feat: node updates by restart, auto by default; Podman Quadlet install from the panel alongside compose [CI]

backend/src/MoShiro.Backend.Api/Admin/AgentEndpoints.cs

@@ -143,7 +143,7 @@ public static class AgentEndpoints
             return Problems.From(http, ownerError);
         }
 
-        var plan = new InstallPlan(genesis, controllers, InstallScripts.Sha256(InstallScripts.Sh), InstallScripts.Sha256(InstallScripts.Ps1), InstallScripts.ComposeSha256(request.Role ?? JoinTokenService.AgentRole));
+        var plan = new InstallPlan(genesis, controllers, InstallScripts.Sha256(InstallScripts.Sh), InstallScripts.Sha256(InstallScripts.Ps1), InstallScripts.ComposeSha256(request.Role ?? JoinTokenService.AgentRole), InstallScripts.QuadletSha256(request.Role ?? JoinTokenService.AgentRole));
         http.SetDetail($"{request.Role ?? JoinTokenService.AgentRole}: {request.Note}");
         Result<CreatedJoinToken> result = await tokens.CreateAsync(
             new Application.CreateJoinTokenRequest(request.Note, request.Labels, request.AutoApprove ?? true, request.MaxUses ?? 1, request.ExpiresInHours ?? 24, request.Role ?? JoinTokenService.AgentRole, http.GetPrincipal().Label), baseUrl, plan, http.RequestAborted);
@@ -154,7 +154,7 @@ public static class AgentEndpoints
 
         http.Response.Headers.CacheControl = "no-store";
         http.Response.Headers.Location = "/api/admin/join-tokens";
-        return TypedResults.Json(new CreatedJoinTokenDto(Mappers.ToDto(created.Info), created.Plaintext, new InstallCommandsDto(created.InstallCommands.Linux, created.InstallCommands.Macos, created.InstallCommands.Windows), new ComposeInstallDto(created.Compose.Env, created.Compose.Url, created.Compose.Sha256, created.Compose.Linux, created.Compose.Macos, created.Compose.Windows)), ApiJsonContext.Default.CreatedJoinTokenDto, statusCode: StatusCodes.Status201Created);
+        return TypedResults.Json(new CreatedJoinTokenDto(Mappers.ToDto(created.Info), created.Plaintext, new InstallCommandsDto(created.InstallCommands.Linux, created.InstallCommands.Macos, created.InstallCommands.Windows), new ComposeInstallDto(created.Compose.Env, created.Compose.Url, created.Compose.Sha256, created.Compose.Linux, created.Compose.Macos, created.Compose.Windows), new QuadletInstallDto(created.Quadlet.Env, created.Quadlet.Url, created.Quadlet.Sha256, created.Quadlet.Command)), ApiJsonContext.Default.CreatedJoinTokenDto, statusCode: StatusCodes.Status201Created);
     }
 
     private static async Task<IResult> RevokeTokenAsync(JoinTokenService tokens, string id, bool? purge, CancellationToken ct)

backend/src/MoShiro.Backend.Api/Contracts/AdminDtos.cs

@@ -91,6 +91,12 @@ public sealed record InstallCommandsDto(string Linux, string Macos, string Windo
 /// <param name="Windows">Windows（Docker Desktop，PowerShell）；Agent 同样是空的。</param>
 public sealed record ComposeInstallDto(string Env, string Url, string Sha256, string Linux, string Macos, string Windows);
 
+/// <param name="Env">要存成 <c>~/.config/moshiro/&lt;角色&gt;.env</c> 的内容（只有公开的值）。</param>
+/// <param name="Url">Quadlet 单元的下载地址。</param>
+/// <param name="Sha256">Quadlet 单元的 SHA-256：命令下载之后先核对它。</param>
+/// <param name="Command">Linux + Podman（rootless）：写 env、下载并核对单元、指定镜像仓库、启动，合在一起的一条命令。</param>
+public sealed record QuadletInstallDto(string Env, string Url, string Sha256, string Command);
+
 /// <summary>下一版里新增的 passkey。</summary>
 public sealed record ProposedCredentialDto(string Id, string Name, DateTimeOffset CreatedAt);
 
@@ -108,7 +114,7 @@ public sealed record TrustProposalDto(string Statement, int Version, string Chal
 /// <param name="InstallMatchesRelease">和 CI 签名的发布清单里记的哈希是否一致；没有清单或清单里没记时为空。不一致说明这个面板提供的脚本不是 CI 构建出来的那份。</param>
 public sealed record TrustStateDto(bool Initialized, string? Genesis, int Version, bool InSync, TrustProposalDto? Proposal, string InstallUrl = "", IReadOnlyList<string>? Operators = null, string InstallShSha256 = "", string InstallPs1Sha256 = "", bool? InstallMatchesRelease = null, string ServerKey = "", bool ServerKeyListed = false, IReadOnlyList<NodeOwnerDto>? OperatorDetails = null);
 
-public sealed record CreatedJoinTokenDto(JoinTokenDto Token, string Plaintext, InstallCommandsDto InstallCommands, ComposeInstallDto Compose);
+public sealed record CreatedJoinTokenDto(JoinTokenDto Token, string Plaintext, InstallCommandsDto InstallCommands, ComposeInstallDto Compose, QuadletInstallDto Quadlet);
 
 /// <summary>Agent 眼中连着的一个 Probe（Agent 上报）。</summary>
 public sealed record ConnectedProbeDto(string ProbeId, string? Version, string? Remote, DateTimeOffset ConnectedSince, string IpVersion = "ipv4");

backend/src/MoShiro.Backend.Api/Contracts/ApiJsonContext.cs

@@ -87,6 +87,7 @@ namespace MoShiro.Backend.Api;
 [JsonSerializable(typeof(SetupStatusDto))]
 [JsonSerializable(typeof(SetupRequest))]
 [JsonSerializable(typeof(ComposeInstallDto))]
+[JsonSerializable(typeof(QuadletInstallDto))]
 [JsonSerializable(typeof(ProposedCredentialDto))]
 [JsonSerializable(typeof(PasskeyDto))]
 [JsonSerializable(typeof(PageDto<PasskeyDto>))]

backend/src/MoShiro.Backend.Api/InstallScripts.cs

@@ -25,6 +25,12 @@ public static class InstallScripts
     /// <summary>某个角色（agent、probe）的 compose 文件的 SHA-256；其他角色返回空。</summary>
     public static string ComposeSha256(string? role) => role is "agent" or "probe" ? Sha256("compose-" + role + ".yaml") : string.Empty;
 
+    /// <summary>Quadlet 单元的资源名（<c>agent.container</c>、<c>probe.container</c>）；不是这两个就是 null。</summary>
+    public static string? QuadletResource(string file) => file is "agent.container" or "probe.container" ? "quadlet-" + file : null;
+
+    /// <summary>某个角色（agent、probe）的 Quadlet 单元的 SHA-256；其他角色返回空。</summary>
+    public static string QuadletSha256(string? role) => role is "agent" or "probe" ? Sha256("quadlet-" + role + ".container") : string.Empty;
+
     /// <summary>脚本内容的 SHA-256（小写十六进制，按 UTF-8 字节）。</summary>
     public static string Sha256(string resource) => Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(Read(resource))));
 

backend/src/MoShiro.Backend.Api/MoShiro.Backend.Api.csproj

@@ -13,6 +13,8 @@
     <EmbeddedResource Include="..\..\..\packaging\compose\agent\compose.yaml" LogicalName="compose-agent.yaml" />
     <EmbeddedResource Include="..\..\..\packaging\compose\probe\compose.yaml" LogicalName="compose-probe.yaml" />
     <EmbeddedResource Include="..\..\..\packaging\compose\backend\compose.yaml" LogicalName="compose-backend.yaml" />
+    <EmbeddedResource Include="..\..\..\packaging\quadlet\moshiro-agent.container" LogicalName="quadlet-agent.container" />
+    <EmbeddedResource Include="..\..\..\packaging\quadlet\moshiro-probe.container" LogicalName="quadlet-probe.container" />
   </ItemGroup>
   <!-- 前端构建产物（web 目录下 npm run build）内嵌进 Backend；没构建时不嵌入，Backend 只提供 API -->
   <ItemGroup Condition="Exists('..\..\..\web\display\dist\index.html')">

backend/src/MoShiro.Backend.Api/OpsEndpoints.cs

@@ -38,6 +38,10 @@ public static class OpsEndpoints
         app.MapGet("/install/compose/{file}", (HttpContext http, string file) => InstallScripts.ComposeResource(file) is { } resource ? Static(http, resource, "text/yaml") : Problems.Create(http, MoShiroErrors.NotFound, "unknown compose file"))
             .Api("install_compose", "The static compose file of agent, probe or backend (agent.yaml, probe.yaml, backend.yaml; same bytes for everyone)", Tag)
             .Produces(StatusCodes.Status200OK, contentType: "text/yaml").ProducesProblems(404);
+        // Podman Quadlet 单元（Linux 上推荐，节点的更新靠 Pull=always）：Agent、Probe 各一份，静态，命令里先核对 SHA-256。
+        app.MapGet("/install/quadlet/{file}", (HttpContext http, string file) => InstallScripts.QuadletResource(file) is { } resource ? Static(http, resource, "text/plain") : Problems.Create(http, MoShiroErrors.NotFound, "unknown quadlet file"))
+            .Api("install_quadlet", "The static Podman Quadlet unit of agent or probe (agent.container, probe.container; same bytes for everyone)", Tag)
+            .Produces(StatusCodes.Status200OK, contentType: "text/plain").ProducesProblems(404);
         app.MapGet("/install.ps1", (HttpContext http) => Static(http, InstallScripts.Ps1, "text/plain"))
             .Api("install_ps1", "The static one-line installer for Windows nodes (same bytes for everyone; its SHA-256 is published with each release)", Tag)
             .Produces(StatusCodes.Status200OK, contentType: "text/plain");

backend/src/MoShiro.Backend.Application/Admin/JoinTokenService.cs

@@ -15,7 +15,8 @@ public sealed record InstallCommands(string Linux, string Macos, string Windows)
 /// 和面板提供的静态安装脚本的 SHA-256（命令先核对哈希再执行）。没有建立信任根时 <c>Genesis</c> 为空，节点不固定信任根。
 /// </summary>
 /// <param name="ComposeSha256">面板提供的这个角色的 compose 文件的 SHA-256（命令下载之后先核对）。</param>
-public sealed record InstallPlan(string? Genesis, IReadOnlyList<string> Controllers, string ScriptShSha256, string ScriptPs1Sha256, string ComposeSha256 = "");
+/// <param name="QuadletSha256">面板提供的这个角色的 Podman Quadlet 单元的 SHA-256。</param>
+public sealed record InstallPlan(string? Genesis, IReadOnlyList<string> Controllers, string ScriptShSha256, string ScriptPs1Sha256, string ComposeSha256 = "", string QuadletSha256 = "");
 
 /// <summary>
 /// compose 安装：<c>Env</c> 是要存成 <c>.env</c> 的内容（只有公开的值），<c>Url</c> 和 <c>Sha256</c> 是 compose 文件的下载地址和哈希，
@@ -23,7 +24,13 @@ public sealed record InstallPlan(string? Genesis, IReadOnlyList<string> Controll
 /// </summary>
 public sealed record ComposeInstall(string Env, string Url, string Sha256, string Linux, string Macos, string Windows);
 
-public sealed record CreatedJoinToken(JoinTokenInfo Info, string Plaintext, InstallCommands InstallCommands, ComposeInstall Compose);
+/// <summary>
+/// Podman Quadlet 安装（Linux 上推荐）：<c>Env</c> 存成 <c>~/.config/moshiro/&lt;角色&gt;.env</c>，<c>Url</c> 和 <c>Sha256</c> 是 Quadlet 单元的下载地址和哈希，
+/// <c>Command</c> 把 env、单元、镜像仓库（drop-in）、核对哈希和启动合在一起。单元写了 <c>Pull=always</c>，节点退出再被拉起就是更新，默认自动更新。
+/// </summary>
+public sealed record QuadletInstall(string Env, string Url, string Sha256, string Command);
+
+public sealed record CreatedJoinToken(JoinTokenInfo Info, string Plaintext, InstallCommands InstallCommands, ComposeInstall Compose, QuadletInstall Quadlet);
 
 /// <summary>加入令牌：明文只在创建时返回一次，服务端只保存 SHA-256。</summary>
 public sealed class JoinTokenService
@@ -86,7 +93,7 @@ public sealed class JoinTokenService
             Ulid.NewPrefixed("jtk", _time), TokenHash.Sha256(plaintext), request.Note, request.Labels ?? [], request.AutoApprove, KindOf(request.Role),
             request.MaxUses, now + (request.ExpiresInHours * 3_600_000L), now, request.CreatedBy, ct);
 
-        return Result<CreatedJoinToken>.Ok(new CreatedJoinToken(info, plaintext, Commands(BaseUrl(requestBaseUrl), request.Role, plaintext, plan), Compose(BaseUrl(requestBaseUrl), request.Role, plaintext, plan)));
+        return Result<CreatedJoinToken>.Ok(new CreatedJoinToken(info, plaintext, Commands(BaseUrl(requestBaseUrl), request.Role, plaintext, plan), Compose(BaseUrl(requestBaseUrl), request.Role, plaintext, plan), Quadlet(BaseUrl(requestBaseUrl), request.Role, plaintext, plan)));
     }
 
     /// <summary>
@@ -150,6 +157,35 @@ public sealed class JoinTokenService
         return new ComposeInstall(Env(false), url, plan.ComposeSha256, linux, macos, windows);
     }
 
+    /// <summary>
+    /// Podman Quadlet 安装：env 文件、单元文件（静态，核对哈希）、一个把镜像仓库指向面板配置的 drop-in，然后启动用户服务。
+    /// 自动更新默认开（<c>MOSHIRO_UPDATE_POLICY</c> 缺省是 auto）：env 里留了一行注释，去掉 # 就改成在管理端手动点更新。
+    /// </summary>
+    public QuadletInstall Quadlet(string baseUrl, string role, string code, InstallPlan plan)
+    {
+        string url = $"{baseUrl}/install/quadlet/{role}.container";
+        var lines = new List<string> { $"MOSHIRO_SERVER={baseUrl}", $"MOSHIRO_JOIN={code}" };
+        if (plan.Genesis is null)
+        {
+            lines.Add("MOSHIRO_ALLOW_NO_OWNER=1");
+        }
+        else
+        {
+            lines.Add($"MOSHIRO_GENESIS={plan.Genesis}");
+            lines.Add($"MOSHIRO_CONTROLLERS={string.Join(',', plan.Controllers)}");
+        }
+
+        lines.Add("# 自动更新默认开：面板发现新版本后，节点运行满 10 分钟就自动重启，Podman 启动时拉最新镜像。想改成在管理端手动点「更新」，去掉下一行的 #");
+        lines.Add("# MOSHIRO_UPDATE_POLICY=manual");
+        string env = string.Join('\n', lines);
+        string unit = $"$HOME/.config/containers/systemd/moshiro-{role}.container";
+        string command = $"mkdir -p ~/.config/moshiro ~/.config/containers/systemd/moshiro-{role}.container.d && cat > ~/.config/moshiro/{role}.env <<'EOF'\n{env}\nEOF\n"
+            + $"chmod 600 ~/.config/moshiro/{role}.env && curl -fsSL '{url}' -o \"{unit}\" && echo \"{plan.QuadletSha256}  {unit}\" | sha256sum -c - "
+            + $"&& printf '[Container]\\nImage={ImageRepository(role)}:latest\\n' > ~/.config/containers/systemd/moshiro-{role}.container.d/10-image.conf "
+            + $"&& systemctl --user daemon-reload && systemctl --user start moshiro-{role}";
+        return new QuadletInstall(env, url, plan.QuadletSha256, command);
+    }
+
     /// <summary>这个角色的镜像仓库地址（不带 tag）：节点镜像仓库加上命名空间。</summary>
     private string ImageRepository(string role)
     {