diff --git a/.gitignore b/.gitignore
index e7833fa..af900e2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
artifacts/
+.release/
bin/
obj/
*.user
diff --git a/.woodpecker/gitea-release.yml b/.woodpecker/gitea-release.yml
new file mode 100644
index 0000000..f355761
--- /dev/null
+++ b/.woodpecker/gitea-release.yml
@@ -0,0 +1,27 @@
+labels:
+ ci: domain-linux-native
+ platform: linux/amd64
+
+clone:
+ - name: git
+ image: plugin-git
+ settings:
+ lfs: false
+
+when:
+ - event: tag
+ ref: refs/tags/v*
+
+depends_on:
+ - linux-release
+ - windows-release
+
+steps:
+ - name: publish-gitea-release
+ image: bash
+ environment:
+ GITEA_BASE: http://192.168.2.162:3100
+ GITEA_TOKEN:
+ from_secret: gitea_token
+ commands:
+ - bash ci/publish-gitea-release.sh
diff --git a/.woodpecker/linux-release.yml b/.woodpecker/linux-release.yml
new file mode 100644
index 0000000..19a7a58
--- /dev/null
+++ b/.woodpecker/linux-release.yml
@@ -0,0 +1,56 @@
+labels:
+ ci: domain-linux-native
+ platform: linux/amd64
+
+clone:
+ - name: git
+ image: plugin-git
+ settings:
+ lfs: false
+
+when:
+ - event: tag
+ ref: refs/tags/v*
+
+concurrency: 1
+
+steps:
+ - name: linux-amd64-backend
+ image: bash
+ environment:
+ NUGET_PACKAGES: /home/justme/.nuget/packages
+ ZOT_REGISTRY: 192.168.2.162:5000
+ ZOT_USERNAME:
+ from_secret: zot_username
+ ZOT_PASSWORD:
+ from_secret: zot_password
+ commands:
+ - bash ci/release-linux.sh amd64 backend
+ depends_on: []
+
+ - name: linux-arm64-backend
+ image: bash
+ environment:
+ NUGET_PACKAGES: /home/justme/.nuget/packages
+ ZOT_REGISTRY: 192.168.2.162:5000
+ ZOT_USERNAME:
+ from_secret: zot_username
+ ZOT_PASSWORD:
+ from_secret: zot_password
+ commands:
+ - bash ci/release-linux.sh arm64 backend
+ depends_on: []
+
+ - name: backend-multiarch-index
+ image: bash
+ environment:
+ ZOT_REGISTRY: 192.168.2.162:5000
+ ZOT_USERNAME:
+ from_secret: zot_username
+ ZOT_PASSWORD:
+ from_secret: zot_password
+ commands:
+ - bash ci/index-backend-image.sh
+ depends_on:
+ - linux-amd64-backend
+ - linux-arm64-backend
diff --git a/.woodpecker/verify.yml b/.woodpecker/verify.yml
new file mode 100644
index 0000000..57a4be3
--- /dev/null
+++ b/.woodpecker/verify.yml
@@ -0,0 +1,30 @@
+labels:
+ ci: domain-linux-native
+ platform: linux/amd64
+
+clone:
+ - name: git
+ image: plugin-git
+ settings:
+ lfs: false
+
+when:
+ - event: [push, pull_request]
+
+steps:
+ - name: backend-tests
+ image: bash
+ environment:
+ NUGET_PACKAGES: /home/justme/.nuget/packages
+ commands:
+ - cd backend && dotnet test --solution Monitor.slnx -c Release
+
+ - name: web-build
+ image: bash
+ environment:
+ NPM_CONFIG_CACHE: /home/justme/.npm
+ commands:
+ - npm ci --prefix web --prefer-offline
+ - npm run build --prefix web
+ - npm run lint:css --prefix web
+ depends_on: []
diff --git a/.woodpecker/windows-release.yml b/.woodpecker/windows-release.yml
new file mode 100644
index 0000000..2a5d6c0
--- /dev/null
+++ b/.woodpecker/windows-release.yml
@@ -0,0 +1,246 @@
+labels:
+ ci: domain-windows
+ platform: windows/amd64
+
+clone:
+ - name: git
+ image: plugin-git
+ settings:
+ lfs: false
+
+when:
+ - event: tag
+ ref: refs/tags/v*
+
+concurrency: 1
+
+steps:
+ - name: build-linux-x64-agent
+ image: powershell
+ environment: &build-environment
+ GITEA_BASE: http://localhost:3100
+ GITEA_TOKEN:
+ from_secret: gitea_token
+ NUGET_PACKAGES: 'C:\Users\JustMe-NAS\.nuget\packages'
+ RID: linux-x64
+ COMPONENT: agent
+ commands: &build-commands
+ - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
+ - ./ci/release-cross-platform.ps1 -RuntimeIdentifier $env:RID -Component $env:COMPONENT
+ depends_on: []
+
+ - name: build-linux-x64-probe
+ image: powershell
+ environment: &rid-linux-x64-probe
+ <<: *build-environment
+ COMPONENT: probe
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-linux-x64-enroll
+ image: powershell
+ environment: &rid-linux-x64-enroll
+ <<: *build-environment
+ COMPONENT: fleet-enroll
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-linux-arm64-agent
+ image: powershell
+ environment: &rid-linux-arm64-agent
+ <<: *build-environment
+ RID: linux-arm64
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-linux-arm64-probe
+ image: powershell
+ environment: &rid-linux-arm64-probe
+ <<: *rid-linux-arm64-agent
+ COMPONENT: probe
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-linux-arm64-enroll
+ image: powershell
+ environment: &rid-linux-arm64-enroll
+ <<: *rid-linux-arm64-agent
+ COMPONENT: fleet-enroll
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-linux-musl-x64-agent
+ image: powershell
+ environment: &rid-linux-musl-x64-agent
+ <<: *build-environment
+ RID: linux-musl-x64
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-linux-musl-x64-probe
+ image: powershell
+ environment: &rid-linux-musl-x64-probe
+ <<: *rid-linux-musl-x64-agent
+ COMPONENT: probe
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-linux-musl-x64-enroll
+ image: powershell
+ environment: &rid-linux-musl-x64-enroll
+ <<: *rid-linux-musl-x64-agent
+ COMPONENT: fleet-enroll
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-linux-musl-arm64-agent
+ image: powershell
+ environment: &rid-linux-musl-arm64-agent
+ <<: *build-environment
+ RID: linux-musl-arm64
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-linux-musl-arm64-probe
+ image: powershell
+ environment: &rid-linux-musl-arm64-probe
+ <<: *rid-linux-musl-arm64-agent
+ COMPONENT: probe
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-linux-musl-arm64-enroll
+ image: powershell
+ environment: &rid-linux-musl-arm64-enroll
+ <<: *rid-linux-musl-arm64-agent
+ COMPONENT: fleet-enroll
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-macos-x64-agent
+ image: powershell
+ environment: &rid-macos-x64-agent
+ <<: *build-environment
+ RID: osx-x64
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-macos-x64-probe
+ image: powershell
+ environment: &rid-macos-x64-probe
+ <<: *rid-macos-x64-agent
+ COMPONENT: probe
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-macos-x64-enroll
+ image: powershell
+ environment: &rid-macos-x64-enroll
+ <<: *rid-macos-x64-agent
+ COMPONENT: fleet-enroll
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-macos-arm64-agent
+ image: powershell
+ environment: &rid-macos-arm64-agent
+ <<: *build-environment
+ RID: osx-arm64
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-macos-arm64-probe
+ image: powershell
+ environment: &rid-macos-arm64-probe
+ <<: *rid-macos-arm64-agent
+ COMPONENT: probe
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-macos-arm64-enroll
+ image: powershell
+ environment: &rid-macos-arm64-enroll
+ <<: *rid-macos-arm64-agent
+ COMPONENT: fleet-enroll
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-windows-x64-agent
+ image: powershell
+ environment: &rid-windows-x64-agent
+ <<: *build-environment
+ RID: win-x64
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-windows-x64-probe
+ image: powershell
+ environment: &rid-windows-x64-probe
+ <<: *rid-windows-x64-agent
+ COMPONENT: probe
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-windows-x64-enroll
+ image: powershell
+ environment: &rid-windows-x64-enroll
+ <<: *rid-windows-x64-agent
+ COMPONENT: fleet-enroll
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-windows-arm64-agent
+ image: powershell
+ environment: &rid-windows-arm64-agent
+ <<: *build-environment
+ RID: win-arm64
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-windows-arm64-probe
+ image: powershell
+ environment: &rid-windows-arm64-probe
+ <<: *rid-windows-arm64-agent
+ COMPONENT: probe
+ commands: *build-commands
+ depends_on: []
+
+ - name: build-windows-arm64-enroll
+ image: powershell
+ environment: &rid-windows-arm64-enroll
+ <<: *rid-windows-arm64-agent
+ COMPONENT: fleet-enroll
+ commands: *build-commands
+ depends_on: []
+
+ - name: package-and-upload
+ image: powershell
+ environment: *build-environment
+ commands:
+ - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
+ - ./ci/package-cross-platform.ps1
+ depends_on:
+ - build-linux-x64-agent
+ - build-linux-x64-probe
+ - build-linux-x64-enroll
+ - build-linux-arm64-agent
+ - build-linux-arm64-probe
+ - build-linux-arm64-enroll
+ - build-linux-musl-x64-agent
+ - build-linux-musl-x64-probe
+ - build-linux-musl-x64-enroll
+ - build-linux-musl-arm64-agent
+ - build-linux-musl-arm64-probe
+ - build-linux-musl-arm64-enroll
+ - build-macos-x64-agent
+ - build-macos-x64-probe
+ - build-macos-x64-enroll
+ - build-macos-arm64-agent
+ - build-macos-arm64-probe
+ - build-macos-arm64-enroll
+ - build-windows-x64-agent
+ - build-windows-x64-probe
+ - build-windows-x64-enroll
+ - build-windows-arm64-agent
+ - build-windows-arm64-probe
+ - build-windows-arm64-enroll
diff --git a/README.md b/README.md
index 8ef7dba..dfc4fb4 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,6 @@ Probe <──测量会话──> Agent ──长连接与数据上报──> Bac
## 快速开始
### 环境要求
-[README.md](backend/README.md)
- .NET SDK 10；项目使用 `backend/global.json` 指定 SDK 版本和滚动策略。
- Node.js 与 npm，用于构建 Web 前端。
@@ -43,7 +42,9 @@ npm ci --prefix web
npm run build --prefix web
```
-前端产物位于 `web/display/dist/` 和 `web/admin/dist/`。NativeAOT 发布还需要对应平台的 C/C++ 工具链；Linux 发布脚本和 RID 说明见 [`docs/deployment.md`](docs/deployment.md)。
+前端产物位于 `web/display/dist/` 和 `web/admin/dist/`。NativeAOT 目标平台和 Windows 上使用 AotAnywhere 交叉构建的说明见 [`docs/deployment.md`](docs/deployment.md)。
+
+Backend 以 OCI 镜像发布，支持 Linux/amd64 与 Linux/arm64；Agent 和 Probe 发布 Linux glibc/musl x64、arm64，macOS x64/arm64，以及 Windows x64/arm64 二进制包。容器部署配置见 [`compose.yaml`](compose.yaml)，发布说明见 [`docs/deployment.md`](docs/deployment.md)。
### 本地运行
diff --git a/backend/Directory.Build.props b/backend/Directory.Build.props
index dd2894b..bbd8e84 100644
--- a/backend/Directory.Build.props
+++ b/backend/Directory.Build.props
@@ -5,6 +5,8 @@
enable
enable
true
+ none
+ false
latest-recommended
true
true
diff --git a/backend/README.md b/backend/README.md
index 7d3f43f..aae510d 100644
--- a/backend/README.md
+++ b/backend/README.md
@@ -36,7 +36,9 @@ dotnet test --solution Monitor.slnx
dotnet publish src/Monitor.Backend -c Release -r -p:PublishAot=true
```
-例如 `` 可为 `win-x64`、`linux-x64` 或 `linux-musl-x64`。NativeAOT 发布需要对应平台的 C/C++ 工具链。仓库根目录的 `scripts/publish.sh` 也提供发布和容器构建流程，详见 [`../docs/deployment.md`](../docs/deployment.md)。
+例如 `` 可为 `win-x64`、`linux-x64` 或 `linux-arm64`。NativeAOT 发布需要对应平台的 C/C++ 工具链。仓库根目录的 `scripts/publish.sh backend ` 可构建单个平台的 Backend 可执行文件；容器发布由 Woodpecker tag 流水线完成，详见 [`../docs/deployment.md`](../docs/deployment.md)。
+
+正式发布通过 Woodpecker tag 流水线生成 Linux/amd64 与 Linux/arm64 OCI 镜像，容器内监听 `8080`，数据写入挂载的 `/data` 卷。Agent 与 Probe 的多平台二进制包单独发布，不包含在 Backend 镜像中。
## 本地运行
diff --git a/backend/agent/src/Monitor.Agent/Monitor.Agent.csproj b/backend/agent/src/Monitor.Agent/Monitor.Agent.csproj
index 8ff3c29..86652a2 100644
--- a/backend/agent/src/Monitor.Agent/Monitor.Agent.csproj
+++ b/backend/agent/src/Monitor.Agent/Monitor.Agent.csproj
@@ -1,4 +1,7 @@
-
+
+
+
Exe
monitor-agent
@@ -11,4 +14,7 @@
+
+
diff --git a/backend/fleet/tools/fleet-enroll/fleet-enroll.csproj b/backend/fleet/tools/fleet-enroll/fleet-enroll.csproj
index 96f2d53..08e149e 100644
--- a/backend/fleet/tools/fleet-enroll/fleet-enroll.csproj
+++ b/backend/fleet/tools/fleet-enroll/fleet-enroll.csproj
@@ -1,4 +1,7 @@
-
+
+
+
Exe
fleet-enroll
@@ -8,4 +11,7 @@
+
+
diff --git a/backend/global.json b/backend/global.json
index a4e7375..2f5da59 100644
--- a/backend/global.json
+++ b/backend/global.json
@@ -3,6 +3,9 @@
"version": "10.0.200",
"rollForward": "latestFeature"
},
+ "msbuild-sdks": {
+ "StuDev.AotAnywhere": "1.0.5"
+ },
"test": {
"runner": "Microsoft.Testing.Platform"
}
diff --git a/backend/probe/src/Monitor.Probe/Monitor.Probe.csproj b/backend/probe/src/Monitor.Probe/Monitor.Probe.csproj
index 9621c17..22b9da3 100644
--- a/backend/probe/src/Monitor.Probe/Monitor.Probe.csproj
+++ b/backend/probe/src/Monitor.Probe/Monitor.Probe.csproj
@@ -1,4 +1,7 @@
-
+
+
+
Exe
monitor-probe
@@ -11,4 +14,7 @@
+
+
diff --git a/backend/tests/Monitor.Backend.Tests/AgentEndToEndTests.cs b/backend/tests/Monitor.Backend.Tests/AgentEndToEndTests.cs
index 5c41db0..cc4ae75 100644
--- a/backend/tests/Monitor.Backend.Tests/AgentEndToEndTests.cs
+++ b/backend/tests/Monitor.Backend.Tests/AgentEndToEndTests.cs
@@ -252,9 +252,32 @@ public sealed class AgentEndToEndTests
await using ProbeSimulator probe = await agent.ConnectProbeAsync();
await BackendFixture.EventuallyAsync(async () => (await AgentViewAsync(agent))["probe_connected"]!.GetValue());
- using HttpResponseMessage accepted = await _backend.Admin.PostAsync($"/api/admin/lines/{agent.Id}~{probe.ProbeId}/tests", BackendFixture.Json(new JsonObject { ["plan"] = "hy2_ladder", ["params"] = new JsonObject { ["size"] = 1000 } }));
- Assert.True(accepted.StatusCode == System.Net.HttpStatusCode.Accepted, await accepted.Content.ReadAsStringAsync());
- string testId = JsonNode.Parse(await accepted.Content.ReadAsStringAsync())!["id"]!.GetValue();
+ HttpResponseMessage? accepted = null;
+ string? startFailure = null;
+ for (int attempt = 0; attempt < 5; attempt++)
+ {
+ accepted = await _backend.Admin.PostAsync($"/api/admin/lines/{agent.Id}~{probe.ProbeId}/tests", BackendFixture.Json(new JsonObject { ["plan"] = "hy2_ladder", ["params"] = new JsonObject { ["size"] = 1000 } }));
+ if (accepted.StatusCode == System.Net.HttpStatusCode.Accepted)
+ {
+ break;
+ }
+
+ startFailure = await accepted.Content.ReadAsStringAsync();
+ string? code = JsonNode.Parse(startFailure)?["code"]?.GetValue();
+ accepted.Dispose();
+ accepted = null;
+ if (code != "probe_offline" || attempt == 4)
+ {
+ Assert.Fail($"The test request was rejected: {startFailure}");
+ }
+
+ await BackendFixture.EventuallyAsync(async () => (await AgentViewAsync(agent))["probe_connected"]!.GetValue(), TimeSpan.FromSeconds(15), "the probe should reconnect after a transient disconnect");
+ }
+
+ HttpResponseMessage acceptedResponse = accepted ?? throw new InvalidOperationException("The test request was not accepted.");
+ using (acceptedResponse)
+ {
+ string testId = JsonNode.Parse(await acceptedResponse.Content.ReadAsStringAsync())!["id"]!.GetValue();
JsonNode test = null!;
await BackendFixture.EventuallyAsync(
@@ -273,6 +296,7 @@ public sealed class AgentEndToEndTests
await BackendFixture.EventuallyAsync(
async () => (await _backend.GetJsonAsync(_backend.Admin, $"/api/admin/raw/chunks?agent_id={agent.Id}"))["items"]!.AsArray().Count(c => c!["kind"]!.GetValue() == "udp_train") == agent.App.Counters.Fragments,
because: (await _backend.GetJsonAsync(_backend.Admin, $"/api/admin/events?agent_id={agent.Id}")).ToJsonString() + $" fragments={agent.App.Counters.Fragments} discarded={agent.App.Counters.FragmentsDiscarded} pending={agent.App.Link.Outbox.PendingCount}/{agent.App.Link.Outbox.PendingBytes} dropped={agent.App.Link.Outbox.Dropped} link={agent.App.Link.IsConnected}");
+ }
}
[Fact]
diff --git a/backend/tests/Monitor.Backend.Tests/ApiBasicsTests.cs b/backend/tests/Monitor.Backend.Tests/ApiBasicsTests.cs
index 304dcfb..bf95a14 100644
--- a/backend/tests/Monitor.Backend.Tests/ApiBasicsTests.cs
+++ b/backend/tests/Monitor.Backend.Tests/ApiBasicsTests.cs
@@ -199,3 +199,6 @@ public sealed class ApiBasicsTests
[CollectionDefinition("backend")]
public sealed class BackendCollection : ICollectionFixture;
+
+[CollectionDefinition("probe-e2e")]
+public sealed class ProbeEndToEndCollection : ICollectionFixture;
diff --git a/backend/tests/Monitor.Backend.Tests/ArchitectureTests.cs b/backend/tests/Monitor.Backend.Tests/ArchitectureTests.cs
index 1c54695..cf81a17 100644
--- a/backend/tests/Monitor.Backend.Tests/ArchitectureTests.cs
+++ b/backend/tests/Monitor.Backend.Tests/ArchitectureTests.cs
@@ -36,10 +36,13 @@ public sealed class ArchitectureTests
Path.GetFileNameWithoutExtension(path),
path,
Path.GetDirectoryName(path)!,
- [.. items.Where(e => e.Name == "ProjectReference").Select(e => Path.GetFileNameWithoutExtension((string?)e.Attribute("Include") ?? ""))],
+ [.. items.Where(e => e.Name == "ProjectReference").Select(e => Path.GetFileNameWithoutExtension(NormalizePath((string?)e.Attribute("Include") ?? "")))],
[.. items.Where(e => e.Name == "PackageReference").Select(e => (string?)e.Attribute("Include") ?? "")]);
})];
+ private static string NormalizePath(string path) =>
+ path.Replace('\\', Path.DirectorySeparatorChar).Replace('/', Path.DirectorySeparatorChar);
+
private static bool IsTest(Project p) => p.Path.Contains(Path.DirectorySeparatorChar + "tests" + Path.DirectorySeparatorChar, StringComparison.Ordinal);
private static bool IsFleet(Project p) => p.Name.StartsWith("Fleet.", StringComparison.Ordinal) && !IsTest(p);
diff --git a/backend/tests/Monitor.Backend.Tests/ProbeEndToEndTests.cs b/backend/tests/Monitor.Backend.Tests/ProbeEndToEndTests.cs
index 652ccdf..d5f1b85 100644
--- a/backend/tests/Monitor.Backend.Tests/ProbeEndToEndTests.cs
+++ b/backend/tests/Monitor.Backend.Tests/ProbeEndToEndTests.cs
@@ -3,7 +3,7 @@ using System.Text.Json.Nodes;
namespace Monitor.Backend.Tests;
/// 真实的后端 + 真实的 Agent + 真实的 Probe（都在进程内，回环网络）。
-[Collection("backend")]
+[Collection("probe-e2e")]
public sealed class ProbeEndToEndTests
{
private readonly BackendFixture _backend;
diff --git a/ci/Monitor.Tar/Monitor.Tar.csproj b/ci/Monitor.Tar/Monitor.Tar.csproj
new file mode 100644
index 0000000..238f157
--- /dev/null
+++ b/ci/Monitor.Tar/Monitor.Tar.csproj
@@ -0,0 +1,8 @@
+
+
+ Exe
+ net10.0
+ enable
+ enable
+
+
diff --git a/ci/Monitor.Tar/Program.cs b/ci/Monitor.Tar/Program.cs
new file mode 100644
index 0000000..a66e340
--- /dev/null
+++ b/ci/Monitor.Tar/Program.cs
@@ -0,0 +1,38 @@
+using System.Formats.Tar;
+using System.IO.Compression;
+
+if (args.Length < 3)
+{
+ Console.Error.WriteLine("usage: Monitor.Tar ...");
+ return 2;
+}
+
+string sourceDirectory = Path.GetFullPath(args[0]);
+string archivePath = Path.GetFullPath(args[1]);
+HashSet executables = args.Skip(2).Select(path => path.Replace('\\', '/')).ToHashSet(StringComparer.Ordinal);
+UnixFileMode executableMode = UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute |
+ UnixFileMode.GroupRead | UnixFileMode.GroupExecute |
+ UnixFileMode.OtherRead | UnixFileMode.OtherExecute;
+UnixFileMode regularMode = UnixFileMode.UserRead | UnixFileMode.UserWrite |
+ UnixFileMode.GroupRead | UnixFileMode.OtherRead;
+
+Directory.CreateDirectory(Path.GetDirectoryName(archivePath)!);
+using FileStream fileStream = File.Create(archivePath);
+using GZipStream gzipStream = new(fileStream, CompressionLevel.Optimal, leaveOpen: true);
+using TarWriter writer = new(gzipStream, TarEntryFormat.Pax, leaveOpen: true);
+
+foreach (string filePath in Directory.EnumerateFiles(sourceDirectory, "*", SearchOption.AllDirectories))
+{
+ string relativePath = Path.GetRelativePath(sourceDirectory, filePath).Replace('\\', '/');
+ PaxTarEntry entry = new(TarEntryType.RegularFile, relativePath)
+ {
+ Mode = executables.Contains(relativePath) ? executableMode : regularMode,
+ DataStream = File.OpenRead(filePath)
+ };
+ using (entry.DataStream)
+ {
+ writer.WriteEntry(entry);
+ }
+}
+
+return 0;
diff --git a/ci/index-backend-image.sh b/ci/index-backend-image.sh
new file mode 100644
index 0000000..c2d1042
--- /dev/null
+++ b/ci/index-backend-image.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Publish a multi-architecture OCI index for the two architecture-specific
+# Backend images already pushed by release-linux.sh.
+set -euo pipefail
+
+version="${CI_COMMIT_TAG#v}"
+[[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+ echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+ exit 2
+}
+
+registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
+scheme="${ZOT_SCHEME:-http}"
+image="monitor/monitor-backend"
+auth_file="$(mktemp)"
+chmod 600 "$auth_file"
+trap 'rm -f "$auth_file"' EXIT
+printf 'machine %s login %s password %s\n' "${registry%%:*}" "$ZOT_USERNAME" "$ZOT_PASSWORD" > "$auth_file"
+
+accept='application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json'
+
+manifest_head() {
+ local tag="$1"
+ curl --silent --show-error --fail --head --netrc-file "$auth_file" \
+ -H "Accept: $accept" "$scheme://$registry/v2/$image/manifests/$tag" \
+ | tr -d '\r' | awk '
+ tolower($1)=="docker-content-digest:" { digest=$2 }
+ tolower($1)=="content-length:" { size=$2 }
+ tolower($1)=="content-type:" { media=$2 }
+ END { if (digest && size && media) print digest, size, media; else exit 1 }'
+}
+
+amd="$(manifest_head "$version-amd64")"
+arm="$(manifest_head "$version-arm64")"
+read -r amd_digest amd_size amd_media <<< "$amd"
+read -r arm_digest arm_size arm_media <<< "$arm"
+index_media='application/vnd.oci.image.index.v1+json'
+body="$(printf '{"schemaVersion":2,"mediaType":"%s","manifests":[{"mediaType":"%s","digest":"%s","size":%s,"platform":{"architecture":"amd64","os":"linux"}},{"mediaType":"%s","digest":"%s","size":%s,"platform":{"architecture":"arm64","os":"linux"}}]}' \
+ "$index_media" "$amd_media" "$amd_digest" "$amd_size" "$arm_media" "$arm_digest" "$arm_size")"
+
+put_tag() {
+ local tag="$1" code
+ code="$(curl --silent --show-error --netrc-file "$auth_file" -o /dev/null -w '%{http_code}' \
+ -H "Content-Type: $index_media" -X PUT --data-binary "$body" \
+ "$scheme://$registry/v2/$image/manifests/$tag")"
+ case "$code" in
+ 200|201) echo "published $image:$tag" ;;
+ *) echo "failed to publish $image:$tag (HTTP $code)" >&2; return 1 ;;
+ esac
+}
+
+put_tag "$version"
+if [[ "$version" != *-* ]]; then
+ put_tag latest
+fi
diff --git a/ci/package-cross-platform.ps1 b/ci/package-cross-platform.ps1
new file mode 100644
index 0000000..32c02be
--- /dev/null
+++ b/ci/package-cross-platform.ps1
@@ -0,0 +1,172 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+if (-not $env:CI_COMMIT_TAG -or $env:CI_COMMIT_TAG -notmatch '^v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$') {
+ throw 'Release must run from a vMAJOR.MINOR.PATCH tag.'
+}
+if (-not $env:GITEA_TOKEN) {
+ throw 'GITEA_TOKEN is required.'
+}
+$version = $Matches[1]
+$root = Split-Path -Parent $PSScriptRoot
+$backend = Join-Path $root 'backend'
+$projectVersion = [regex]::Match((Get-Content (Join-Path $backend 'Directory.Build.props') -Raw), '([^<]+)').Groups[1].Value
+if ($version -ne $projectVersion) {
+ throw "Tag version $version does not match project version $projectVersion."
+}
+
+$tarProject = Join-Path $PSScriptRoot 'Monitor.Tar\Monitor.Tar.csproj'
+$tarTool = Join-Path $PSScriptRoot 'Monitor.Tar\bin\Release\net10.0\Monitor.Tar.dll'
+& dotnet build $tarProject -c Release --nologo
+if ($LASTEXITCODE -ne 0) {
+ throw 'Could not build the cross-platform tar helper.'
+}
+$giteaBase = if ($env:GITEA_BASE) { $env:GITEA_BASE.TrimEnd('/') } else { 'http://localhost:3100' }
+$netrc = Join-Path $env:TEMP ("monitor-gitea-$([guid]::NewGuid().ToString('N')).netrc")
+$giteaHost = ([Uri]$giteaBase).Host
+Set-Content -LiteralPath $netrc -Value "machine $giteaHost login justme password $($env:GITEA_TOKEN)" -Encoding ascii -NoNewline
+
+function New-TarGzArchive([string]$SourceDirectory, [string]$ArchivePath, [string[]]$Executables) {
+ & dotnet $tarTool $SourceDirectory $ArchivePath @Executables
+ if ($LASTEXITCODE -ne 0) {
+ throw "Could not create tar archive $ArchivePath."
+ }
+}
+
+try {
+ $targets = @(
+ @{ Rid = 'linux-x64'; Os = 'linux'; Arch = 'amd64'; Windows = $false },
+ @{ Rid = 'linux-arm64'; Os = 'linux'; Arch = 'arm64'; Windows = $false },
+ @{ Rid = 'linux-musl-x64'; Os = 'linux'; Arch = 'musl-amd64'; Windows = $false },
+ @{ Rid = 'linux-musl-arm64'; Os = 'linux'; Arch = 'musl-arm64'; Windows = $false },
+ @{ Rid = 'osx-x64'; Os = 'macos'; Arch = 'x64'; Windows = $false },
+ @{ Rid = 'osx-arm64'; Os = 'macos'; Arch = 'arm64'; Windows = $false },
+ @{ Rid = 'win-x64'; Os = 'windows'; Arch = 'amd64'; Windows = $true },
+ @{ Rid = 'win-arm64'; Os = 'windows'; Arch = 'arm64'; Windows = $true }
+ )
+ $packageRoot = Join-Path $root '.release\packages'
+ $null = New-Item -ItemType Directory -Force -Path $packageRoot
+ $uploadFiles = [System.Collections.Generic.List[string]]::new()
+ foreach ($target in $targets) {
+ $agentDirectory = Join-Path $root ".release\publish\$($target.Rid)\agent"
+ $probeDirectory = Join-Path $root ".release\publish\$($target.Rid)\probe"
+ $enrollDirectory = Join-Path $root ".release\publish\$($target.Rid)\fleet-enroll"
+ foreach ($path in @($agentDirectory, $probeDirectory, $enrollDirectory)) {
+ if (-not (Test-Path -LiteralPath $path -PathType Container)) {
+ throw "Build output is missing: $path"
+ }
+ }
+
+ foreach ($role in @('agent', 'probe')) {
+ $stage = Join-Path $root ".release\stage\$($target.Rid)\$role"
+ $null = New-Item -ItemType Directory -Force -Path $stage
+ $extension = if ($target.Windows) { '.exe' } else { '' }
+ Copy-Item -LiteralPath (Join-Path (Join-Path $root ".release\publish\$($target.Rid)\$role") "monitor-$role$extension") -Destination $stage
+ Copy-Item -LiteralPath (Join-Path $root 'LICENSE') -Destination $stage
+ Copy-Item -LiteralPath (Join-Path $root "backend\$role\README.md") -Destination $stage
+
+ $executables = @("monitor-$role$extension")
+ if ($role -eq 'agent') {
+ $enrollName = if ($target.Windows) { 'fleet-enroll.exe' } else { 'fleet-enroll' }
+ Copy-Item -LiteralPath (Join-Path $enrollDirectory $enrollName) -Destination $stage
+ $executables += $enrollName
+ }
+ if ($target.Os -eq 'linux') {
+ Copy-Item -LiteralPath (Join-Path $root 'packaging/install.sh') -Destination $stage
+ $executables += 'install.sh'
+ $systemd = Join-Path $stage 'systemd'
+ $null = New-Item -ItemType Directory -Force -Path $systemd
+ Copy-Item -LiteralPath (Join-Path $root "packaging/systemd/monitor-$role.service") -Destination $systemd
+ if ($role -eq 'probe') {
+ $openwrt = Join-Path $stage 'openwrt'
+ $null = New-Item -ItemType Directory -Force -Path $openwrt
+ Copy-Item -LiteralPath (Join-Path $root 'packaging/openwrt/monitor-probe.init') -Destination $openwrt
+ Copy-Item -LiteralPath (Join-Path $root 'packaging/openwrt/monitor.keep') -Destination $openwrt
+ }
+ }
+ elseif ($target.Os -eq 'macos') {
+ @'
+This macOS NativeAOT binary is not signed with a Developer ID certificate and
+has not been notarized by Apple. Apple Silicon builds receive an ad-hoc code
+signature; Intel builds are unsigned. Gatekeeper may block browser-downloaded
+files. A Developer ID signature and notarization are required for a seamless
+consumer install.
+'@ | Set-Content -LiteralPath (Join-Path $stage 'MACOS-SECURITY.txt') -Encoding utf8
+ }
+
+ $archiveName = if ($target.Windows) { "monitor-$role-v$version-windows-$($target.Arch).zip" } else { "monitor-$role-v$version-$($target.Os)-$($target.Arch).tar.gz" }
+ $archive = Join-Path $packageRoot $archiveName
+ if ($target.Windows) {
+ Compress-Archive -Path (Join-Path $stage '*') -DestinationPath $archive -CompressionLevel Optimal -Force
+ }
+ else {
+ New-TarGzArchive $stage $archive $executables
+ }
+ $hash = (Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant()
+ $checksum = "$hash $archiveName`n"
+ $checksumPath = "$archive.sha256"
+ [IO.File]::WriteAllText($checksumPath, $checksum, [Text.UTF8Encoding]::new($false))
+ [void]$uploadFiles.Add($archive)
+ [void]$uploadFiles.Add($checksumPath)
+ }
+ }
+
+ $uploadScript = @'
+param([string]$File, [string]$Base, [string]$PackageVersion, [string]$Netrc)
+$ErrorActionPreference = 'Stop'
+$name = [IO.Path]::GetFileName($File)
+$url = "$Base/api/packages/justme/generic/monitor-node/$PackageVersion/$name"
+$status = & curl.exe --silent --show-error --retry 3 --netrc-file $Netrc --upload-file $File --output NUL --write-out '%{http_code}' $url
+if ($LASTEXITCODE -ne 0) {
+ throw "Gitea package upload failed for $name (curl exit $LASTEXITCODE)."
+}
+if ($status -match '^2') {
+ "uploaded Gitea package $name"
+}
+elseif ($status -eq '409') {
+ "Gitea package $name already exists; reusing the existing release file"
+}
+else {
+ throw "Gitea package upload failed for $name (HTTP $status)."
+}
+'@
+ $runspacePool = [RunspaceFactory]::CreateRunspacePool(1, 8)
+ $runspacePool.Open()
+ $pendingUploads = [System.Collections.Generic.List[object]]::new()
+ try {
+ foreach ($file in $uploadFiles) {
+ $powerShell = [PowerShell]::Create()
+ $powerShell.RunspacePool = $runspacePool
+ [void]$powerShell.AddScript($uploadScript).AddArgument($file).AddArgument($giteaBase).AddArgument($version).AddArgument($netrc)
+ $pendingUploads.Add([pscustomobject]@{ PowerShell = $powerShell; Handle = $powerShell.BeginInvoke() })
+ }
+
+ $uploadErrors = [System.Collections.Generic.List[string]]::new()
+ foreach ($pending in $pendingUploads) {
+ try {
+ foreach ($message in $pending.PowerShell.EndInvoke($pending.Handle)) {
+ Write-Output $message
+ }
+ foreach ($errorRecord in $pending.PowerShell.Streams.Error) {
+ $uploadErrors.Add($errorRecord.ToString())
+ }
+ }
+ catch {
+ $uploadErrors.Add($_.Exception.Message)
+ }
+ }
+ if ($uploadErrors.Count -gt 0) {
+ throw "One or more Gitea package uploads failed:`n$($uploadErrors -join "`n")"
+ }
+ }
+ finally {
+ foreach ($pending in $pendingUploads) {
+ $pending.PowerShell.Dispose()
+ }
+ $runspacePool.Close()
+ $runspacePool.Dispose()
+ }
+}
+finally {
+ Remove-Item -LiteralPath $netrc -Force -ErrorAction SilentlyContinue
+}
diff --git a/ci/publish-gitea-release.sh b/ci/publish-gitea-release.sh
new file mode 100644
index 0000000..4f0b182
--- /dev/null
+++ b/ci/publish-gitea-release.sh
@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Create/update the Gitea Release after all platform package workflows succeed.
+set -euo pipefail
+
+tag="${CI_COMMIT_TAG:-}"
+[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+ echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+ exit 2
+}
+[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
+
+version="${tag#v}"
+gitea_base="${GITEA_BASE:-http://192.168.2.162:3100}"
+gitea_base="${gitea_base%/}"
+gitea_host="${gitea_base#https://}"
+gitea_host="${gitea_host#http://}"
+gitea_host="${gitea_host%%/*}"
+gitea_host="${gitea_host%%:*}"
+api="$gitea_base/api/v1/repos/justme/MyMonitor"
+tmp="$(mktemp -d)"
+netrc="$tmp/netrc"
+release_json="$tmp/release.json"
+assets_json="$tmp/assets.json"
+chmod 700 "$tmp"
+printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
+chmod 600 "$netrc"
+trap 'rm -rf "$tmp"' EXIT
+
+release_body="Agent and Probe builds: Linux glibc and musl (x64, arm64), macOS (x64, arm64), and Windows (x64, arm64). macOS binaries are not Developer ID signed or notarized. Backend OCI images: registry.oeo.one/monitor/monitor-backend:$version (linux/amd64 and linux/arm64)."
+payload="$(printf '{"tag_name":"%s","target_commitish":"%s","name":"MyMonitor %s","body":"%s","draft":false,"prerelease":false}' \
+ "$tag" "${CI_COMMIT_SHA:-}" "$tag" "$release_body")"
+release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+ --output "$release_json" --write-out '%{http_code}' "$api/releases/tags/$tag")"
+release_created=false
+if [[ "$release_status" == 404 ]]; then
+ release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+ --header 'Content-Type: application/json' --data "$payload" \
+ --output "$release_json" --write-out '%{http_code}' "$api/releases")"
+ release_created=true
+fi
+[[ "$release_status" =~ ^2 ]] || {
+ echo "Gitea Release lookup/create failed (HTTP $release_status)" >&2
+ cat "$release_json" >&2
+ exit 1
+}
+release_id="$(grep -o '"id":[[:space:]]*[0-9][0-9]*' "$release_json" | head -1 | tr -cd '0-9')"
+[[ -n "$release_id" ]] || { echo "Could not read Gitea Release ID" >&2; exit 1; }
+if [[ "$release_created" == false ]]; then
+ update_response="$tmp/release-update.json"
+ update_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+ --request PATCH --header 'Content-Type: application/json' --data "$payload" \
+ --output "$update_response" --write-out '%{http_code}' "$api/releases/$release_id")"
+ [[ "$update_status" =~ ^2 ]] || {
+ echo "Gitea Release update failed (HTTP $update_status)" >&2
+ cat "$update_response" >&2
+ exit 1
+ }
+fi
+curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
+ "$api/releases/$release_id/assets" -o "$assets_json"
+
+assets=(
+ "monitor-agent-v$version-linux-amd64.tar.gz"
+ "monitor-agent-v$version-linux-arm64.tar.gz"
+ "monitor-probe-v$version-linux-amd64.tar.gz"
+ "monitor-probe-v$version-linux-arm64.tar.gz"
+ "monitor-agent-v$version-linux-musl-amd64.tar.gz"
+ "monitor-probe-v$version-linux-musl-amd64.tar.gz"
+ "monitor-agent-v$version-linux-musl-arm64.tar.gz"
+ "monitor-probe-v$version-linux-musl-arm64.tar.gz"
+ "monitor-agent-v$version-macos-x64.tar.gz"
+ "monitor-probe-v$version-macos-x64.tar.gz"
+ "monitor-agent-v$version-macos-arm64.tar.gz"
+ "monitor-probe-v$version-macos-arm64.tar.gz"
+ "monitor-agent-v$version-windows-amd64.zip"
+ "monitor-agent-v$version-windows-arm64.zip"
+ "monitor-probe-v$version-windows-amd64.zip"
+ "monitor-probe-v$version-windows-arm64.zip"
+)
+
+upload_release_asset() {
+ local name="$1" file="$tmp/$1" upload_response="$tmp/$1.upload.json" status
+ curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
+ "$gitea_base/api/packages/justme/generic/monitor-node/$version/$name" -o "$file"
+ status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+ --request POST --header 'Content-Type: application/octet-stream' --data-binary "@$file" \
+ --output "$upload_response" --write-out '%{http_code}' \
+ "$api/releases/$release_id/assets?name=$name")"
+ case "$status" in
+ 2*) echo "attached $name" ;;
+ *) echo "Gitea Release asset upload failed for $name (HTTP $status)" >&2; cat "$upload_response" >&2; return 1 ;;
+ esac
+}
+
+pids=()
+for archive in "${assets[@]}"; do
+ for name in "$archive" "$archive.sha256"; do
+ if grep -Eq "\"name\"[[:space:]]*:[[:space:]]*\"$name\"" "$assets_json"; then
+ echo "release asset $name already exists; keeping the existing asset"
+ continue
+ fi
+ upload_release_asset "$name" &
+ pids+=("$!")
+ if ((${#pids[@]} >= 8)); then
+ wait "${pids[0]}"
+ pids=("${pids[@]:1}")
+ fi
+ done
+done
+for pid in "${pids[@]}"; do
+ wait "$pid"
+done
+
+echo "published Gitea Release $tag: https://git.oeo.one/justme/MyMonitor/releases/tag/$tag"
diff --git a/ci/release-cross-platform.ps1 b/ci/release-cross-platform.ps1
new file mode 100644
index 0000000..f45f67c
--- /dev/null
+++ b/ci/release-cross-platform.ps1
@@ -0,0 +1,75 @@
+param(
+ [Parameter(Mandatory)]
+ [ValidateSet(
+ 'linux-x64', 'linux-arm64',
+ 'linux-musl-x64', 'linux-musl-arm64',
+ 'osx-x64', 'osx-arm64', 'win-x64', 'win-arm64'
+ )]
+ [string]$RuntimeIdentifier,
+ [Parameter(Mandatory)]
+ [ValidateSet('agent', 'probe', 'fleet-enroll')]
+ [string]$Component
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+if (-not $env:CI_COMMIT_TAG -or $env:CI_COMMIT_TAG -notmatch '^v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$') {
+ throw 'Release must run from a vMAJOR.MINOR.PATCH tag.'
+}
+$version = $Matches[1]
+$root = Split-Path -Parent $PSScriptRoot
+$backend = Join-Path $root 'backend'
+$projectVersion = [regex]::Match((Get-Content (Join-Path $backend 'Directory.Build.props') -Raw), '([^<]+)').Groups[1].Value
+if ($version -ne $projectVersion) {
+ throw "Tag version $version does not match project version $projectVersion."
+}
+
+if ($RuntimeIdentifier -in @('win-x64', 'win-arm64')) {
+ $vcArchitecture = if ($RuntimeIdentifier -eq 'win-x64') { 'x64' } else { 'arm64' }
+ $vsWhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+ $vsPath = & $vsWhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
+ if (-not $vsPath) {
+ throw 'Visual Studio C++ Build Tools were not found.'
+ }
+ $devCmd = Join-Path $vsPath 'Common7\Tools\VsDevCmd.bat'
+ $environmentLines = & cmd.exe /d /s /c "call `"$devCmd`" -no_logo -arch=$vcArchitecture -host_arch=x64 && set"
+ foreach ($line in $environmentLines) {
+ $separator = $line.IndexOf('=')
+ if ($separator -gt 0) {
+ [Environment]::SetEnvironmentVariable($line.Substring(0, $separator), $line.Substring($separator + 1), 'Process')
+ }
+ }
+}
+
+$project = switch ($Component) {
+ 'agent' { 'agent/src/Monitor.Agent' }
+ 'probe' { 'probe/src/Monitor.Probe' }
+ 'fleet-enroll' { 'fleet/tools/fleet-enroll' }
+}
+$output = Join-Path $root ".release\publish\$RuntimeIdentifier\$Component"
+$buildRoot = Join-Path $root ".release\build\$RuntimeIdentifier-$Component"
+$null = New-Item -ItemType Directory -Force -Path $output
+
+Push-Location $backend
+try {
+ & dotnet publish $project `
+ -m:1 `
+ -c Release `
+ -r $RuntimeIdentifier `
+ --self-contained true `
+ -p:PublishAot=true `
+ -p:StripSymbols=true `
+ -p:DebugType=none `
+ -p:DebugSymbols=false `
+ --artifacts-path $buildRoot `
+ -o $output
+ if ($LASTEXITCODE -ne 0) {
+ throw "NativeAOT publish failed for $project ($RuntimeIdentifier)."
+ }
+}
+finally {
+ Pop-Location
+}
+
+Write-Output "built $Component for $RuntimeIdentifier"
diff --git a/ci/release-linux.sh b/ci/release-linux.sh
new file mode 100644
index 0000000..9736ac1
--- /dev/null
+++ b/ci/release-linux.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Publish one framework-dependent Backend OCI image for the requested arch.
+set -euo pipefail
+
+arch="${1:?usage: release-linux.sh }"
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tag="${CI_COMMIT_TAG:-}"
+[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+ echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+ exit 2
+}
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_PASSWORD:-}" ]] || {
+ echo "Zot credentials are required" >&2; exit 2;
+}
+case "$arch" in
+ amd64|arm64) ;;
+ *) echo "unsupported architecture: $arch" >&2; exit 2 ;;
+esac
+
+version="${tag#v}"
+project_version="$(sed -n 's#.*\(.*\).*#\1#p' "$root/backend/Directory.Build.props" | head -1)"
+if [[ "$version" != "$project_version" ]]; then
+ echo "tag version $version does not match project version $project_version" >&2
+ exit 1
+fi
+
+registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
+image="$registry/monitor/monitor-backend"
+output="$root/.release/linux-$arch/backend"
+build_root="$root/.release/build/linux-$arch-backend"
+container_context="$root/.release/container/linux-$arch"
+mkdir -p "$output" "$build_root" "$container_context/app" "$container_context/data"
+
+(cd "$root/backend" && dotnet publish src/Monitor.Backend \
+ -m:3 -c Release --no-self-contained \
+ -p:DebugType=none -p:DebugSymbols=false \
+ -p:UseAppHost=false -p:OpenApiGenerateDocuments=false \
+ --artifacts-path "$build_root" -o "$output")
+find "$output" -type f -name '*.pdb' -delete
+cp -a "$output/." "$container_context/app/"
+: > "$container_context/data/.keep"
+
+export REGISTRY_AUTH_FILE="$root/.release/auth/zot-linux-$arch.json"
+mkdir -p "$(dirname "$REGISTRY_AUTH_FILE")"
+logged_in=false
+for attempt in 1 2 3 4; do
+ if buildah login --tls-verify=false --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_PASSWORD" >/dev/null; then
+ logged_in=true
+ break
+ fi
+ if [[ "$attempt" -lt 4 ]]; then
+ echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
+ sleep 3
+ fi
+done
+[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
+local_image="localhost/monitor-backend:$version-$arch"
+buildah bud --tls-verify=false --arch "$arch" \
+ --build-arg "APP_VERSION=$version" \
+ -f "$root/packaging/container/Backend.Containerfile" \
+ -t "$local_image" "$container_context" >/dev/null
+pushed=false
+for attempt in 1 2 3; do
+ if buildah push --tls-verify=false "$local_image" "docker://$image:$version-$arch" >/dev/null; then
+ pushed=true
+ break
+ fi
+ if [[ "$attempt" -lt 3 ]]; then
+ echo "Zot push attempt $attempt failed; retrying in 5 seconds" >&2
+ sleep 5
+ fi
+done
+[[ "$pushed" == true ]] || { echo "could not push image to Zot after 3 attempts" >&2; exit 1; }
+echo "pushed Zot image $image:$version-$arch"
diff --git a/compose.yaml b/compose.yaml
new file mode 100644
index 0000000..93b92cc
--- /dev/null
+++ b/compose.yaml
@@ -0,0 +1,26 @@
+services:
+ backend:
+ image: registry.oeo.one/monitor/monitor-backend:${MONITOR_VERSION:-0.1.0}
+ container_name: monitor-backend
+ restart: unless-stopped
+ init: true
+ ports:
+ - "127.0.0.1:8080:8080"
+ environment:
+ ASPNETCORE_HTTP_PORTS: "8080"
+ Monitor__DataDirectory: /data
+ Monitor__InitialAdminUser: ${MONITOR_ADMIN_USER:-admin}
+ Monitor__InitialAdminPassword: "${MONITOR_ADMIN_PASSWORD:?Set MONITOR_ADMIN_PASSWORD in the environment}"
+ volumes:
+ - monitor-data:/data
+ read_only: true
+ tmpfs:
+ - /tmp:rw,noexec,nosuid,size=64m,mode=1777
+ security_opt:
+ - no-new-privileges:true
+ cap_drop:
+ - ALL
+ stop_grace_period: 30s
+
+volumes:
+ monitor-data:
diff --git a/docs/deployment.md b/docs/deployment.md
index 69ec9d1..22860d1 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -11,12 +11,32 @@ scripts/package.sh → backend/art
| rid | 目标 | 构建方式 |
| --- | --- | --- |
-| `linux-musl-x64` | Alpine、OpenWrt x86 | Alpine 的 NativeAOT SDK 容器（任何有 Docker 的主机，包括 Windows） |
-| `linux-x64` | Debian、Ubuntu 等 glibc 发行版 | Ubuntu noble 的 NativeAOT SDK 容器 |
-| `win-x64` | Windows | 在 Windows 上直接 `dotnet publish -p:PublishAot=true`（需要 VS 的 C++ 工具链，`vswhere.exe` 所在目录要在 PATH 里） |
-| `linux-musl-arm64`、`linux-arm64` | 路由器、树莓派 | 需要在 arm64 主机（或 CI 的 arm64 runner）上运行同一个脚本；脚本在 x64 主机上会拒绝并说明 |
+| `linux-x64`、`linux-arm64` | Debian/Ubuntu glibc 服务器 | Windows CI 主机通过 AotAnywhere 交叉编译 |
+| `linux-musl-x64`、`linux-musl-arm64` | Alpine、amd64 OpenWrt、aarch64 OpenWrt 路由器 | Windows CI 主机通过 AotAnywhere 交叉编译 |
+| `osx-x64`、`osx-arm64` | Intel Mac、Apple Silicon | Windows CI 主机通过 AotAnywhere 交叉编译；发布包未做 Developer ID 签名或 Apple 公证 |
+| `win-x64`、`win-arm64` | Windows x64、ARM64 | Windows CI 主机上的 Visual Studio C++ 工具链 |
-NativeAOT 不能交叉编译到别的操作系统；MIPS 不支持（见 `project-layout.md`）。
+macOS 的 Apple Silicon 产物带临时 ad-hoc 签名，Intel 产物未签名。通过浏览器下载时，macOS Gatekeeper 可能阻止启动；面向普通用户分发前需要 Developer ID 签名和 Apple 公证。MIPS 不在当前目标列表中（见 `project-layout.md`）。
+
+仓库内的 `scripts/publish.sh` 面向本机目标平台；Woodpecker 的 tag 流水线在 Windows runner 上构建 Agent、Probe 和 `fleet-enroll` 的所有发布目标，Backend OCI 镜像仍在 Linux runner 上构建。
+
+## Backend 容器
+
+Backend 使用 OCI 标准镜像，通过 `registry.oeo.one/monitor/monitor-backend:` 分发，支持 `linux/amd64` 和 `linux/arm64`。容器基于 .NET 10 ASP.NET noble-chiseled-extra 运行时镜像，以非 root 用户运行，在 `8080/tcp` 提供 HTTP 服务；数据库和原始数据统一写入 `/data`。`extra` 变体带 IANA 时区数据，供按时区查询使用。将 `/data` 挂载为持久卷，并在反向代理处配置 HTTPS。
+
+在部署目录保存此仓库的 `compose.yaml`，先通过部署平台的环境变量或密钥管理设置 `MONITOR_ADMIN_PASSWORD`（可选设置 `MONITOR_ADMIN_USER`、`MONITOR_VERSION`），然后启动：
+
+```sh
+docker compose up -d
+```
+
+Compose 将容器端口只绑定到宿主机 `127.0.0.1:8080`，适合由同机 HTTPS 反向代理转发；数据保存在 Docker 命名卷 `monitor-data`。首次启动成功创建管理员后，改密应在管理端完成。
+
+健康检查端点为 `GET /healthz`。容器定义见 [`../packaging/container/Backend.Containerfile`](../packaging/container/Backend.Containerfile)。
+
+## 节点二进制发布
+
+Woodpecker 在 `vMAJOR.MINOR.PATCH` tag 上，由 Windows runner 使用 AotAnywhere 并行构建 Agent/Probe 的 Linux glibc、Linux musl、macOS 和 Windows 产物。Agent 包还包含一次性注册工具 `fleet-enroll`。Linux 归档带有安装脚本和 systemd/OpenWrt 单元；Windows 产物为 `.zip`，Linux/macOS 产物为 `.tar.gz`。所有平台产物和 Backend OCI 镜像成功后，CI 会创建对应的 Gitea Release，并附上压缩包和 SHA-256 校验文件。macOS 产物目前未签名/公证。安装说明见 [`../backend/agent/README.md`](../backend/agent/README.md) 与 [`../backend/probe/README.md`](../backend/probe/README.md)。
实测体积（`StackTraceSupport=false`、`IlcFoldIdenticalMethodBodies=true`、`OptimizationPreference=Size`）：
diff --git a/packaging/container/Backend.Containerfile b/packaging/container/Backend.Containerfile
new file mode 100644
index 0000000..2bde19a
--- /dev/null
+++ b/packaging/container/Backend.Containerfile
@@ -0,0 +1,20 @@
+FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled-extra
+
+ARG APP_VERSION=unknown
+LABEL org.opencontainers.image.title="Monitor Backend" \
+ org.opencontainers.image.description="Self-hosted network path quality monitoring backend" \
+ org.opencontainers.image.licenses="Apache-2.0" \
+ org.opencontainers.image.version="$APP_VERSION"
+
+WORKDIR /app
+COPY --chown=1654:1654 app/ /app/
+COPY --chown=1654:1654 data/.keep /data/.keep
+
+ENV ASPNETCORE_HTTP_PORTS=8080 \
+ Monitor__DataDirectory=/data \
+ DOTNET_EnableDiagnostics=0
+
+USER 1654:1654
+VOLUME ["/data"]
+EXPOSE 8080
+ENTRYPOINT ["dotnet", "/app/monitor-backend.dll"]
diff --git a/scripts/publish.sh b/scripts/publish.sh
index ab745e4..fe1fc70 100644
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -17,7 +17,7 @@ case "$project" in
esac
out="backend/artifacts/publish/$project/$rid"
-args=(publish "$csproj" -c Release -r "$rid" -p:PublishAot=true -p:DebugType=none -o "/src/$out" --artifacts-path /artifacts -nologo -v q)
+args=(publish "$csproj" -c Release -r "$rid" -p:PublishAot=true -p:DebugType=none -p:DebugSymbols=false -o "/src/$out" --artifacts-path /artifacts -nologo -v q)
case "$rid" in
linux-musl-x64)
@@ -34,7 +34,7 @@ case "$rid" in
;;
*)
cd "$root/backend" # global.json 在 backend/ 下
- dotnet publish "${csproj#backend/}" -c Release -r "$rid" -p:PublishAot=true -o "$root/$out" -nologo -v q
+ dotnet publish "${csproj#backend/}" -c Release -r "$rid" -p:PublishAot=true -p:DebugType=none -p:DebugSymbols=false -o "$root/$out" -nologo -v q
;;
esac