45 lines
2.0 KiB
Bash
45 lines
2.0 KiB
Bash
#!/bin/sh
|
|
# 容器入口（Agent 和 Probe 共用）：第一次启动用 MOSHIRO_SERVER / MOSHIRO_JOIN / MOSHIRO_NAME 自己注册并写配置，
|
|
# 身份和配置都在命名卷 /etc/moshiro 里，之后重启（或换新镜像重建容器）直接启动，不需要再给参数。
|
|
set -eu
|
|
|
|
role="${MOSHIRO_ROLE:?MOSHIRO_ROLE is set by the image}"
|
|
dir=/etc/moshiro
|
|
identity="$dir/$role-id"
|
|
config="$dir/$role.json"
|
|
|
|
if [ ! -f "$identity/node.json" ]; then
|
|
if [ -z "${MOSHIRO_SERVER:-}" ] || [ -z "${MOSHIRO_JOIN:-}" ] || [ -z "${MOSHIRO_NAME:-}" ]; then
|
|
echo "first start: set MOSHIRO_SERVER, MOSHIRO_JOIN and MOSHIRO_NAME (the panel shows the complete command)" >&2
|
|
exit 1
|
|
fi
|
|
# 每个节点都必须有属主（passkey）：信任根指纹和属主缺一个就不注册
|
|
if [ -z "${MOSHIRO_GENESIS:-}" ] || [ -z "${MOSHIRO_CONTROLLERS:-}" ]; then
|
|
if [ "${MOSHIRO_ALLOW_NO_OWNER:-}" != 1 ]; then
|
|
echo "this node has no owner: set MOSHIRO_GENESIS and MOSHIRO_CONTROLLERS (the panel's command has them; set up the trust root first)" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
if [ -n "${MOSHIRO_GENESIS:-}" ]; then
|
|
# 命令里带着信任根指纹和属主（公开值）：先验证面板的操作员集合，并把它们固定在本地
|
|
/usr/local/bin/fleet-enroll --server "$MOSHIRO_SERVER" --join "$MOSHIRO_JOIN" --name "$MOSHIRO_NAME" --identity-dir "$identity" \
|
|
--genesis "$MOSHIRO_GENESIS" --controllers "${MOSHIRO_CONTROLLERS:-}"
|
|
else
|
|
/usr/local/bin/fleet-enroll --server "$MOSHIRO_SERVER" --join "$MOSHIRO_JOIN" --name "$MOSHIRO_NAME" --identity-dir "$identity"
|
|
fi
|
|
fi
|
|
|
|
if [ ! -f "$config" ]; then
|
|
if [ -z "${MOSHIRO_SERVER:-}" ]; then
|
|
echo "$config is missing: set MOSHIRO_SERVER to create it" >&2
|
|
exit 1
|
|
fi
|
|
if [ "$role" = agent ]; then
|
|
printf '{"fleet":{"server":"%s","identity_dir":"%s"},"listen":{"bind":"::"}}\n' "$MOSHIRO_SERVER" "$identity" > "$config"
|
|
else
|
|
printf '{"fleet":{"server":"%s","identity_dir":"%s"}}\n' "$MOSHIRO_SERVER" "$identity" > "$config"
|
|
fi
|
|
fi
|
|
|
|
exec "/usr/local/bin/moshiro-$role" "$@"
|