justme
a2f88a344b
Join codes need no passkey touch and carry only public values (genesis fingerprint, owner credentials, installer hashes). Nodes pin the genesis and owners at enrollment and only follow passkey-signed operator set versions. The panel's server key is listed in the set; pinned nodes require its signature and run the control link under AES-256-GCM. Password sessions carry no capabilities. The updater adopts a next_key from a signed manifest. Bump version to 0.2.0. [CI SKIP]
38 lines
1.6 KiB
Bash
38 lines
1.6 KiB
Bash
#!/bin/sh
|
|
# 容器入口（Agent 和 Probe 共用）：第一次启动用 MOSHIRO_SERVER / MOSHIRO_JOIN / MOSHIRO_NAME 自己注册并写配置，
|
|
# 身份和配置都在命名卷 /etc/moshiro 里，之后重启（或换新镜像重建容器）直接启动，不需要再给参数。
|
|
set -eu
|
|
|
|
role="${MOSHIRO_ROLE:?MOSHIRO_ROLE is set by the image}"
|
|
dir=/etc/moshiro
|
|
identity="$dir/$role-id"
|
|
config="$dir/$role.json"
|
|
|
|
if [ ! -f "$identity/node.json" ]; then
|
|
if [ -z "${MOSHIRO_SERVER:-}" ] || [ -z "${MOSHIRO_JOIN:-}" ] || [ -z "${MOSHIRO_NAME:-}" ]; then
|
|
echo "first start: set MOSHIRO_SERVER, MOSHIRO_JOIN and MOSHIRO_NAME (the panel shows the complete command)" >&2
|
|
exit 1
|
|
fi
|
|
if [ -n "${MOSHIRO_GENESIS:-}" ]; then
|
|
# 命令里带着信任根指纹和属主（公开值）：先验证面板的操作员集合，并把它们固定在本地
|
|
/usr/local/bin/fleet-enroll --server "$MOSHIRO_SERVER" --join "$MOSHIRO_JOIN" --name "$MOSHIRO_NAME" --identity-dir "$identity" \
|
|
--genesis "$MOSHIRO_GENESIS" --controllers "${MOSHIRO_CONTROLLERS:-}"
|
|
else
|
|
/usr/local/bin/fleet-enroll --server "$MOSHIRO_SERVER" --join "$MOSHIRO_JOIN" --name "$MOSHIRO_NAME" --identity-dir "$identity"
|
|
fi
|
|
fi
|
|
|
|
if [ ! -f "$config" ]; then
|
|
if [ -z "${MOSHIRO_SERVER:-}" ]; then
|
|
echo "$config is missing: set MOSHIRO_SERVER to create it" >&2
|
|
exit 1
|
|
fi
|
|
if [ "$role" = agent ]; then
|
|
printf '{"fleet":{"server":"%s","identity_dir":"%s"},"listen":{"bind":"::"}}\n' "$MOSHIRO_SERVER" "$identity" > "$config"
|
|
else
|
|
printf '{"fleet":{"server":"%s","identity_dir":"%s"}}\n' "$MOSHIRO_SERVER" "$identity" > "$config"
|
|
fi
|
|
fi
|
|
|
|
exec "/usr/local/bin/moshiro-$role" "$@"
|