@echo off
:: =============================================================================
:: vFirewall Security Proxy — Windows Auto-Setup Script
:: Run as Administrator: Right-click > Run as administrator
:: =============================================================================
:: Chuc nang:
::   1. Xoa proxy cu (netsh winhttp, registry, env vars)
::   2. Cai CA certificate vao Trusted Root
::   3. Cau hinh proxy moi (system + winhttp)
::   4. Kiem tra ket noi
:: =============================================================================

title vFirewall Proxy Setup
color 0A

:: Check admin
net session >nul 2>&1
if %errorlevel% neq 0 (
    color 0C
    echo.
    echo  [ERROR] Script nay can chay voi quyen Administrator!
    echo  Click chuot phai file .cmd ^> Run as administrator
    echo.
    pause
    exit /b 1
)

echo.
echo  =============================================
echo   vFirewall Security Proxy — Windows Setup
echo  =============================================
echo.

:: -----------------------------------------------------------
:: Step 1: Reset proxy cu
:: -----------------------------------------------------------
echo  [1/4] Xoa cau hinh proxy cu...

:: Reset winhttp proxy
netsh winhttp reset proxy >nul 2>&1

:: Reset IE/System proxy settings
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /f >nul 2>&1
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f >nul 2>&1
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyOverride /f >nul 2>&1

:: Clear env vars
reg delete "HKCU\Environment" /v HTTP_PROXY /f >nul 2>&1
reg delete "HKCU\Environment" /v HTTPS_PROXY /f >nul 2>&1
reg delete "HKCU\Environment" /v ALL_PROXY /f >nul 2>&1
reg delete "HKCU\Environment" /v NO_PROXY /f >nul 2>&1
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v HTTP_PROXY /f >nul 2>&1
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v HTTPS_PROXY /f >nul 2>&1

echo        OK — Proxy cu da xoa sach
echo.

:: -----------------------------------------------------------
:: Step 2: Install CA Certificate
:: -----------------------------------------------------------
echo  [2/4] Cai CA Certificate...

set "CA_FILE=%~dp0vFirewall-Proxy-CA.der"
set "CA_URL=http://secure-proxy.fwcloud.vn/ca/proxy-ca.der"
set "CA_TEMP=%TEMP%\vfirewall-proxy-ca.der"

:: Try local file first, then download
if exist "%CA_FILE%" (
    echo        Tim thay CA file: %CA_FILE%
    certutil -addstore "Root" "%CA_FILE%" >nul 2>&1
) else (
    echo        Khong tim thay file .der cung thu muc, dang download...
    powershell -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; (New-Object Net.WebClient).DownloadFile('%CA_URL%','%CA_TEMP%')" >nul 2>&1
    if exist "%CA_TEMP%" (
        certutil -addstore "Root" "%CA_TEMP%" >nul 2>&1
        del "%CA_TEMP%" >nul 2>&1
    ) else (
        echo        [CANH BAO] Khong the download CA. Hay download thu cong tu:
        echo        %CA_URL%
    )
)

echo        OK — CA da cai vao Trusted Root Certification Authorities
echo.

:: -----------------------------------------------------------
:: Step 3: Configure proxy
:: -----------------------------------------------------------
echo  [3/4] Cau hinh proxy moi...

set "PROXY_SERVER=160.25.146.188:3128"
set "BYPASS=localhost;127.0.0.1;10.*;172.16.*;172.17.*;172.18.*;172.19.*;172.20.*;172.21.*;172.22.*;172.23.*;172.24.*;172.25.*;172.26.*;172.27.*;172.28.*;172.29.*;172.30.*;172.31.*;192.168.*;*.local;secure-proxy.fwcloud.vn"

:: Set winhttp proxy (for system services, Windows Update, etc.)
netsh winhttp set proxy proxy-server="%PROXY_SERVER%" bypass-list="%BYPASS%" >nul 2>&1

:: Set IE/System proxy (for Edge, Chrome, most apps)
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /t REG_SZ /d "%PROXY_SERVER%" /f >nul 2>&1
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyOverride /t REG_SZ /d "%BYPASS%" /f >nul 2>&1

echo        OK — Proxy: %PROXY_SERVER%
echo        OK — Bypass: localhost, private networks, secure-proxy.fwcloud.vn
echo.

:: -----------------------------------------------------------
:: Step 4: Verify
:: -----------------------------------------------------------
echo  [4/4] Kiem tra ket noi...
echo.

:: Show current proxy
echo  --- WinHTTP Proxy ---
netsh winhttp show proxy 2>nul | findstr /i "proxy bypass"
echo.

:: Show IE proxy
echo  --- IE/System Proxy ---
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer 2>nul | findstr "ProxyServer"
echo.

:: Show CA
echo  --- CA Certificate ---
certutil -store "Root" "vFirewall" 2>nul | findstr /i "Subject NotAfter"
echo.

echo  =============================================
echo   Setup hoan tat!
echo  =============================================
echo.
echo   Proxy Server:  160.25.146.188:3128
echo   Username:      proxy
echo   Password:      vFirewall@2026
echo.
echo   Khi trinh duyet hoi dang nhap, nhap:
echo     Username: proxy
echo     Password: vFirewall@2026
echo     [x] Remember my credentials
echo.
echo   Luu y:
echo   - Restart trinh duyet (Chrome/Edge) de ap dung
echo   - Firefox can import CA rieng: Settings ^> Certificates
echo   - De go bo proxy: chay lai script voi tham so /uninstall
echo.

:: Handle /uninstall parameter
if /i "%1"=="/uninstall" goto :uninstall
goto :done

:uninstall
echo.
echo  Dang go bo proxy...
netsh winhttp reset proxy >nul 2>&1
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /f >nul 2>&1
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f >nul 2>&1
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyOverride /f >nul 2>&1
echo  OK — Proxy da go bo. Restart trinh duyet de ap dung.
echo.

:done
pause