAuthKey" --hostname="$GatewayName" --accept-dns=false --ssh
} else {
    Write-Host ">>> 请执行以下命令完成登录（完成后按回车继续）：" -ForegroundColor Green
    Write-Host "    tailscale up --hostname=$GatewayName --accept-dns=false --ssh" -ForegroundColor White
    Read-Host
}

Start-Sleep -Seconds 3
$tsIp = & $tsPath ip -4 2>$null
Write-Host ">>> Tailscale IP: $tsIp" -ForegroundColor Green

# 5. 配置 netsh 端口转发
Write-Host "[5/8] 配置端口转发..." -ForegroundColor Yellow
foreach ($nvr in $NvrList) {
    $listenPort = $nvr.LocalPort
    $targetIp   = $nvr.NvrIp
    $targetPort = $nvr.NvrPort
    $svcName    = $nvr.SvcName

    # 先删除可能存在的旧规则
    netsh interface portproxy delete v4tov4 listenport=$listenPort listenaddress=0.0.0.0 2>$null | Out-Null

    # 添加新规则
    netsh interface portproxy add v4tov4 listenport=$listenPort listenaddress=0.0.0.0 connectport=$targetPort connectaddress=$targetIp

    Write-Host "    OK $svcName : 0.0.0.0:$listenPort -> $targetIp`:$targetPort" -ForegroundColor Green
}

# 6. 配置 Windows 防火墙
Write-Host "[6/8] 配置防火墙规则..." -ForegroundColor Yellow
foreach ($nvr in $NvrList) {
    $listenPort = $nvr.LocalPort
    $ruleName = "NVR-Gateway-Port-$listenPort"

    # 删除旧规则
    Remove-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue

    # 添加入站规则（仅允许 Tailscale 虚拟网卡接口，或全部接口）
    New-NetFirewallRule `
        -DisplayName $ruleName `
        -Direction Inbound `
        -Protocol TCP `
        -LocalPort $listenPort `
        -Action Allow `
        -Profile Any `
        -ErrorAction SilentlyContinue | Out-Null

    Write-Host "    OK 防火墙规则: $ruleName (端口 $listenPort)" -ForegroundColor Green
}

# 7. 生成健康检查脚本
Write-Host "[7/8] 生成健康检查脚本..." -ForegroundColor Yellow
$healthCheckScript = @'
param([string]$ConfigFile = "C:\NVR-Gateway\config.json")

$cfg = Get-Content $ConfigFile | ConvertFrom-Json
$logFile = "$($cfg.LogDir)\health-check.log"

function Write-Log($msg) {
    $line = "[{0:yyyy-MM-dd HH:mm:ss}] {1}" -f (Get-Date), $msg
    Add-Content -Path $logFile -Value $line
    Write-Host $line
}

foreach ($nvr in $cfg.NvrList) {
    $tcp = New-Object System.Net.Sockets.TcpClient
    try {
        $tcp.Connect($nvr.NvrIp, $nvr.NvrPort)
        $tcp.Close()
        Write-Log ("OK {0} ({1}:{2}) 健康" -f $nvr.SvcName, $nvr.NvrIp, $nvr.NvrPort)
    }
    catch {
        Write-Log ("NG {0} ({1}:{2}) 不可达，正在重建端口转发..." -f $nvr.SvcName, $nvr.NvrIp, $nvr.NvrPort)
        netsh interface portproxy delete v4tov4 listenport=$($nvr.LocalPort) listenaddress=0.0.0.0 2>$null | Out-Null
        netsh interface portproxy add v4tov4 listenport=$($nvr.LocalPort) listenaddress=0.0.0.0 connectport=$($nvr.NvrPort) connectaddress=$($nvr.NvrIp)
        Write-Log ("REBUILD {0} 端口转发已重建" -f $nvr.SvcName)
    }
}
'@
$healthCheckScript | Out-File -FilePath "$InstallDir\Scripts\health-check.ps1" -Encoding UTF8

# 8. 注册 Windows 计划任务（定时健康检查 + 开机自启重建转发）
Write-Host "[8/8] 注册计划任务..." -ForegroundColor Yellow

# 8.1 健康检查任务（每 5 分钟）
$healthTaskName = "NVR-Gateway-HealthCheck"
Unregister-ScheduledTask -TaskName $healthTaskName -Confirm:$false -ErrorAction SilentlyContinue

$healthAction = New-ScheduledTaskAction -Execute "powershell.exe" `
    -Argument "-ExecutionPolicy Bypass -File `"$InstallDir\Scripts\health-check.ps1`""
$healthTrigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 3650)
$healthSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RunOnlyIfNetworkAvailable
Register-ScheduledTask -TaskName $healthTaskName -Action $healthAction -Trigger $healthTrigger -Settings $healthSettings -RunLevel Highest -Force | Out-Null
Write-Host "    OK 健康检查任务: 每 5 分钟执行" -ForegroundColor Green

# 8.2 开机重建转发任务（系统启动时执行）
$bootTaskName = "NVR-Gateway-BootSetup"
Unregister-ScheduledTask -TaskName $bootTaskName -Confirm:$false -ErrorAction SilentlyContinue

$bootScript = @"
`$cfg = Get-Content '$ConfigFile' | ConvertFrom-Json
foreach (`$nvr in `$cfg.NvrList) {
    netsh interface portproxy delete v4tov4 listenport=`$(`$nvr.LocalPort) listenaddress=0.0.0.0 2>`$null | Out-Null
    netsh interface portproxy add v4tov4 listenport=`$(`$nvr.LocalPort) listenaddress=0.0.0.0 connectport=`$(`$nvr.NvrPort) connectaddress=`$(`$nvr.NvrIp)
}
"@
$bootScript | Out-File -FilePath "$InstallDir\Scripts\boot-setup.ps1" -Encoding UTF8

$bootAction = New-ScheduledTaskAction -Execute "powershell.exe" `
    -Argument "-ExecutionPolicy Bypass -File `"$InstallDir\Scripts\boot-setup.ps1`""
$bootTrigger = New-ScheduledTaskTrigger -AtStartup
$bootSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName $bootTaskName -Action $bootAction -Trigger $bootTrigger -Settings $bootSettings -RunLevel Highest -Force | Out-Null
Write-Host "    OK 开机重建任务: 系统启动时自动重建端口转发" -ForegroundColor Green

# 9. 生成管理脚本（manage-gateway.ps1）
#    status / restart / health / logs / test 五个子命令，落地到 Scripts 目录

# 输出部署结果
Write-Host ""
Write-Host "========================================" -ForegroundColor Cyan
Write-Host "[$GatewayName] 部署完成" -ForegroundColor Green
Write-Host "----------------------------------------" -ForegroundColor Gray
Write-Host "Tailscale IP : $tsIp" -ForegroundColor White
Write-Host "访问方式     :" -ForegroundColor White
foreach ($nvr in $NvrList) {
    Write-Host "  http://${tsIp}:$($nvr.LocalPort)  ->  $($nvr.NvrIp):$($nvr.NvrPort) ($($nvr.SvcName))" -ForegroundColor White
}
Write-Host "----------------------------------------" -ForegroundColor Gray
Write-Host "安装目录     : $InstallDir" -ForegroundColor White
Write-Host "配置文件     : $ConfigFile" -ForegroundColor White
Write-Host "日志目录     : $LogDir" -ForegroundColor White
Write-Host "健康检查     : 每 5 分钟自动执行" -ForegroundColor White
Write-Host "开机自启     : 系统启动时自动重建端口转发" -ForegroundColor White
Write-Host "========================================" -ForegroundColor Cyan