feat!: probes generate their own keys and enroll with a join token; node and peer keys are separate [CI]

packaging/container/deploy-node.sh

@@ -3,7 +3,7 @@
 # 重新安装单元和更新器，然后重启节点；已有的身份和配置不会被覆盖。
 #
 #   首次部署 Agent：sudo sh deploy-node.sh agent --image-repo REPO --server https://panel --join jt_xxx --name hk-1
-#   首次部署 Probe：sudo sh deploy-node.sh probe --image-repo REPO --probe-json ./probe.json
+#   首次部署 Probe：sudo sh deploy-node.sh probe --image-repo REPO --server https://panel --join jt_xxx --name home-1
 #   更新（配置迁移、单元和更新器、镜像）：sudo sh deploy-node.sh agent   （其余参数沿用上次的更新器配置）
 #
 # 需要 root、systemd，以及 Podman 或 Docker；脚本要和 packaging/ 里的 systemd/、update/ 放在一起。
@@ -12,13 +12,13 @@ set -eu
 
 usage() {
   echo "usage: deploy-node.sh <agent|probe> [--engine podman|docker] [--image-repo R] [--tag T] [--image REF]" >&2
-  echo "       [--server URL --join TOKEN --name NAME] [--probe-json FILE] [--policy auto|manual] [--authfile F]" >&2
+  echo "       [--server URL --join TOKEN --name NAME] [--policy auto|manual] [--authfile F]" >&2
   exit 2
 }
 
 ROLE="${1:-}"; shift || true
 case "$ROLE" in agent|probe) ;; *) usage ;; esac
-ENGINE=""; REPO=""; TAG=latest; IMAGE=""; SERVER=""; JOIN=""; NAME=""; PROBE_JSON=""; POLICY=""; AUTHFILE=""
+ENGINE=""; REPO=""; TAG=latest; IMAGE=""; SERVER=""; JOIN=""; NAME=""; POLICY=""; AUTHFILE=""
 while [ $# -gt 0 ]; do
   case "$1" in
     --engine) ENGINE="$2"; shift 2 ;;
@@ -28,7 +28,6 @@ while [ $# -gt 0 ]; do
     --server) SERVER="$2"; shift 2 ;;
     --join) JOIN="$2"; shift 2 ;;
     --name) NAME="$2"; shift 2 ;;
-    --probe-json) PROBE_JSON="$2"; shift 2 ;;
     --policy) POLICY="$2"; shift 2 ;;
     --authfile) AUTHFILE="$2"; shift 2 ;;
     *) usage ;;
@@ -82,13 +81,14 @@ in_volume() {
 }
 in_volume 'mkdir -p /etc/moshiro/update' </dev/null
 
-# 3. 配置
+# 3. 配置：身份由节点自己生成（Agent 和 Probe 一样），注册之后面板只认这把公钥
+ID_DIR="/etc/moshiro/$ROLE-id"
+if ! in_volume "test -f $ID_DIR/node.json" </dev/null; then
+  [ -n "$SERVER" ] && [ -n "$JOIN" ] && [ -n "$NAME" ] || { echo "first deployment needs --server, --join and --name" >&2; exit 1; }
+  "$ENGINE" run --rm --pull=never -v "$V_CFG:/etc/moshiro" --entrypoint /usr/local/bin/fleet-enroll "$IMAGE" \
+    --server "$SERVER" --join "$JOIN" --name "$NAME" --identity-dir "$ID_DIR"
+fi
 if [ "$ROLE" = agent ]; then
-  if ! in_volume 'test -f /etc/moshiro/agent-id/node.json' </dev/null; then
-    [ -n "$SERVER" ] && [ -n "$JOIN" ] && [ -n "$NAME" ] || { echo "first deployment needs --server, --join and --name" >&2; exit 1; }
-    "$ENGINE" run --rm --pull=never -v "$V_CFG:/etc/moshiro" --entrypoint /usr/local/bin/fleet-enroll "$IMAGE" \
-      --server "$SERVER" --join "$JOIN" --name "$NAME" --identity-dir /etc/moshiro/agent-id
-  fi
   if ! in_volume 'test -f /etc/moshiro/agent.json' </dev/null; then
     [ -n "$SERVER" ] || { echo "agent.json is missing; pass --server to create it" >&2; exit 1; }
     printf '{"fleet":{"server":"%s","identity_dir":"/etc/moshiro/agent-id"},"listen":{"bind":"::"}}\n' "$SERVER" \
@@ -100,11 +100,11 @@ if [ "$ROLE" = agent ]; then
     echo "config: listen.bind 0.0.0.0 -> ::"
   fi
 else
-  if [ -n "$PROBE_JSON" ]; then
-    in_volume 'umask 077; cat > /etc/moshiro/probe.json' < "$PROBE_JSON"
-    echo "config: imported probe.json"
-  elif ! in_volume 'test -f /etc/moshiro/probe.json' </dev/null; then
-    echo "first deployment needs --probe-json (download it from the panel)" >&2; exit 1
+  if ! in_volume 'test -f /etc/moshiro/probe.json' </dev/null; then
+    [ -n "$SERVER" ] || { echo "probe.json is missing; pass --server to create it" >&2; exit 1; }
+    printf '{"fleet":{"server":"%s","identity_dir":"/etc/moshiro/probe-id"}}\n' "$SERVER" \
+      | in_volume 'umask 077; cat > /etc/moshiro/probe.json'
+    echo "config: created probe.json"
   fi
 fi