justme
12be44645f
ci/woodpecker/push/main-amd64-build Pipeline was successful
Agent, Probe and Backend now start from one static compose.yaml plus a local
.env: the panel (or the release assets, for the very first Backend) provides
the file, the panel's command writes the public values into .env, checks the
file's SHA-256 and runs compose up. Updating is compose pull && compose up -d.
The image is chosen by the CI channel (:latest, or MOSHIRO_VERSION in .env),
not by the panel; the previous one-line script stays as a fallback.
- packaging/compose/{agent,probe,backend}/compose.yaml are the single source,
embedded in the Backend and served at /install/compose/{file}; the root
compose.yaml moved there. Releases also carry them and list them in the
signed SHA256SUMS.
- The container entrypoint defaults the node name to the host name.
- Join token creation returns a compose block (.env, url, hash, per-platform
commands); the admin dialog leads with it.
- Remove code with no references (HotLayer members, LiveHub.SubscriberCount,
QueryService.ParseParams, ReleaseService.Forget, a few constants) and reduce
the install-code lookup to the role it is for.
54 lines
2.1 KiB
YAML
54 lines
2.1 KiB
YAML
# MoShiro Agent（Linux，需要宿主网络）。Docker 和 rootless/rootful Podman 共用。
|
||
#
|
||
# 用法（面板「添加 Agent」会给出带好参数的 .env 内容）：
|
||
# mkdir moshiro-agent && cd moshiro-agent
|
||
# 把面板给的 .env 内容存成 .env，再下载本文件为 compose.yaml
|
||
# podman compose up -d # Docker 用 docker compose
|
||
# 更新：podman compose pull && podman compose up -d （身份和配置在命名卷里，不会动）
|
||
# 固定版本：在 .env 里写 MOSHIRO_VERSION=0.3.3；想要更严，写成 MOSHIRO_VERSION=0.3.3@sha256:<digest>。
|
||
# 说明见 docs/ops/deployment.md。
|
||
services:
|
||
agent:
|
||
image: ${MOSHIRO_IMAGE:-registry.oeo.one/moshiro/moshiro-agent}:${MOSHIRO_VERSION:-latest}
|
||
container_name: moshiro-agent
|
||
restart: unless-stopped
|
||
init: true
|
||
# Probe 要直连 Agent 的 7443（TCP+UDP）和 7444（TCP），用宿主网络，不做端口映射
|
||
network_mode: host
|
||
volumes:
|
||
- agent-config:/etc/moshiro
|
||
- agent-status:/etc/moshiro/update-status:ro
|
||
- /etc/os-release:/etc/os-release:ro
|
||
# 系统目录只读，不加 :z/:Z；SELinux 隔离在容器级别禁用。
|
||
- /proc:/host/proc:ro
|
||
- /sys:/host/sys:ro
|
||
- /:/host/root:ro
|
||
environment:
|
||
# 只在第一次启动时用来注册（身份写进 agent-config 卷之后，.env 里的 MOSHIRO_JOIN 就可以删掉）
|
||
MOSHIRO_SERVER: ${MOSHIRO_SERVER:-}
|
||
MOSHIRO_JOIN: ${MOSHIRO_JOIN:-}
|
||
MOSHIRO_NAME: ${MOSHIRO_NAME:-}
|
||
MOSHIRO_GENESIS: ${MOSHIRO_GENESIS:-}
|
||
MOSHIRO_CONTROLLERS: ${MOSHIRO_CONTROLLERS:-}
|
||
MOSHIRO_ALLOW_NO_OWNER: ${MOSHIRO_ALLOW_NO_OWNER:-}
|
||
MOSHIRO_NETWORK_SCOPE: host
|
||
HOST_PROC: /host/proc
|
||
HOST_SYS: /host/sys
|
||
HOST_ROOT: /host/root
|
||
read_only: true
|
||
tmpfs:
|
||
- /tmp:rw,noexec,nosuid,size=64m,mode=1777
|
||
security_opt:
|
||
- label=disable
|
||
- no-new-privileges:true
|
||
cap_drop:
|
||
- ALL
|
||
# Linux ICMP 使用 ping sockets；ping_group_range 需允许容器映射后的 GID。
|
||
stop_grace_period: 20s
|
||
|
||
volumes:
|
||
agent-config:
|
||
name: moshiro-agent-config
|
||
agent-status:
|
||
name: moshiro-agent-status
|