feat!: probes generate their own keys and enroll with a join token; node and peer keys are separate [CI]

packaging/container/Probe.Containerfile

@@ -7,6 +7,7 @@ LABEL org.opencontainers.image.title="MoShiro Probe" \
       org.opencontainers.image.version="$APP_VERSION"
 
 COPY --chown=1654:1654 app/moshiro-probe /usr/local/bin/moshiro-probe
+COPY --chown=1654:1654 app/fleet-enroll /usr/local/bin/fleet-enroll
 COPY --chown=1654:1654 config/ /etc/moshiro/
 
 USER 1654:1654

packaging/container/Probe.NativeBuild.Containerfile

@@ -3,7 +3,8 @@ FROM mcr.microsoft.com/dotnet/sdk:10.0-alpine-aot AS build
 WORKDIR /src/backend
 COPY restore/backend/ ./
 # restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」
-RUN dotnet restore probe/src/MoShiro.Probe -r linux-musl-x64 -p:PublishAot=true --artifacts-path /artifacts
+RUN dotnet restore probe/src/MoShiro.Probe -r linux-musl-x64 -p:PublishAot=true --artifacts-path /artifacts \
+    && dotnet restore fleet/tools/fleet-enroll -r linux-musl-x64 -p:PublishAot=true --artifacts-path /artifacts
 
 COPY source/backend/ ./
 # 构建信息：CI 通过 --build-arg 传入；不传就是空（放在 restore 之后，每次构建都变的时间不会让依赖还原的缓存失效）
@@ -14,10 +15,14 @@ ENV MOSHIRO_TAG=$MOSHIRO_TAG MOSHIRO_COMMIT=$MOSHIRO_COMMIT MOSHIRO_BUILT_AT=$MO
 RUN dotnet publish probe/src/MoShiro.Probe -m:3 -c Release -r linux-musl-x64 \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=false \
     -p:UseAppHost=true -p:StripSymbols=true \
-    -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/probe
+    -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/probe \
+    && dotnet publish fleet/tools/fleet-enroll -m:3 -c Release -r linux-musl-x64 \
+    --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=false \
+    -p:UseAppHost=true -p:StripSymbols=true \
+    -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/enroll
 # 原生程序有几 MB；几十 KB 的是只会去找 .dll 的启动器
-RUN test -x /out/probe/moshiro-probe \
-    && test "$(stat -c%s /out/probe/moshiro-probe)" -gt 2000000
+RUN test -x /out/probe/moshiro-probe && test -x /out/enroll/fleet-enroll \
+    && test "$(stat -c%s /out/probe/moshiro-probe)" -gt 2000000 && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000
 
 FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine
 
@@ -28,6 +33,7 @@ LABEL org.opencontainers.image.title="MoShiro Probe" \
       org.opencontainers.image.version="$APP_VERSION"
 
 COPY --chown=1654:1654 --from=build /out/probe/moshiro-probe /usr/local/bin/moshiro-probe
+COPY --chown=1654:1654 --from=build /out/enroll/fleet-enroll /usr/local/bin/fleet-enroll
 COPY --chown=1654:1654 config/ /etc/moshiro/
 
 USER 1654:1654

packaging/container/deploy-node.sh

@@ -3,7 +3,7 @@
 # 重新安装单元和更新器，然后重启节点；已有的身份和配置不会被覆盖。
 #
 #   首次部署 Agent：sudo sh deploy-node.sh agent --image-repo REPO --server https://panel --join jt_xxx --name hk-1
-#   首次部署 Probe：sudo sh deploy-node.sh probe --image-repo REPO --probe-json ./probe.json
+#   首次部署 Probe：sudo sh deploy-node.sh probe --image-repo REPO --server https://panel --join jt_xxx --name home-1
 #   更新（配置迁移、单元和更新器、镜像）：sudo sh deploy-node.sh agent   （其余参数沿用上次的更新器配置）
 #
 # 需要 root、systemd，以及 Podman 或 Docker；脚本要和 packaging/ 里的 systemd/、update/ 放在一起。
@@ -12,13 +12,13 @@ set -eu
 
 usage() {
   echo "usage: deploy-node.sh <agent|probe> [--engine podman|docker] [--image-repo R] [--tag T] [--image REF]" >&2
-  echo "       [--server URL --join TOKEN --name NAME] [--probe-json FILE] [--policy auto|manual] [--authfile F]" >&2
+  echo "       [--server URL --join TOKEN --name NAME] [--policy auto|manual] [--authfile F]" >&2
   exit 2
 }
 
 ROLE="${1:-}"; shift || true
 case "$ROLE" in agent|probe) ;; *) usage ;; esac
-ENGINE=""; REPO=""; TAG=latest; IMAGE=""; SERVER=""; JOIN=""; NAME=""; PROBE_JSON=""; POLICY=""; AUTHFILE=""
+ENGINE=""; REPO=""; TAG=latest; IMAGE=""; SERVER=""; JOIN=""; NAME=""; POLICY=""; AUTHFILE=""
 while [ $# -gt 0 ]; do
   case "$1" in
     --engine) ENGINE="$2"; shift 2 ;;
@@ -28,7 +28,6 @@ while [ $# -gt 0 ]; do
     --server) SERVER="$2"; shift 2 ;;
     --join) JOIN="$2"; shift 2 ;;
     --name) NAME="$2"; shift 2 ;;
-    --probe-json) PROBE_JSON="$2"; shift 2 ;;
     --policy) POLICY="$2"; shift 2 ;;
     --authfile) AUTHFILE="$2"; shift 2 ;;
     *) usage ;;
@@ -82,13 +81,14 @@ in_volume() {
 }
 in_volume 'mkdir -p /etc/moshiro/update' </dev/null
 
-# 3. 配置
+# 3. 配置：身份由节点自己生成（Agent 和 Probe 一样），注册之后面板只认这把公钥
+ID_DIR="/etc/moshiro/$ROLE-id"
+if ! in_volume "test -f $ID_DIR/node.json" </dev/null; then
+  [ -n "$SERVER" ] && [ -n "$JOIN" ] && [ -n "$NAME" ] || { echo "first deployment needs --server, --join and --name" >&2; exit 1; }
+  "$ENGINE" run --rm --pull=never -v "$V_CFG:/etc/moshiro" --entrypoint /usr/local/bin/fleet-enroll "$IMAGE" \
+    --server "$SERVER" --join "$JOIN" --name "$NAME" --identity-dir "$ID_DIR"
+fi
 if [ "$ROLE" = agent ]; then
-  if ! in_volume 'test -f /etc/moshiro/agent-id/node.json' </dev/null; then
-    [ -n "$SERVER" ] && [ -n "$JOIN" ] && [ -n "$NAME" ] || { echo "first deployment needs --server, --join and --name" >&2; exit 1; }
-    "$ENGINE" run --rm --pull=never -v "$V_CFG:/etc/moshiro" --entrypoint /usr/local/bin/fleet-enroll "$IMAGE" \
-      --server "$SERVER" --join "$JOIN" --name "$NAME" --identity-dir /etc/moshiro/agent-id
-  fi
   if ! in_volume 'test -f /etc/moshiro/agent.json' </dev/null; then
     [ -n "$SERVER" ] || { echo "agent.json is missing; pass --server to create it" >&2; exit 1; }
     printf '{"fleet":{"server":"%s","identity_dir":"/etc/moshiro/agent-id"},"listen":{"bind":"::"}}\n' "$SERVER" \
@@ -100,11 +100,11 @@ if [ "$ROLE" = agent ]; then
     echo "config: listen.bind 0.0.0.0 -> ::"
   fi
 else
-  if [ -n "$PROBE_JSON" ]; then
-    in_volume 'umask 077; cat > /etc/moshiro/probe.json' < "$PROBE_JSON"
-    echo "config: imported probe.json"
-  elif ! in_volume 'test -f /etc/moshiro/probe.json' </dev/null; then
-    echo "first deployment needs --probe-json (download it from the panel)" >&2; exit 1
+  if ! in_volume 'test -f /etc/moshiro/probe.json' </dev/null; then
+    [ -n "$SERVER" ] || { echo "probe.json is missing; pass --server to create it" >&2; exit 1; }
+    printf '{"fleet":{"server":"%s","identity_dir":"/etc/moshiro/probe-id"}}\n' "$SERVER" \
+      | in_volume 'umask 077; cat > /etc/moshiro/probe.json'
+    echo "config: created probe.json"
   fi
 fi