feat!: probes generate their own keys and enroll with a join token; node and peer keys are separate [CI]

packaging/install.sh

@@ -3,7 +3,7 @@
 # POSIX sh: runs on Debian/Ubuntu/Alpine/OpenWrt (busybox).
 #
 #   ./install.sh agent --server https://panel.example.com --join <join-token> --name hk-1
-#   ./install.sh probe [--probe-json /path/to/probe.json]
+#   ./install.sh probe --server https://panel --join jt_xxx --name home-1
 #   ./install.sh uninstall agent|probe [--purge]
 #
 # Binaries go to /usr/lib/moshiro (root-owned: the collector cannot rewrite its own executable);
@@ -62,27 +62,34 @@ install_binary() {
   put 0755 "$HERE/$src" "$PREFIX/$src"
 }
 
-write_agent_config() {
-  cat >"$CONFIG/agent.json" <<JSON
+write_config() {
+  if [ "$1" = agent ]; then
+    cat >"$CONFIG/agent.json" <<JSON
 {
-  "fleet": { "server": "$1", "identity_dir": "$CONFIG" },
+  "fleet": { "server": "$2", "identity_dir": "$CONFIG" },
   "listen": { "bind": "::", "control_port": 7443, "udp_ports": [7443], "tcp_ports": [7444] },
   "limits": { "max_total_mbps": 200, "max_total_pps": 20000, "allowed_target_cidrs": [], "max_concurrent_tests": 1 }
 }
 JSON
-  chmod 0640 "$CONFIG/agent.json"
-  if [ "$have_user" -eq 1 ]; then chown "root:$(id -gn "$USER_NAME")" "$CONFIG/agent.json"; fi
+  else
+    cat >"$CONFIG/probe.json" <<JSON
+{
+  "fleet": { "server": "$2", "identity_dir": "$CONFIG" }
+}
+JSON
+  fi
+  chmod 0640 "$CONFIG/$1.json"
+  if [ "$have_user" -eq 1 ]; then chown "root:$(id -gn "$USER_NAME")" "$CONFIG/$1.json"; fi
 }
 
 install_role() {
   role="$1"; shift
-  server=""; join=""; name=""; probe_json=""; no_start=0
+  server=""; join=""; name=""; no_start=0
   while [ $# -gt 0 ]; do
     case "$1" in
       --server) server="$2"; shift 2 ;;
       --join) join="$2"; shift 2 ;;
       --name) name="$2"; shift 2 ;;
-      --probe-json) probe_json="$2"; shift 2 ;;
       --no-start) no_start=1; shift ;;
       *) die "unknown option: $1" ;;
     esac
@@ -96,7 +103,7 @@ install_role() {
   chmod 0750 "$CONFIG"
 
   install_binary "moshiro-$role"
-  if [ "$role" = agent ]; then install_binary fleet-enroll; fi
+  install_binary fleet-enroll
   say "installed binaries to $PREFIX"
 
   init="$(init_system)"
@@ -114,25 +121,17 @@ install_role() {
   esac
 
   ready=0
-  if [ "$role" = agent ]; then
-    if [ -n "$server" ] && [ ! -f "$CONFIG/node.json" ]; then
-      [ -n "$join" ] && [ -n "$name" ] || die "--server needs --join and --name to enroll"
-      say "enrolling as $name"
-      if [ "$have_user" -eq 1 ]; then
-        su -s /bin/sh "$USER_NAME" -c "'$PREFIX/fleet-enroll' --server '$server' --join '$join' --name '$name' --identity-dir '$CONFIG'"
-      else
-        "$PREFIX/fleet-enroll" --server "$server" --join "$join" --name "$name" --identity-dir "$CONFIG"
-      fi
+  if [ -n "$server" ] && [ ! -f "$CONFIG/node.json" ]; then
+    [ -n "$join" ] && [ -n "$name" ] || die "--server needs --join and --name to enroll"
+    say "enrolling as $name"
+    if [ "$have_user" -eq 1 ]; then
+      su -s /bin/sh "$USER_NAME" -c "'$PREFIX/fleet-enroll' --server '$server' --join '$join' --name '$name' --identity-dir '$CONFIG'"
+    else
+      "$PREFIX/fleet-enroll" --server "$server" --join "$join" --name "$name" --identity-dir "$CONFIG"
     fi
-    if [ ! -f "$CONFIG/agent.json" ] && [ -n "$server" ]; then write_agent_config "$server"; fi
-    if [ -f "$CONFIG/agent.json" ] && [ -f "$CONFIG/node.json" ]; then ready=1; fi
-  else
-    if [ -n "$probe_json" ]; then
-      put 0600 "$probe_json" "$CONFIG/probe.json"
-      if [ "$have_user" -eq 1 ]; then chown "$USER_NAME" "$CONFIG/probe.json"; fi
-    fi
-    if [ -f "$CONFIG/probe.json" ]; then ready=1; fi
   fi
+  if [ ! -f "$CONFIG/$role.json" ] && [ -n "$server" ]; then write_config "$role" "$server"; fi
+  if [ -f "$CONFIG/$role.json" ] && [ -f "$CONFIG/node.json" ]; then ready=1; fi
 
   if [ "$ready" -eq 1 ] && [ "$no_start" -eq 0 ]; then
     case "$init" in
@@ -142,13 +141,9 @@ install_role() {
     say "moshiro-$role is installed"
   else
     say "installed, not started yet. Next:"
-    if [ "$role" = agent ]; then
-      echo "  $PREFIX/fleet-enroll --server <panel-url> --join <token> --name <name> --identity-dir $CONFIG   (as the '$USER_NAME' user)"
-      echo "  write $CONFIG/agent.json (see README.md), then: systemctl enable --now moshiro-agent"
-    else
-      echo "  save the panel's probe identity (POST /api/admin/probe/identity) as $CONFIG/probe.json (mode 0600, owner $USER_NAME)"
-      echo "  then: systemctl enable --now moshiro-probe     (OpenWrt: /etc/init.d/moshiro-probe enable && /etc/init.d/moshiro-probe start)"
-    fi
+    echo "  $PREFIX/fleet-enroll --server <panel-url> --join <token> --name <name> --identity-dir $CONFIG   (as the '$USER_NAME' user)"
+    echo "  write $CONFIG/$role.json (see README.md), then: systemctl enable --now moshiro-$role"
+    [ "$role" = agent ] || echo "  (OpenWrt: /etc/init.d/moshiro-probe enable && /etc/init.d/moshiro-probe start)"
   fi
 }
 
@@ -166,7 +161,7 @@ uninstall() {
       rm -f /etc/init.d/moshiro-probe /lib/upgrade/keep.d/moshiro ;;
   esac
   rm -f "$PREFIX/moshiro-$role"
-  if [ "$role" = agent ]; then rm -f "$PREFIX/fleet-enroll"; fi
+  rm -f "$PREFIX/fleet-enroll"
   rmdir "$PREFIX" 2>/dev/null || true
   if [ "$purge" -eq 1 ]; then
     rm -rf "$CONFIG"