scripts: consolidate Agent deployment and remove Probe packages
Use Agent for native, container, systemd and OpenWrt installations and signed updates. Remove retired Probe deployment templates and smoke scripts.
This commit is contained in:
justme committed
1 parent
ad5efc62ff
commit
016dbc2bbf
30 files changed
+96
-1206
No files matched your search
@@ -1,6 +1,6 @@
|
||||
# MoShiro 节点一键安装（Windows，Agent 和 Probe 共用同一份，**静态**文件：不替换任何值，所以它的 SHA-256 在一个版本内固定不变）。
|
||||
# MoShiro 节点一键安装（Windows，监听和拨号两种模式共用同一份，**静态**文件：不替换任何值，所以它的 SHA-256 在一个版本内固定不变）。
|
||||
# 面板给的命令先下载这份文件、核对 SHA-256（CI 构建时算出，写进签名的发布清单，也公布在发布页），一致才执行。
|
||||
# 必需的环境变量：MOSHIRO_SERVER（面板地址）、MOSHIRO_ROLE（agent 或 probe）、MOSHIRO_CODE（一次性的加入码）。
|
||||
# 必需的环境变量：MOSHIRO_SERVER（面板地址）、MOSHIRO_ROLE（默认 agent，监听并拨号）、MOSHIRO_CODE（一次性的加入码）。
|
||||
# 做的事：用 Docker Desktop 起一个容器，身份和配置存在命名卷里（重启、换新镜像重建都不用再给参数），节点名字默认取计算机名。
|
||||
# 可选环境变量：MOSHIRO_NAME=节点名字（名字被占用时用）、MOSHIRO_GENESIS / MOSHIRO_CONTROLLERS（命令里带着：信任根指纹和这个节点的属主 passkey 凭证 id，都是公开值）、
|
||||
# MOSHIRO_ALLOW_UNVERIFIED=1 加 MOSHIRO_IMAGE=镜像（面板还没有已签名的发布清单时，不验签、按这个镜像安装；默认拒绝）。
|
||||
@@ -31,7 +31,7 @@ function Test-MoShiroSignature([byte[]]$data, [byte[]]$derSignature, [string]$pe
|
||||
|
||||
function Install-MoShiro {
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$role = $env:MOSHIRO_ROLE
|
||||
$role = if ($env:MOSHIRO_ROLE) { $env:MOSHIRO_ROLE } else { 'agent' }
|
||||
$server = $env:MOSHIRO_SERVER
|
||||
$code = $env:MOSHIRO_CODE
|
||||
$image = $env:MOSHIRO_IMAGE
|
||||
@@ -43,7 +43,7 @@ YOrtO3Vso/QNdSMmepQlx1Q3v+KkN7ro3AY3I6DT2Q2txJu5pS7qzutSQA==
|
||||
'@
|
||||
|
||||
# 这些值来自命令行环境：只允许正常的字符，因为它们会进到 URL 和容器参数里
|
||||
if ($role -notin @('agent', 'probe')) { Write-Error 'MOSHIRO_ROLE must be agent or probe'; return }
|
||||
if ($role -notin @('agent')) { Write-Error 'MOSHIRO_ROLE must be agent'; return }
|
||||
if ($server -notmatch '^https?://[A-Za-z0-9._:/@~%+\[\]-]+$') { Write-Error 'MOSHIRO_SERVER must be the panel address (http:// or https://)'; return }
|
||||
if ($code -notmatch '^[A-Za-z0-9._~%+-]+$') { Write-Error 'MOSHIRO_CODE is required (copy the whole command from the panel)'; return }
|
||||
|
||||
@@ -83,7 +83,7 @@ YOrtO3Vso/QNdSMmepQlx1Q3v+KkN7ro3AY3I6DT2Q2txJu5pS7qzutSQA==
|
||||
}
|
||||
if ($null -eq $manifest) {
|
||||
if ($env:MOSHIRO_ALLOW_UNVERIFIED -ne '1' -or -not $image) {
|
||||
Write-Error "the panel has no signed release for $role yet, so the image cannot be verified. To install anyway set `$env:MOSHIRO_ALLOW_UNVERIFIED='1' and `$env:MOSHIRO_IMAGE"
|
||||
Write-Error "the panel has no signed release yet, so the image cannot be verified. To install anyway set `$env:MOSHIRO_ALLOW_UNVERIFIED='1' and `$env:MOSHIRO_IMAGE"
|
||||
return
|
||||
}
|
||||
Write-Host "warning: installing $image without signature verification"
|
||||
@@ -93,7 +93,7 @@ YOrtO3Vso/QNdSMmepQlx1Q3v+KkN7ro3AY3I6DT2Q2txJu5pS7qzutSQA==
|
||||
return
|
||||
}
|
||||
$release = [Text.Encoding]::UTF8.GetString($manifest) | ConvertFrom-Json
|
||||
if ($release.component -ne $role) { Write-Error "the signed release is for '$($release.component)', not '$role'"; return }
|
||||
if ($release.component -ne 'agent') { Write-Error "the signed release is for '$($release.component)', not 'agent'"; return }
|
||||
if ($release.digest -notmatch '^sha256:[0-9a-f]{64}$') { Write-Error 'the signed release has a malformed digest'; return }
|
||||
if ($release.image -notmatch '^[A-Za-z0-9._/:-]+$') { Write-Error 'the signed release has a malformed image name'; return }
|
||||
$image = "$($release.image)@$($release.digest)"
|
||||
@@ -110,9 +110,9 @@ YOrtO3Vso/QNdSMmepQlx1Q3v+KkN7ro3AY3I6DT2Q2txJu5pS7qzutSQA==
|
||||
$arguments = @('run', '-d', '--name', $container, '--restart', 'unless-stopped',
|
||||
'--read-only', '--tmpfs', '/tmp:rw,noexec,nosuid,size=64m', '--cap-drop', 'all', '--security-opt', 'no-new-privileges',
|
||||
'-v', "${volume}:/etc/moshiro")
|
||||
# Docker Desktop 没有宿主网络：Agent 把端口发布出来（面板里的地址需要指向这台机器的公网地址）
|
||||
# Docker Desktop 没有宿主网络：监听的节点把端口发布出来（面板里的地址需要指向这台机器的公网地址）
|
||||
if ($role -eq 'agent') { $arguments += @('-p', '7443:7443/tcp', '-p', '7443:7443/udp', '-p', '7444:7444/tcp') }
|
||||
$arguments += @('-e', "MOSHIRO_SERVER=$server", '-e', "MOSHIRO_JOIN=$code", '-e', "MOSHIRO_NAME=$name")
|
||||
$arguments += @('-e', "MOSHIRO_SERVER=$server", '-e', "MOSHIRO_JOIN=$code", '-e', "MOSHIRO_NAME=$name", '-e', "MOSHIRO_MODE=$role")
|
||||
# 每个节点都必须有属主（passkey）：命令里的信任根指纹和属主缺一个就不装（面板的命令总是带着；只有没有信任根的老面板才需要 MOSHIRO_ALLOW_NO_OWNER=1）
|
||||
if ((-not $env:MOSHIRO_GENESIS -or -not $env:MOSHIRO_CONTROLLERS) -and $env:MOSHIRO_ALLOW_NO_OWNER -ne '1') {
|
||||
Write-Error 'this node has no owner: MOSHIRO_GENESIS and MOSHIRO_CONTROLLERS are required (copy the complete command from the panel; set up the trust root first)'
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/bin/sh
|
||||
# MoShiro 节点一键安装（Agent 和 Probe 共用同一份，**静态**文件：不替换任何值，所以它的 SHA-256 在一个版本内固定不变）。
|
||||
# MoShiro 节点一键安装（监听和拨号两种模式共用同一份，**静态**文件：不替换任何值，所以它的 SHA-256 在一个版本内固定不变）。
|
||||
# 面板给的命令先下载这份文件、核对 SHA-256（CI 构建时算出，写进签名的发布清单，也公布在发布页），一致才执行：
|
||||
# f=$(mktemp) && curl -fsSL 'https://panel/install' -o "$f" && echo "<sha256> $f" | sha256sum -c - && MOSHIRO_SERVER=… MOSHIRO_ROLE=… MOSHIRO_CODE=… sh "$f"
|
||||
# 必需的环境变量：MOSHIRO_SERVER（面板地址）、MOSHIRO_ROLE（agent 或 probe）、MOSHIRO_CODE（一次性的加入码）。
|
||||
# 必需的环境变量：MOSHIRO_SERVER（面板地址）、MOSHIRO_ROLE（默认 agent，监听并拨号）、MOSHIRO_CODE（一次性的加入码）。
|
||||
# 做的事：用 Docker 或 Podman 起一个容器，身份和配置存在命名卷里（重启、换新镜像重建都不用再给参数），节点名字默认取主机名。
|
||||
# 可选环境变量：MOSHIRO_NAME=节点名字（名字被占用时用）、MOSHIRO_ENGINE=docker|podman、MOSHIRO_DRY_RUN=1（只打印命令）、
|
||||
# MOSHIRO_GENESIS / MOSHIRO_CONTROLLERS（命令里带着：你的信任根指纹和这个节点的属主 passkey 凭证 id，节点在注册时验证面板的操作员集合并把它们固定在本地；都是公开值）、
|
||||
@@ -11,7 +11,7 @@
|
||||
set -eu
|
||||
|
||||
SERVER="${MOSHIRO_SERVER:-}"
|
||||
ROLE="${MOSHIRO_ROLE:-}"
|
||||
ROLE="${MOSHIRO_ROLE:-agent}"
|
||||
CODE="${MOSHIRO_CODE:-}"
|
||||
IMAGE="${MOSHIRO_IMAGE:-}"
|
||||
RELEASE_KEY='-----BEGIN PUBLIC KEY-----
|
||||
@@ -23,7 +23,7 @@ say() { printf '%s\n' "$*"; }
|
||||
die() { printf 'error: %s\n' "$*" >&2; exit 1; }
|
||||
|
||||
# 这些值来自命令行环境：只允许正常的字符，因为它们会进到 URL 和容器参数里
|
||||
case "$ROLE" in agent|probe) ;; *) die "MOSHIRO_ROLE must be agent or probe" ;; esac
|
||||
case "$ROLE" in agent) ;; *) die "MOSHIRO_ROLE must be agent" ;; esac
|
||||
case "$SERVER" in http://*|https://*) ;; *) die "MOSHIRO_SERVER must be the panel address (http:// or https://)" ;; esac
|
||||
case "$SERVER$CODE" in *[!A-Za-z0-9._:/@~%+\[\]-]*|'') die "MOSHIRO_SERVER or MOSHIRO_CODE has unexpected characters" ;; esac
|
||||
[ -n "$CODE" ] || die "MOSHIRO_CODE is required (copy the whole command from the panel)"
|
||||
@@ -70,7 +70,7 @@ resolve_image() {
|
||||
curl -fsS "$SERVER/install/manifest?code=$CODE" -o "$tmp/manifest" 2>/dev/null </dev/null || have_manifest=0
|
||||
curl -fsS "$SERVER/install/manifest.sig?code=$CODE" -o "$tmp/sig.b64" 2>/dev/null </dev/null || have_manifest=0
|
||||
if [ "$have_manifest" -eq 0 ]; then
|
||||
[ "${MOSHIRO_ALLOW_UNVERIFIED:-}" = 1 ] && [ -n "$IMAGE" ] || die "the panel has no signed release for $ROLE yet, so the image cannot be verified. To install anyway set MOSHIRO_ALLOW_UNVERIFIED=1 and MOSHIRO_IMAGE=<image>"
|
||||
[ "${MOSHIRO_ALLOW_UNVERIFIED:-}" = 1 ] && [ -n "$IMAGE" ] || die "the panel has no signed release yet, so the image cannot be verified. To install anyway set MOSHIRO_ALLOW_UNVERIFIED=1 and MOSHIRO_IMAGE=<image>"
|
||||
say "warning: installing $IMAGE without signature verification"
|
||||
return 0
|
||||
fi
|
||||
@@ -80,7 +80,7 @@ resolve_image() {
|
||||
openssl dgst -sha256 -verify "$tmp/key.pem" -signature "$tmp/sig.bin" "$tmp/manifest" >/dev/null 2>&1 \
|
||||
|| die "the release signature does not verify against the built-in release key; refusing to install"
|
||||
field() { sed -n "s/.*\"$1\":\"\([^\"]*\)\".*/\1/p" "$tmp/manifest" | head -n 1; }
|
||||
[ "$(field component)" = "$ROLE" ] || die "the signed release is for '$(field component)', not '$ROLE'"
|
||||
[ "$(field component)" = agent ] || die "the signed release is for '$(field component)', not 'agent'"
|
||||
repo="$(field image)"
|
||||
digest="$(field digest)"
|
||||
case "$digest" in sha256:????????????????????????????????????????????????????????????????) ;; *) die "the signed release has a malformed digest" ;; esac
|
||||
@@ -97,18 +97,16 @@ set -- run -d --name "$container" --restart "$restart" \
|
||||
-v "$volume:/etc/moshiro"
|
||||
[ "$engine" = podman ] && set -- "$@" --security-opt label=disable
|
||||
if [ "$linux" -eq 1 ]; then
|
||||
# 宿主网络：Agent 对外暴露端口，也靠它识别本机的公网 IPv4 和 IPv6 地址
|
||||
# 宿主网络：监听的节点对外暴露端口，两种模式都靠它识别本机的公网 IPv4 和 IPv6 地址
|
||||
set -- "$@" --network host
|
||||
if [ "$ROLE" = agent ]; then
|
||||
# 主机资源占用（只读），管理端的 Agent 详情页显示 CPU、内存、磁盘、网络
|
||||
set -- "$@" -v /etc/os-release:/etc/os-release:ro -v /proc:/host/proc:ro -v /sys:/host/sys:ro -v /:/host/root:ro \
|
||||
-e MOSHIRO_NETWORK_SCOPE=host -e HOST_PROC=/host/proc -e HOST_SYS=/host/sys -e HOST_ROOT=/host/root
|
||||
fi
|
||||
# 主机资源占用（只读），管理端的节点详情页显示 CPU、内存、磁盘、网络
|
||||
set -- "$@" -v /etc/os-release:/etc/os-release:ro -v /proc:/host/proc:ro -v /sys:/host/sys:ro -v /:/host/root:ro \
|
||||
-e MOSHIRO_NETWORK_SCOPE=host -e HOST_PROC=/host/proc -e HOST_SYS=/host/sys -e HOST_ROOT=/host/root
|
||||
elif [ "$ROLE" = agent ]; then
|
||||
# macOS 上的 Docker 没有宿主网络：把 Agent 的端口发布出来（面板里的地址需要指向这台机器的公网地址）
|
||||
# macOS 上的 Docker 没有宿主网络：把监听节点的端口发布出来（面板里的地址需要指向这台机器的公网地址）
|
||||
set -- "$@" -p 7443:7443/tcp -p 7443:7443/udp -p 7444:7444/tcp
|
||||
fi
|
||||
set -- "$@" -e "MOSHIRO_SERVER=$SERVER" -e "MOSHIRO_JOIN=$CODE" -e "MOSHIRO_NAME=$name"
|
||||
set -- "$@" -e "MOSHIRO_SERVER=$SERVER" -e "MOSHIRO_JOIN=$CODE" -e "MOSHIRO_NAME=$name" -e "MOSHIRO_MODE=$ROLE"
|
||||
# 每个节点都必须有属主（passkey）：命令里的信任根指纹和属主缺一个就不装（面板的命令总是带着；只有没有信任根的老面板才需要 MOSHIRO_ALLOW_NO_OWNER=1）
|
||||
if [ -z "${MOSHIRO_GENESIS:-}" ] || [ -z "${MOSHIRO_CONTROLLERS:-}" ]; then
|
||||
[ "${MOSHIRO_ALLOW_NO_OWNER:-}" = 1 ] || die "this node has no owner: MOSHIRO_GENESIS and MOSHIRO_CONTROLLERS are required (copy the complete command from the panel; set up the trust root first)"
|
||||
|
||||
Reference in new issue
Block a user