qwer-xyz
376 lines
9.7 KiB
Bash
376 lines
9.7 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SERVICE_NAME="incudal-agent"
|
|
CONFIG_DIR="${INCUDAL_CONFIG_DIR:-/etc/incudal-agent}"
|
|
CONFIG_FILE="${INCUDAL_CONFIG_FILE:-${CONFIG_DIR}/config.yaml}"
|
|
INSTALL_DIR="${INCUDAL_INSTALL_DIR:-/usr/local/bin}"
|
|
BIN_PATH="${INCUDAL_AGENT_BIN:-${INSTALL_DIR}/incudal-agent}"
|
|
SERVICE_FILE="${INCUDAL_SERVICE_FILE:-/etc/systemd/system/${SERVICE_NAME}.service}"
|
|
HEARTBEAT_INTERVAL="${INCUDAL_HEARTBEAT_INTERVAL_SECONDS:-30}"
|
|
REQUEST_TIMEOUT="${INCUDAL_REQUEST_TIMEOUT_SECONDS:-10}"
|
|
DRY_RUN="${INCUDAL_AGENT_DRY_RUN:-0}"
|
|
INSTALL_CONFIG_PATH=""
|
|
|
|
fail() {
|
|
echo "error: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
need_env() {
|
|
local name="$1"
|
|
if [ -z "${!name:-}" ]; then
|
|
fail "${name} is required"
|
|
fi
|
|
}
|
|
|
|
detect_os() {
|
|
case "$(uname -s)" in
|
|
Linux) echo "linux" ;;
|
|
*) fail "unsupported OS: $(uname -s)" ;;
|
|
esac
|
|
}
|
|
|
|
detect_arch() {
|
|
case "$(uname -m)" in
|
|
x86_64|amd64) echo "amd64" ;;
|
|
aarch64|arm64) echo "arm64" ;;
|
|
*) fail "unsupported architecture: $(uname -m)" ;;
|
|
esac
|
|
}
|
|
|
|
run() {
|
|
if [ "${DRY_RUN}" = "1" ]; then
|
|
printf '+'
|
|
printf ' %q' "$@"
|
|
printf '\n'
|
|
return 0
|
|
fi
|
|
"$@"
|
|
}
|
|
|
|
write_file() {
|
|
local path="$1"
|
|
local mode="$2"
|
|
local owner="$3"
|
|
local tmp
|
|
|
|
if [ "${DRY_RUN}" = "1" ]; then
|
|
echo "+ write ${path} mode=${mode} owner=${owner}"
|
|
sed 's/^/| /'
|
|
return 0
|
|
fi
|
|
|
|
tmp="$(mktemp)"
|
|
cat > "${tmp}"
|
|
install -d -m 0755 "$(dirname "${path}")"
|
|
install -m "${mode}" -o "${owner%%:*}" -g "${owner##*:}" "${tmp}" "${path}"
|
|
rm -f "${tmp}"
|
|
}
|
|
|
|
download_binary_once() {
|
|
local binary_url="$1"
|
|
local target="$2"
|
|
local expected_sha256="${3:-}"
|
|
local binary_path="${binary_url%%\?*}"
|
|
binary_path="${binary_path%%#*}"
|
|
|
|
if [ "${DRY_RUN}" = "1" ]; then
|
|
echo "+ download ${binary_url} -> ${target}"
|
|
if [ -n "${expected_sha256}" ]; then
|
|
echo "+ verify sha256 ${expected_sha256} ${target}.download"
|
|
fi
|
|
return 0
|
|
fi
|
|
|
|
install -d -m 0755 "$(dirname "${target}")"
|
|
if [[ "${binary_url}" == file://* ]]; then
|
|
install -m 0644 "${binary_url#file://}" "${target}.download" || return 1
|
|
else
|
|
command -v curl >/dev/null 2>&1 || fail "curl is required"
|
|
curl -fsSL "${binary_url}" -o "${target}.download" || {
|
|
rm -f "${target}.download"
|
|
return 1
|
|
}
|
|
fi
|
|
|
|
if [ -n "${expected_sha256}" ]; then
|
|
verify_sha256 "${target}.download" "${expected_sha256}" || {
|
|
rm -f "${target}.download"
|
|
return 1
|
|
}
|
|
fi
|
|
|
|
if [[ "${binary_path}" == *.gz ]]; then
|
|
command -v gzip >/dev/null 2>&1 || {
|
|
rm -f "${target}.download"
|
|
return 1
|
|
}
|
|
gzip -dc "${target}.download" > "${target}.tmp" || {
|
|
rm -f "${target}.download" "${target}.tmp"
|
|
return 1
|
|
}
|
|
rm -f "${target}.download"
|
|
else
|
|
mv "${target}.download" "${target}.tmp"
|
|
fi
|
|
install -m 0755 "${target}.tmp" "${target}"
|
|
rm -f "${target}.tmp"
|
|
}
|
|
|
|
download_binary() {
|
|
local binary_url="$1"
|
|
local target="$2"
|
|
local fallback_url="${3:-}"
|
|
local expected_sha256="${4:-}"
|
|
|
|
if download_binary_once "${binary_url}" "${target}" "${expected_sha256}"; then
|
|
return 0
|
|
fi
|
|
|
|
if [ -n "${fallback_url}" ]; then
|
|
echo "warning: failed to download ${binary_url}, fallback to ${fallback_url}" >&2
|
|
download_binary_once "${fallback_url}" "${target}"
|
|
return $?
|
|
fi
|
|
|
|
return 1
|
|
}
|
|
|
|
append_query_param() {
|
|
local url="$1"
|
|
local key="$2"
|
|
local value="$3"
|
|
|
|
if [[ "${url}" == *\?* ]]; then
|
|
echo "${url}&${key}=${value}"
|
|
else
|
|
echo "${url}?${key}=${value}"
|
|
fi
|
|
}
|
|
|
|
sha256_file() {
|
|
local path="$1"
|
|
|
|
if command -v sha256sum >/dev/null 2>&1; then
|
|
sha256sum "${path}" | awk '{print $1}'
|
|
return 0
|
|
fi
|
|
|
|
if command -v shasum >/dev/null 2>&1; then
|
|
shasum -a 256 "${path}" | awk '{print $1}'
|
|
return 0
|
|
fi
|
|
|
|
fail "sha256sum or shasum is required"
|
|
}
|
|
|
|
verify_sha256() {
|
|
local path="$1"
|
|
local expected="$2"
|
|
local actual
|
|
|
|
actual="$(sha256_file "${path}")"
|
|
if [ "${actual}" != "${expected}" ]; then
|
|
echo "warning: sha256 mismatch for ${path}: expected=${expected} actual=${actual}" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
download_manifest() {
|
|
local manifest_url="$1"
|
|
local target="$2"
|
|
|
|
if [ "${DRY_RUN}" = "1" ]; then
|
|
echo "+ download ${manifest_url} -> ${target}"
|
|
return 0
|
|
fi
|
|
|
|
command -v curl >/dev/null 2>&1 || fail "curl is required"
|
|
curl -fsSL "${manifest_url}" -o "${target}"
|
|
}
|
|
|
|
manifest_value() {
|
|
local manifest_path="$1"
|
|
local platform="$2"
|
|
local key="$3"
|
|
|
|
awk -v platform="\"${platform}\"" -v key="\"${key}\"" '
|
|
$0 ~ platform { in_platform=1; next }
|
|
in_platform && $0 ~ /^[[:space:]]*}/ { exit }
|
|
in_platform && $0 ~ key {
|
|
line=$0
|
|
sub(/^[^:]*:[[:space:]]*/, "", line)
|
|
sub(/[,\r]*$/, "", line)
|
|
gsub(/^"|"$/, "", line)
|
|
print line
|
|
exit
|
|
}
|
|
' "${manifest_path}"
|
|
}
|
|
|
|
validate_binary_name() {
|
|
local name="$1"
|
|
local os="$2"
|
|
local arch="$3"
|
|
|
|
case "${name}" in
|
|
"incudal-agent-${os}-${arch}"|"incudal-agent-${os}-${arch}.gz")
|
|
return 0
|
|
;;
|
|
*)
|
|
fail "manifest binary name is invalid for ${os}-${arch}: ${name}"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
install_binary_atomically() {
|
|
local source="$1"
|
|
local target="$2"
|
|
local next="${target}.new"
|
|
|
|
if [ "${DRY_RUN}" = "1" ]; then
|
|
echo "+ install ${source} -> ${target} (atomic replace)"
|
|
return 0
|
|
fi
|
|
|
|
install -d -m 0755 "$(dirname "${target}")"
|
|
install -m 0755 "${source}" "${next}"
|
|
mv -f "${next}" "${target}"
|
|
}
|
|
|
|
fetch_agent_install_config() {
|
|
local install_token="${INCUDAL_AGENT_INSTALL_TOKEN:-}"
|
|
if [ -z "${install_token}" ]; then
|
|
return 0
|
|
fi
|
|
|
|
local config_url="${PANEL_BASE_URL}/api/agent/install-config/${install_token}"
|
|
if [ "${DRY_RUN}" = "1" ]; then
|
|
echo "+ fetch ${config_url}"
|
|
INCUDAL_AGENT_ID="${INCUDAL_AGENT_ID:-agt_from_install_token}"
|
|
INCUDAL_AGENT_SECRET="${INCUDAL_AGENT_SECRET:-ias_from_install_token}"
|
|
return 0
|
|
fi
|
|
|
|
command -v curl >/dev/null 2>&1 || fail "curl is required"
|
|
INSTALL_CONFIG_PATH="$(mktemp)"
|
|
curl -fsSL "${config_url}" -o "${INSTALL_CONFIG_PATH}"
|
|
# shellcheck disable=SC1090
|
|
. "${INSTALL_CONFIG_PATH}"
|
|
rm -f "${INSTALL_CONFIG_PATH}"
|
|
INSTALL_CONFIG_PATH=""
|
|
}
|
|
|
|
need_env INCUDAL_PANEL_URL
|
|
|
|
PANEL_BASE_URL="${INCUDAL_PANEL_URL%/}"
|
|
OS="$(detect_os)"
|
|
ARCH="$(detect_arch)"
|
|
DEFAULT_BINARY_BASE_URL="${PANEL_BASE_URL}/api/agent/binary"
|
|
BINARY_BASE_URL="${INCUDAL_AGENT_BINARY_BASE_URL:-${DEFAULT_BINARY_BASE_URL}}"
|
|
BINARY_NAME="incudal-agent-${OS}-${ARCH}"
|
|
BINARY_URL="${INCUDAL_AGENT_BINARY_URL:-}"
|
|
BINARY_EXPECTED_SHA256="${INCUDAL_AGENT_BINARY_SHA256:-}"
|
|
BINARY_FALLBACK_URL=""
|
|
MANIFEST_PATH=""
|
|
MANIFEST_URL="${INCUDAL_AGENT_MANIFEST_URL:-${PANEL_BASE_URL}/api/agent/manifest.json}"
|
|
STAGED_BIN="${BIN_PATH}.download.$$"
|
|
|
|
cleanup() {
|
|
rm -f "${STAGED_BIN}" "${STAGED_BIN}.download" "${STAGED_BIN}.tmp" "${BIN_PATH}.new"
|
|
if [ -n "${INSTALL_CONFIG_PATH:-}" ]; then
|
|
rm -f "${INSTALL_CONFIG_PATH}"
|
|
fi
|
|
if [ -n "${MANIFEST_PATH:-}" ]; then
|
|
rm -f "${MANIFEST_PATH}"
|
|
fi
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
fetch_agent_install_config
|
|
need_env INCUDAL_AGENT_ID
|
|
need_env INCUDAL_AGENT_SECRET
|
|
|
|
if [ -z "${INCUDAL_AGENT_BINARY_URL:-}" ]; then
|
|
# Cloudflare 等边缘缓存可能缓存旧二进制；默认面板下载强制按安装批次换 URL。
|
|
BINARY_CACHE_BUSTER="${INCUDAL_AGENT_BINARY_CACHE_BUSTER:-$(date +%s)}"
|
|
MANIFEST_URL="$(append_query_param "${MANIFEST_URL}" "v" "${BINARY_CACHE_BUSTER}")"
|
|
MANIFEST_PATH="${BIN_PATH}.manifest.$$"
|
|
download_manifest "${MANIFEST_URL}" "${MANIFEST_PATH}"
|
|
|
|
if [ "${DRY_RUN}" != "1" ]; then
|
|
BINARY_NAME="$(manifest_value "${MANIFEST_PATH}" "${OS}-${ARCH}" "name")"
|
|
BINARY_EXPECTED_SHA256="$(manifest_value "${MANIFEST_PATH}" "${OS}-${ARCH}" "sha256")"
|
|
if [ -z "${BINARY_NAME}" ] || [ -z "${BINARY_EXPECTED_SHA256}" ]; then
|
|
fail "agent manifest does not contain ${OS}-${ARCH} binary metadata"
|
|
fi
|
|
validate_binary_name "${BINARY_NAME}" "${OS}" "${ARCH}"
|
|
else
|
|
BINARY_NAME="${BINARY_NAME}.gz"
|
|
fi
|
|
|
|
BINARY_URL="${BINARY_BASE_URL}/${BINARY_NAME}"
|
|
BINARY_URL="$(append_query_param "${BINARY_URL}" "v" "${BINARY_CACHE_BUSTER}")"
|
|
elif [ -z "${BINARY_EXPECTED_SHA256}" ]; then
|
|
echo "warning: INCUDAL_AGENT_BINARY_URL is set without INCUDAL_AGENT_BINARY_SHA256, skip binary checksum verification" >&2
|
|
fi
|
|
|
|
echo "Installing Incudal Agent"
|
|
echo " panel: ${INCUDAL_PANEL_URL}"
|
|
echo " agent: ${INCUDAL_AGENT_ID}"
|
|
echo " binary: ${BINARY_URL}"
|
|
if [ -n "${BINARY_EXPECTED_SHA256}" ]; then
|
|
echo " sha256: ${BINARY_EXPECTED_SHA256}"
|
|
fi
|
|
|
|
if [ "${DRY_RUN}" != "1" ]; then
|
|
install -d -m 0755 "$(dirname "${STAGED_BIN}")"
|
|
fi
|
|
|
|
# 先下载到临时路径，再原子替换，避免覆盖正在运行的二进制时报 Text file busy。
|
|
download_binary "${BINARY_URL}" "${STAGED_BIN}" "${BINARY_FALLBACK_URL}" "${BINARY_EXPECTED_SHA256}"
|
|
install_binary_atomically "${STAGED_BIN}" "${BIN_PATH}"
|
|
|
|
write_file "${CONFIG_FILE}" 0600 root:root <<EOF_CONFIG
|
|
panel_url: "${INCUDAL_PANEL_URL}"
|
|
agent_id: "${INCUDAL_AGENT_ID}"
|
|
agent_secret: "${INCUDAL_AGENT_SECRET}"
|
|
heartbeat_interval_seconds: ${HEARTBEAT_INTERVAL}
|
|
request_timeout_seconds: ${REQUEST_TIMEOUT}
|
|
EOF_CONFIG
|
|
|
|
write_file "${SERVICE_FILE}" 0644 root:root <<EOF_SERVICE
|
|
[Unit]
|
|
Description=Incudal Host Agent
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=${BIN_PATH} -config ${CONFIG_FILE}
|
|
Restart=always
|
|
RestartSec=5
|
|
User=root
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectHome=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF_SERVICE
|
|
|
|
if [ "${DRY_RUN}" = "1" ]; then
|
|
echo "Dry run completed."
|
|
exit 0
|
|
fi
|
|
|
|
systemctl daemon-reload
|
|
"${BIN_PATH}" -config "${CONFIG_FILE}" -once
|
|
systemctl enable "${SERVICE_NAME}"
|
|
# 已安装场景下 enable --now 不会重启旧进程；restart 确保升级后立即使用最新二进制和配置。
|
|
systemctl restart "${SERVICE_NAME}"
|
|
systemctl status "${SERVICE_NAME}" --no-pager --lines=20
|
|
|
|
echo "Incudal Agent installed or upgraded and started."
|