justme
a2f88a344b
Join codes need no passkey touch and carry only public values (genesis fingerprint, owner credentials, installer hashes). Nodes pin the genesis and owners at enrollment and only follow passkey-signed operator set versions. The panel's server key is listed in the set; pinned nodes require its signature and run the control link under AES-256-GCM. Password sessions carry no capabilities. The updater adopts a next_key from a signed manifest. Bump version to 0.2.0. [CI SKIP]
47 lines
2.0 KiB
C#
47 lines
2.0 KiB
C#
using System.Text.Json.Nodes;
|
|
using Fleet.Core;
|
|
using Fleet.Enrollment.Client;
|
|
|
|
// fleet-enroll --server https://panel --join jt_xxx --name jp-1 --identity-dir /etc/moshiro [--meta '{"probe_tcp_port":7443,...}'] [--version 1.0]
|
|
// 一次性运行：生成身份、注册、写入身份目录，然后退出。
|
|
string? Arg(string name) => args.SkipWhile(a => a != name).Skip(1).FirstOrDefault();
|
|
|
|
string? server = Arg("--server");
|
|
string? join = Arg("--join");
|
|
string? name = Arg("--name");
|
|
string? directory = Arg("--identity-dir");
|
|
if (server is null || join is null || name is null || directory is null)
|
|
{
|
|
Console.Error.WriteLine("usage: fleet-enroll --server <url> --join <token> --name <node name> --identity-dir <dir> [--meta <json>] [--version <v>] [--genesis <trust root fingerprint> --controllers <passkey credential ids, comma separated>]");
|
|
return 2;
|
|
}
|
|
|
|
JsonNode? meta = null;
|
|
if (Arg("--meta") is { } metaText)
|
|
{
|
|
try
|
|
{
|
|
meta = JsonNode.Parse(metaText);
|
|
}
|
|
catch (System.Text.Json.JsonException ex)
|
|
{
|
|
Console.Error.WriteLine("--meta is not valid JSON: " + ex.Message);
|
|
return 2;
|
|
}
|
|
}
|
|
|
|
string? genesis = Arg("--genesis");
|
|
string[] controllers = (Arg("--controllers") ?? "").Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
|
|
|
|
using var http = new HttpClient { Timeout = TimeSpan.FromSeconds(30) };
|
|
Result<EnrollmentResult> result = await EnrollmentClient.EnrollAsync(
|
|
http, new Uri(server), join, name, directory, Arg("--version") ?? "0.0.0", meta, TimeProvider.System, CancellationToken.None, genesis, controllers);
|
|
if (!result.TryGet(out EnrollmentResult? enrolled, out FleetError? error))
|
|
{
|
|
Console.Error.WriteLine($"enrollment failed ({error.Code}): {error.Message}");
|
|
return 1;
|
|
}
|
|
|
|
Console.WriteLine($"enrolled as {enrolled.NodeId} ({enrolled.Status}); identity written to {enrolled.IdentityDirectory}" + (enrolled.Pinned ? "; operator trust pinned" : "; operator trust NOT pinned (no --genesis)"));
|
|
return 0;
|