Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 kory
|
5c64796892 | ||
|
kory
|
88bd8a9265 | ||
|
kory
|
ea7b47c955 | ||
|
kory
|
f084ac5bae | ||
|
kory
|
ea7aebd276 | ||
|
kory
|
539c1e986b | ||
|
kory
|
0b5b0323f2 |
@@ -182,7 +182,7 @@ Agent 只主动连接 Hub，不需要公网入站端口。
|
||||
### 一键安装
|
||||
|
||||
```bash
|
||||
curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/install.sh | sudo bash
|
||||
curl -fsSL https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/install.sh | sudo bash
|
||||
```
|
||||
|
||||
安装脚本自动识别 `amd64/arm64` 并进入 Hub / Agent 安装流程。
|
||||
@@ -190,7 +190,7 @@ curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/i
|
||||
### 一键升级 Agent
|
||||
|
||||
```bash
|
||||
curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/upgrade-agent.sh | sudo bash
|
||||
curl -fsSL https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/upgrade-agent.sh | sudo bash
|
||||
```
|
||||
|
||||
升级脚本下载目标 Release、校验文件大小、备份旧版本并在启动失败时自动回滚。
|
||||
|
||||
+12
-10
@@ -38,6 +38,7 @@ func main() {
|
||||
clusterSecret := os.Getenv("VPS_COMMANDER_CLUSTER_SECRET")
|
||||
webPassword := os.Getenv("VPS_COMMANDER_WEB_PASSWORD")
|
||||
adminToken := os.Getenv("VPS_COMMANDER_ADMIN_TOKEN")
|
||||
installCommand := os.Getenv("VPS_COMMANDER_INSTALL_COMMAND")
|
||||
if adminToken == "" {
|
||||
adminToken = webPassword
|
||||
}
|
||||
@@ -61,16 +62,17 @@ func main() {
|
||||
notificationManager.Start()
|
||||
defer notificationManager.Stop()
|
||||
s := &api.Server{
|
||||
Auth: authManager,
|
||||
Exec: executor.Local{MaxOutput: 1024 * 1024},
|
||||
Cluster: cluster.NewManager(clusterSecret, store),
|
||||
Store: store,
|
||||
LocalName: local,
|
||||
Notify: notificationManager,
|
||||
AdminToken: adminToken,
|
||||
ExecLimiter: make(chan struct{}, 32),
|
||||
SearchLimiter: make(chan struct{}, 8),
|
||||
LocalSessions: executor.NewSessionManager(0),
|
||||
Auth: authManager,
|
||||
Exec: executor.Local{MaxOutput: 1024 * 1024},
|
||||
Cluster: cluster.NewManager(clusterSecret, store),
|
||||
Store: store,
|
||||
LocalName: local,
|
||||
Notify: notificationManager,
|
||||
AdminToken: adminToken,
|
||||
InstallCommand: installCommand,
|
||||
ExecLimiter: make(chan struct{}, 32),
|
||||
SearchLimiter: make(chan struct{}, 8),
|
||||
LocalSessions: executor.NewSessionManager(0),
|
||||
}
|
||||
if err := s.LoadSecurityPolicySnapshot(); err != nil {
|
||||
log.Fatalf("load security policy snapshot: %v", err)
|
||||
|
||||
+2
-2
@@ -52,7 +52,7 @@ chmod 0600 /etc/vps-commander/agent.env
|
||||
### 3.1 一键安装
|
||||
|
||||
```bash
|
||||
curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/install.sh | sudo bash
|
||||
curl -fsSL https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/install.sh | sudo bash
|
||||
```
|
||||
|
||||
脚本自动识别 `amd64/arm64`，并进入 Hub / Agent 安装流程。
|
||||
@@ -64,7 +64,7 @@ curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/i
|
||||
### 3.2 一键升级 Agent
|
||||
|
||||
```bash
|
||||
curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/upgrade-agent.sh | sudo bash
|
||||
curl -fsSL https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/upgrade-agent.sh | sudo bash
|
||||
```
|
||||
|
||||
升级流程：
|
||||
|
||||
+80
-25
@@ -2,13 +2,15 @@
|
||||
set -e
|
||||
|
||||
# VPS-Commander 一键安装与配置脚本 (Hub / Agent)
|
||||
# Repo: https://github.com/kyaring/vps-commander
|
||||
# Repo: https://gitea.king.nyc.mn/openclaw/vps-commander
|
||||
|
||||
REPO="kyaring/vps-commander"
|
||||
REPO="openclaw/vps-commander"
|
||||
INSTALL_DIR="/opt/vps-commander"
|
||||
CONF_DIR="/etc/vps-commander"
|
||||
GITHUB_URL="https://github.com"
|
||||
API_URL="https://api.github.com"
|
||||
RELEASE_BASE_URL="https://gitea.king.nyc.mn"
|
||||
API_URL="https://gitea.king.nyc.mn/api/v1"
|
||||
RAW_INSTALL_URL="https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/install.sh"
|
||||
INSTALL_COMMAND="curl -fsSL ${RAW_INSTALL_URL} | bash"
|
||||
|
||||
# 颜色输出
|
||||
RED='\033[0;31m'
|
||||
@@ -40,7 +42,7 @@ command -v curl >/dev/null 2>&1 || (apt-get update && apt-get install -y curl ||
|
||||
info "正在获取 VPS-Commander 最新版本信息..."
|
||||
LATEST_TAG=$(curl -fsSL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 30 "${API_URL}/repos/${REPO}/releases/latest" | sed -n 's/^[[:space:]]*"tag_name": "\([^"]*\)".*/\1/p' | head -n1)
|
||||
if [ -z "$LATEST_TAG" ]; then
|
||||
error "无法从 GitHub 获取最新正式 Release，已停止安装；不会回退到旧版本"
|
||||
error "无法从 Gitea 获取最新正式 Release，已停止安装；不会回退到旧版本"
|
||||
fi
|
||||
info "检测到最新版本: ${LATEST_TAG} (${TARGET_ARCH})"
|
||||
|
||||
@@ -60,7 +62,7 @@ download_verified() {
|
||||
error "下载结果为空: ${asset_name}"
|
||||
fi
|
||||
if command -v sha256sum >/dev/null 2>&1; then
|
||||
checksum=$(curl -fsSL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 60 "${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/checksums.txt") || error "无法获取 Release 校验文件"
|
||||
checksum=$(curl -fsSL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 60 "${RELEASE_BASE_URL}/${REPO}/releases/download/${LATEST_TAG}/checksums.txt") || error "无法获取 Release 校验文件"
|
||||
expected=$(printf '%s\n' "$checksum" | awk -v f="$asset_name" '$2 == f {print $1; exit}')
|
||||
[ -n "$expected" ] || error "Release 校验文件中缺少 ${asset_name}"
|
||||
actual=$(sha256sum "$tmp" | awk '{print $1}')
|
||||
@@ -75,33 +77,47 @@ download_verified() {
|
||||
mkdir -p "$INSTALL_DIR" "$INSTALL_DIR/data" "$CONF_DIR"
|
||||
chmod 750 "$INSTALL_DIR" "$CONF_DIR"
|
||||
|
||||
read_tty() {
|
||||
local prompt="$1"
|
||||
local __var="$2"
|
||||
if [ -r /dev/tty ]; then
|
||||
local value
|
||||
if ! IFS= read -r -p "$prompt" value < /dev/tty; then
|
||||
error "无法读取交互输入，请在带 TTY 的终端中运行安装脚本；也可以通过环境变量提供配置。"
|
||||
fi
|
||||
printf -v "$__var" '%s' "$value"
|
||||
else
|
||||
error "检测不到可用 TTY。当前命令可能通过管道运行；请使用带终端的 shell 执行，例如: curl -fsSL ${RAW_INSTALL_URL} | bash"
|
||||
fi
|
||||
}
|
||||
|
||||
select_mode() {
|
||||
echo -e "\n请选择安装模式:"
|
||||
echo "1) 安装受控端 Agent (推荐：在受控 VPS 上一键连入集群)"
|
||||
echo "2) 安装中心端 Hub (管理中心)"
|
||||
read -rp "请输入选项 [1-2] (默认 1): " MODE
|
||||
read_tty "请输入选项 [1-2] (默认 1): " MODE
|
||||
MODE=${MODE:-1}
|
||||
}
|
||||
|
||||
install_agent() {
|
||||
info "开始安装 VPS-Commander Agent (${TARGET_ARCH})..."
|
||||
BIN_NAME="vps-commander-agent-linux-${TARGET_ARCH}"
|
||||
DOWNLOAD_URL="${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
|
||||
DOWNLOAD_URL="${RELEASE_BASE_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
|
||||
|
||||
download_verified "${DOWNLOAD_URL}" "${INSTALL_DIR}/vps-commander-agent" "${BIN_NAME}"
|
||||
chmod +x "${INSTALL_DIR}/vps-commander-agent"
|
||||
|
||||
echo -e "\n--- 配置 Agent 参数 ---"
|
||||
read -rp "请输入 Hub WSS 连接地址 (默认: wss://vpstool.kory.kdns.fr/agent/ws): " HUB_WS
|
||||
read_tty "请输入 Hub WSS 连接地址 (默认: wss://vpstool.kory.kdns.fr/agent/ws): " HUB_WS
|
||||
HUB_WS=${HUB_WS:-"wss://vpstool.kory.kdns.fr/agent/ws"}
|
||||
|
||||
DEFAULT_NAME=$(hostname)
|
||||
read -rp "请输入本节点名称 (默认: ${DEFAULT_NAME}): " AGENT_NAME
|
||||
read_tty "请输入本节点名称 (默认: ${DEFAULT_NAME}): " AGENT_NAME
|
||||
AGENT_NAME=${AGENT_NAME:-${DEFAULT_NAME}}
|
||||
|
||||
read -rp "请输入 Agent 独立凭据 Token: " AGENT_TOKEN
|
||||
read_tty "请输入 Agent 独立凭据 Token: " AGENT_TOKEN
|
||||
while [ -z "$AGENT_TOKEN" ]; do
|
||||
read -rp "Agent Token 不能为空，请重新输入: " AGENT_TOKEN
|
||||
read_tty "Agent Token 不能为空，请重新输入: " AGENT_TOKEN
|
||||
done
|
||||
|
||||
cat << ENV > "${CONF_DIR}/agent.env"
|
||||
@@ -122,7 +138,7 @@ Type=simple
|
||||
User=root
|
||||
WorkingDirectory=${INSTALL_DIR}
|
||||
EnvironmentFile=-${CONF_DIR}/agent.env
|
||||
ExecStart=${INSTALL_DIR}/vps-commander-agent -hub \${VPS_COMMANDER_HUB_WS_URL} -name \${VPS_COMMANDER_AGENT_NAME}
|
||||
ExecStart=/bin/sh -c 'exec ${INSTALL_DIR}/vps-commander-agent -hub "\$VPS_COMMANDER_HUB_WS_URL" -name "\$VPS_COMMANDER_AGENT_NAME"'
|
||||
Restart=always
|
||||
RestartSec=3s
|
||||
KillSignal=SIGTERM
|
||||
@@ -135,42 +151,81 @@ WantedBy=multi-user.target
|
||||
SVC
|
||||
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now vps-commander-agent
|
||||
sleep 1
|
||||
|
||||
if systemctl is-active --quiet vps-commander-agent; then
|
||||
success "VPS-Commander Agent 安装并启动成功！"
|
||||
info "节点名称: ${AGENT_NAME}"
|
||||
info "可通过 'systemctl status vps-commander-agent' 查看运行状态。"
|
||||
else
|
||||
warn "服务已启动但状态可能异常，请检查 'journalctl -u vps-commander-agent -n 20'。"
|
||||
# Validate the generated unit before starting it. systemd does not expand
|
||||
# ${VPS_COMMANDER_*} in ExecStart directly; the shell wrapper above must
|
||||
# remain intact. This prevents a false-success install with a broken URL.
|
||||
if ! grep -Fq 'ExecStart=/bin/sh -c' /etc/systemd/system/vps-commander-agent.service ||
|
||||
! grep -Fq '$VPS_COMMANDER_HUB_WS_URL' /etc/systemd/system/vps-commander-agent.service ||
|
||||
! grep -Fq '$VPS_COMMANDER_AGENT_NAME' /etc/systemd/system/vps-commander-agent.service; then
|
||||
error "生成的 Agent systemd 服务异常，ExecStart 未通过校验。安装已中止。"
|
||||
fi
|
||||
if ! [[ "$HUB_WS" =~ ^wss://[^[:space:]]+/agent/ws$ ]]; then
|
||||
error "Hub WSS 地址格式无效: ${HUB_WS}"
|
||||
fi
|
||||
if [[ "$AGENT_NAME" =~ [[:space:]/\?\&\=\#\%] ]]; then
|
||||
error "节点名称包含非法字符: ${AGENT_NAME}"
|
||||
fi
|
||||
|
||||
INSTALL_CHECK_SINCE=$(date --iso-8601=seconds)
|
||||
systemctl enable --now vps-commander-agent
|
||||
sleep 2
|
||||
|
||||
if ! systemctl is-active --quiet vps-commander-agent; then
|
||||
error "Agent 服务启动失败，请执行: journalctl -u vps-commander-agent -n 50 --no-pager"
|
||||
fi
|
||||
|
||||
# Verify that the running process received the actual URL/name, not literal
|
||||
# placeholders or installer source text.
|
||||
AGENT_CMD=$(ps -eo args= | grep -F "${INSTALL_DIR}/vps-commander-agent" | grep -v grep | head -n1 || true)
|
||||
if [[ "$AGENT_CMD" != *"-hub ${HUB_WS} -name ${AGENT_NAME}"* ]]; then
|
||||
error "Agent 进程参数校验失败: ${AGENT_CMD}"
|
||||
fi
|
||||
|
||||
# A fresh connection produces this message after the Hub handshake/MCP sync.
|
||||
# Do not report success merely because systemd says the process is running.
|
||||
CONNECTED=0
|
||||
for _ in {1..13}; do
|
||||
if journalctl -u vps-commander-agent --since "$INSTALL_CHECK_SINCE" --no-pager -o cat 2>/dev/null | grep -q "MCP services synced:"; then
|
||||
CONNECTED=1
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
if [ "$CONNECTED" -ne 1 ]; then
|
||||
error "Agent 已启动，但 15 秒内未确认成功连接 Hub，请检查: journalctl -u vps-commander-agent -n 50 --no-pager"
|
||||
fi
|
||||
|
||||
success "VPS-Commander Agent 安装、启动并完成 Hub 连接校验！"
|
||||
info "节点名称: ${AGENT_NAME}"
|
||||
info "可通过 'systemctl status vps-commander-agent' 查看运行状态。"
|
||||
}
|
||||
|
||||
install_hub() {
|
||||
info "开始安装 VPS-Commander Hub (${TARGET_ARCH})..."
|
||||
BIN_NAME="vps-commander-hub-linux-${TARGET_ARCH}"
|
||||
DOWNLOAD_URL="${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
|
||||
DOWNLOAD_URL="${RELEASE_BASE_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
|
||||
|
||||
download_verified "${DOWNLOAD_URL}" "${INSTALL_DIR}/vps-commander-hub" "${BIN_NAME}"
|
||||
chmod +x "${INSTALL_DIR}/vps-commander-hub"
|
||||
|
||||
echo -e "\n--- 配置 Hub 参数 ---"
|
||||
read -rp "请输入监听端口 (默认 9521): " HUB_PORT
|
||||
read_tty "请输入监听端口 (默认 9521): " HUB_PORT
|
||||
HUB_PORT=${HUB_PORT:-9521}
|
||||
|
||||
GEN_API_KEY=$(od -An -N24 -tx1 /dev/urandom | tr -d ' \n')
|
||||
GEN_PASS=$(od -An -N16 -tx1 /dev/urandom | tr -d ' \n')
|
||||
|
||||
read -rp "请输入 API Key (默认随机生成): " API_KEY
|
||||
read_tty "请输入 API Key (默认随机生成): " API_KEY
|
||||
API_KEY=${API_KEY:-$GEN_API_KEY}
|
||||
|
||||
read -rp "请输入 Web 管理面板密码 (默认随机生成): " WEB_PASS
|
||||
read_tty "请输入 Web 管理面板密码 (默认随机生成): " WEB_PASS
|
||||
WEB_PASS=${WEB_PASS:-$GEN_PASS}
|
||||
|
||||
cat << ENV > "${CONF_DIR}/hub.env"
|
||||
VPS_COMMANDER_API_KEY=${API_KEY}
|
||||
VPS_COMMANDER_WEB_PASSWORD=${WEB_PASS}
|
||||
VPS_COMMANDER_INSTALL_COMMAND="${INSTALL_COMMAND}"
|
||||
ENV
|
||||
chmod 0600 "${CONF_DIR}/hub.env"
|
||||
|
||||
|
||||
@@ -2,12 +2,12 @@
|
||||
set -euo pipefail
|
||||
|
||||
# VPS-Commander Agent 一键安全升级脚本
|
||||
# Repo: https://github.com/kyaring/vps-commander
|
||||
# Repo: https://gitea.king.nyc.mn/openclaw/vps-commander
|
||||
|
||||
REPO="kyaring/vps-commander"
|
||||
REPO="openclaw/vps-commander"
|
||||
INSTALL_DIR="/opt/vps-commander"
|
||||
GITHUB_URL="https://github.com"
|
||||
API_URL="https://api.github.com"
|
||||
RELEASE_BASE_URL="https://gitea.king.nyc.mn"
|
||||
API_URL="https://gitea.king.nyc.mn/api/v1"
|
||||
|
||||
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; BLUE='\033[0;34m'; NC='\033[0m'
|
||||
info() { echo -e "${BLUE}[INFO]${NC} $*"; }
|
||||
@@ -31,12 +31,12 @@ info "正在获取最新正式 Release 版本信息..."
|
||||
LATEST_TAG=$(curl -fsSL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 30 \
|
||||
"${API_URL}/repos/${REPO}/releases/latest" |
|
||||
sed -n 's/^[[:space:]]*"tag_name": "\\([^"]*\\)".*/\\1/p' | head -n1)
|
||||
[ -n "$LATEST_TAG" ] || error "无法从 GitHub 获取最新正式 Release，已停止升级；不会回退到旧版本"
|
||||
[ -n "$LATEST_TAG" ] || error "无法从 Gitea 获取最新正式 Release，已停止升级；不会回退到旧版本"
|
||||
info "目标升级版本: ${LATEST_TAG} (${TARGET_ARCH})"
|
||||
|
||||
BIN_NAME="vps-commander-agent-linux-${TARGET_ARCH}"
|
||||
DOWNLOAD_URL="${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
|
||||
CHECKSUM_URL="${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/checksums.txt"
|
||||
DOWNLOAD_URL="${RELEASE_BASE_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
|
||||
CHECKSUM_URL="${RELEASE_BASE_URL}/${REPO}/releases/download/${LATEST_TAG}/checksums.txt"
|
||||
TMP_BIN=$(mktemp "${INSTALL_DIR}/vps-commander-agent.tmp.XXXXXX") || error "无法创建临时文件"
|
||||
TMP_SUM=$(mktemp "${INSTALL_DIR}/vps-commander-checksums.tmp.XXXXXX") || { rm -f "$TMP_BIN"; error "无法创建校验文件"; }
|
||||
BAK_BIN="${INSTALL_DIR}/vps-commander-agent.bak"
|
||||
|
||||
@@ -176,7 +176,7 @@ API Key 不应提交到 Git 仓库。
|
||||
仓库已经提供统一安装脚本，支持 Linux `amd64` 与 `arm64`，安装时自动识别架构并从 GitHub Release 获取对应二进制。
|
||||
|
||||
```bash
|
||||
curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/install.sh | sudo bash
|
||||
curl -fsSL https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/install.sh | sudo bash
|
||||
```
|
||||
|
||||
脚本会进入交互式安装流程，可选择 Hub 或 Agent。生产环境使用时，Agent 应使用独立设备凭据，不应重新启用全局 Shared Secret。
|
||||
@@ -184,7 +184,7 @@ curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/i
|
||||
### 7.2 一键升级 Agent
|
||||
|
||||
```bash
|
||||
curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/upgrade-agent.sh | sudo bash
|
||||
curl -fsSL https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/upgrade-agent.sh | sudo bash
|
||||
```
|
||||
|
||||
升级采用临时文件下载 → 基础完整性检查 → 旧二进制备份 → 原子替换 → systemd 重启 → 健康检查；启动失败时自动回滚旧版本。
|
||||
|
||||
+24
-14
@@ -39,17 +39,18 @@ const (
|
||||
)
|
||||
|
||||
type Server struct {
|
||||
Auth *auth.Manager
|
||||
Exec executor.Local
|
||||
Cluster *cluster.Manager
|
||||
Store *storage.Store
|
||||
LocalName string
|
||||
Notify *notify.Manager
|
||||
Policy *security.Snapshot
|
||||
AdminToken string
|
||||
ExecLimiter chan struct{}
|
||||
SearchLimiter chan struct{}
|
||||
LocalSessions *executor.SessionManager
|
||||
Auth *auth.Manager
|
||||
Exec executor.Local
|
||||
Cluster *cluster.Manager
|
||||
Store *storage.Store
|
||||
LocalName string
|
||||
Notify *notify.Manager
|
||||
Policy *security.Snapshot
|
||||
AdminToken string
|
||||
InstallCommand string
|
||||
ExecLimiter chan struct{}
|
||||
SearchLimiter chan struct{}
|
||||
LocalSessions *executor.SessionManager
|
||||
}
|
||||
|
||||
const (
|
||||
@@ -254,8 +255,17 @@ func (s *Server) ProvisionDeviceCredentialJSON(w http.ResponseWriter, r *http.Re
|
||||
http.Error(w, "local control node does not use agent credential", 400)
|
||||
return
|
||||
}
|
||||
if s.Cluster == nil || !s.Cluster.Online(q.Device) {
|
||||
http.Error(w, "device offline", 409)
|
||||
if strings.ContainsAny(q.Device, "/\\?&=#%") {
|
||||
http.Error(w, "invalid device name", 400)
|
||||
return
|
||||
}
|
||||
configured, err := s.Store.HasDeviceCredential(q.Device)
|
||||
if err != nil {
|
||||
http.Error(w, "credential lookup failed", 500)
|
||||
return
|
||||
}
|
||||
if configured {
|
||||
http.Error(w, "device credential already exists; revoke/rotate it before provisioning again", 409)
|
||||
return
|
||||
}
|
||||
b := make([]byte, 32)
|
||||
@@ -269,7 +279,7 @@ func (s *Server) ProvisionDeviceCredentialJSON(w http.ResponseWriter, r *http.Re
|
||||
return
|
||||
}
|
||||
_ = s.Store.Audit(clientIP(r), q.Device, "device_credential_provision", "device="+q.Device, 0, 0, "credential provisioned")
|
||||
jsonOut(w, map[string]any{"ok": true, "device": q.Device, "token": token})
|
||||
jsonOut(w, map[string]any{"ok": true, "device": q.Device, "token": token, "install_command": s.InstallCommand})
|
||||
}
|
||||
|
||||
func (s *Server) UpdateSecuritySettingsJSON(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
@@ -167,3 +167,44 @@ func TestEditBlockSecurityAndReplacement(t *testing.T) {
|
||||
t.Fatalf("low mode status=%d body=%s", w.Code, w.Body.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestProvisionDeviceCredentialForNewOfflineDevice(t *testing.T) {
|
||||
store, err := storage.Open(filepath.Join(t.TempDir(), "commander.db"))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer store.DB.Close()
|
||||
|
||||
s := &Server{
|
||||
Store: store,
|
||||
LocalName: "wjyhk",
|
||||
AdminToken: "admin-test-token",
|
||||
}
|
||||
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/v1/security/device-credentials/provision", strings.NewReader("{\"device\":\"new-node-01\"}"))
|
||||
req.Header.Set("X-Admin-Token", "admin-test-token")
|
||||
w := httptest.NewRecorder()
|
||||
s.ProvisionDeviceCredentialJSON(w, req)
|
||||
if w.Code != http.StatusOK {
|
||||
t.Fatalf("provision status=%d body=%s", w.Code, w.Body.String())
|
||||
}
|
||||
if !strings.Contains(w.Body.String(), "\"token\"") {
|
||||
t.Fatalf("missing token: %s", w.Body.String())
|
||||
}
|
||||
|
||||
ok, err := store.HasDeviceCredential("new-node-01")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !ok {
|
||||
t.Fatal("credential was not persisted")
|
||||
}
|
||||
|
||||
req = httptest.NewRequest(http.MethodPost, "/api/v1/security/device-credentials/provision", strings.NewReader("{\"device\":\"new-node-01\"}"))
|
||||
req.Header.Set("X-Admin-Token", "admin-test-token")
|
||||
w = httptest.NewRecorder()
|
||||
s.ProvisionDeviceCredentialJSON(w, req)
|
||||
if w.Code != http.StatusConflict {
|
||||
t.Fatalf("duplicate provision status=%d body=%s", w.Code, w.Body.String())
|
||||
}
|
||||
}
|
||||
|
||||
@@ -54,6 +54,7 @@ func (p *Panel) Handler() http.Handler {
|
||||
mux.HandleFunc("/panel/api/mcp/test", p.protected(p.testMCP))
|
||||
mux.HandleFunc("/panel/api/security/settings", p.protected(p.securitySettings))
|
||||
mux.HandleFunc("/panel/api/security/settings/update", p.protected(p.updateSecuritySettings))
|
||||
mux.HandleFunc("/panel/api/security/device-credentials/provision", p.protected(p.provisionDeviceCredential))
|
||||
mux.HandleFunc("/panel/api/notifications/webhooks", p.protected(p.webhookTargets))
|
||||
mux.HandleFunc("/panel/api/notifications/webhook/update", p.protected(p.updateWebhookTarget))
|
||||
mux.HandleFunc("/panel/api/notifications/webhook/delete", p.protected(p.deleteWebhookTarget))
|
||||
@@ -65,6 +66,7 @@ func (p *Panel) Handler() http.Handler {
|
||||
type securityPanelRunner interface {
|
||||
SecuritySettingsJSON(http.ResponseWriter, *http.Request)
|
||||
UpdateSecuritySettingsJSON(http.ResponseWriter, *http.Request)
|
||||
ProvisionDeviceCredentialJSON(http.ResponseWriter, *http.Request)
|
||||
}
|
||||
|
||||
type mcpPanelRunner interface {
|
||||
@@ -121,6 +123,17 @@ func (p *Panel) updateSecuritySettings(w http.ResponseWriter, r *http.Request) {
|
||||
http.Error(w, "security API unavailable", 501)
|
||||
}
|
||||
|
||||
func (p *Panel) provisionDeviceCredential(w http.ResponseWriter, r *http.Request) {
|
||||
if p.AdminToken != "" {
|
||||
r.Header.Set("X-Admin-Token", p.AdminToken)
|
||||
}
|
||||
if v, ok := p.Runner.(securityPanelRunner); ok {
|
||||
v.ProvisionDeviceCredentialJSON(w, r)
|
||||
return
|
||||
}
|
||||
http.Error(w, "security API unavailable", 501)
|
||||
}
|
||||
|
||||
func (p *Panel) testMCP(w http.ResponseWriter, r *http.Request) {
|
||||
if v, ok := p.Runner.(mcpPanelRunner); ok {
|
||||
v.TestMCPJSON(w, r)
|
||||
|
||||
@@ -213,6 +213,25 @@ $("#mcpTest").onclick=async()=>{
|
||||
$("#mcpTransport").onchange=()=>{const stdio=$("#mcpTransport").value==="stdio";$("#mcpCommand").parentElement.style.display=stdio?"":"none";$("#mcpArgs").parentElement.style.display=stdio?"":"none";$("#mcpUrl").parentElement.style.display=stdio?"none":""};
|
||||
loadMCPServices().catch(console.error);
|
||||
|
||||
async function provisionDeviceCredential(){
|
||||
const result=$("#deviceProvisionResult");
|
||||
const status=$("#deviceProvisionStatus");
|
||||
const name=($("#provisionDeviceName").value||"").trim();
|
||||
if(!name){status.textContent="请输入节点名称。";return}
|
||||
try{
|
||||
const x=await api("/security/device-credentials/provision",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device:name})});
|
||||
$("#deviceProvisionToken").value=x.token||"";
|
||||
$("#deviceProvisionCommand").value=x.install_command||"";
|
||||
result.hidden=false;
|
||||
status.textContent=name+" 接入凭证已生成。安装时把 Token 填入 Agent Token。";
|
||||
}catch(e){status.textContent="生成失败: "+e.message}
|
||||
}
|
||||
$("#deviceProvisionNew").onclick=()=>{$("#deviceProvisionEditor").hidden=false;$("#deviceProvisionResult").hidden=true;$("#deviceProvisionStatus").textContent="";$("#provisionDeviceName").focus()};
|
||||
$("#deviceProvisionCancel").onclick=()=>{$("#deviceProvisionEditor").hidden=true};
|
||||
$("#deviceProvisionCreate").onclick=()=>provisionDeviceCredential();
|
||||
$("#deviceProvisionToken").onclick=e=>e.target.select();
|
||||
$("#deviceProvisionCommand").onclick=e=>e.target.select();
|
||||
|
||||
async function loadSecuritySettings(){const x=await api("/security/settings"),nodes=x.nodes||[],effective=x.effective||{},configured=new Map(nodes.map(n=>[n.node,n.mode])),devices=await api("/devices");$("#globalSecurity").value=x.global||"medium";$("#securityNodes").innerHTML=devices.map(d=>{const mode=configured.get(d.name)||"inherit",eff=effective[d.name]||x.global||"medium";return `<tr><td>${esc(d.name)}</td><td><select data-security-node="${esc(d.name)}"><option value="inherit" ${mode==='inherit'?'selected':''}>跟随全局</option><option value="low" ${mode==='low'?'selected':''}>低 · Low</option><option value="medium" ${mode==='medium'?'selected':''}>中 · Medium</option><option value="high" ${mode==='high'?'selected':''}>高 · High</option></select></td><td>${esc(eff)}</td><td><button type="button" onclick="saveNodeSecurity('${esc(d.name)}')">保存</button></td></tr>`}).join("")}
|
||||
async function saveNodeSecurity(node){const el=document.querySelector(`[data-security-node="${CSS.escape(node)}"]`);if(!el)return;try{await api("/security/settings/update",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({node,mode:el.value})});$("#securityStatus").textContent=`${node} 策略已保存。`;await loadSecuritySettings()}catch(e){$("#securityStatus").textContent="保存失败: "+e.message}}
|
||||
$("#saveGlobalSecurity").onclick=async()=>{try{await api("/security/settings/update",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({global:$("#globalSecurity").value})});$("#securityStatus").textContent="全局安全策略已保存。";await loadSecuritySettings()}catch(e){$("#securityStatus").textContent="保存失败: "+e.message}};$("#securityRefresh").onclick=()=>loadSecuritySettings().catch(console.error);loadSecuritySettings().catch(console.error);
|
||||
|
||||
@@ -1,5 +1,22 @@
|
||||
<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><script>(function(){try{var t=localStorage.getItem("vpc_theme");if(t!=="light"&&t!=="dark")t=matchMedia("(prefers-color-scheme:light)").matches?"light":"dark";document.documentElement.dataset.theme=t}catch(e){document.documentElement.dataset.theme="dark"}})();</script><title>VPS-Commander</title><link rel="stylesheet" href="/static/app.css"></head><body><header><div class="brand-wrap"><img src="/static/icon.png" alt="logo" class="brand-logo"><div><strong>VPS-Commander</strong><span>Private Infrastructure Console</span></div></div><div class="header-actions"><button id="themeToggle" type="button" class="btn-icon" title="切换主题" aria-label="切换主题"><svg class="theme-svg svg-sun" viewBox="0 0 24 24" width="18" height="18" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="5"></circle><line x1="12" y1="1" x2="12" y2="3"></line><line x1="12" y1="21" x2="12" y2="23"></line><line x1="4.22" y1="4.22" x2="5.64" y2="5.64"></line><line x1="18.36" y1="18.36" x2="19.78" y2="19.78"></line><line x1="1" y1="12" x2="3" y2="12"></line><line x1="21" y1="12" x2="23" y2="12"></line><line x1="4.22" y1="19.78" x2="5.64" y2="18.36"></line><line x1="18.36" y1="5.64" x2="19.78" y2="4.22"></line></svg><svg class="theme-svg svg-moon" viewBox="0 0 24 24" width="18" height="18" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"></path></svg></button><button id="logout" type="button">退出</button></div></header><main><section class="grid"><article class="card wide"><div class="cardhead"><h2>设备看板</h2><button id="refresh" type="button">刷新</button></div><div id="devices" class="devices"></div></article><article class="card"><h2>Actions 向导</h2><p>当前 Hub 的 OpenAPI Schema：</p><div class="actions"><button id="copySchema" type="button">复制 Schema 地址</button><button id="copyPrompt" type="button">复制 System Prompt</button><button id="rotateKey" type="button">轮换 API Key</button></div><pre id="schemaHint">/openapi.json</pre><pre id="newKey"></pre></article><article class="card wide"><div class="mcp-toolbar"><h2>MCP</h2><button id="mcpNew" type="button">新增 MCP</button></div><div id="mcpList" class="mcp-grid"></div><div id="mcpEditor" hidden><div class="mcp-form"><label>服务标识<input id="mcpId" placeholder="docker"></label><label>显示名称<input id="mcpName" placeholder="Docker 容器管理"></label><label>传输类型<select id="mcpTransport"><option value="stdio">命令行 / stdio</option><option value="http">HTTP / Streamable HTTP</option><option value="sse">SSE</option></select></label><label>启用<select id="mcpEnabled"><option value="1">启用</option><option value="0">停用</option></select></label><label class="full">Command<input id="mcpCommand" placeholder="docker-mcp"></label><label class="full">Arguments（JSON 数组）<textarea id="mcpArgs">[]</textarea></label><label class="full">URL<input id="mcpUrl" placeholder="http://127.0.0.1:8080/mcp"></label><label class="full">Headers（JSON 对象，可选）<textarea id="mcpHeaders">{}</textarea></label><label class="full">环境变量（JSON 对象，可选）<textarea id="mcpEnv">{}</textarea></label><label>生效范围<select id="mcpScope"><option value="all">全部节点</option><option value="custom">指定节点</option></select></label><div><span>指定节点</span><div id="mcpNodes" class="mcp-nodes"></div></div><label>测试节点<select id="mcpTestNode"><option value="local">Hub 本机</option></select></label></div><div class="mcp-actions"><button id="mcpSave" type="button">保存并热更新</button><button id="mcpTest" type="button">测试连通性</button><button id="mcpCancel" type="button">取消</button></div><div id="mcpStatus" class="mcp-status"></div><div id="mcpTestResult" class="mcp-test-result" hidden></div></div></article>
|
||||
<article class="card wide"><div class="cardhead"><h2>快速控制台</h2><select id="device"></select></div><textarea id="command" placeholder="输入 Shell 命令，例如 uname -a"></textarea><div><button id="run" type="button">执行</button></div><pre id="output"></pre></article><article class="card wide"><div class="cardhead"><h2>安全</h2><button id="securityRefresh" type="button">刷新</button></div><div class="security-grid"><label>全局安全等级<select id="globalSecurity"><option value="low">低 · Low</option><option value="medium">中 · Medium</option><option value="high">高 · High</option></select></label><button id="saveGlobalSecurity" type="button">保存全局策略</button></div><div class="tablewrap"><table><thead><tr><th>节点</th><th>单机策略</th><th>有效策略</th><th>操作</th></tr></thead><tbody id="securityNodes"></tbody></table></div><p id="securityStatus"></p></article><article class="card wide">
|
||||
<article class="card wide"><div class="cardhead"><h2>快速控制台</h2><select id="device"></select></div><textarea id="command" placeholder="输入 Shell 命令，例如 uname -a"></textarea><div><button id="run" type="button">执行</button></div><pre id="output"></pre></article><article class="card wide"><div class="cardhead"><h2>设备接入</h2><button id="deviceProvisionNew" type="button">添加设备</button></div>
|
||||
<div id="deviceProvisionEditor" hidden>
|
||||
<div class="mcp-form">
|
||||
<label>节点名称<input id="provisionDeviceName" placeholder="例如 hk-vps-01"></label>
|
||||
</div>
|
||||
<div class="mcp-actions">
|
||||
<button id="deviceProvisionCreate" type="button">生成接入凭证</button>
|
||||
<button id="deviceProvisionCancel" type="button">取消</button>
|
||||
</div>
|
||||
<div id="deviceProvisionStatus" class="mcp-status"></div>
|
||||
<div id="deviceProvisionResult" hidden>
|
||||
<label>Agent Token<input id="deviceProvisionToken" readonly></label>
|
||||
<label>一键安装命令<textarea id="deviceProvisionCommand" readonly></textarea></label>
|
||||
<p>Token 只在这里明文显示；Hub 仅保存 Token 哈希。</p>
|
||||
</div>
|
||||
</div>
|
||||
</article>
|
||||
<article class="card wide"><div class="cardhead"><h2>安全</h2><button id="securityRefresh" type="button">刷新</button></div><div class="security-grid"><label>全局安全等级<select id="globalSecurity"><option value="low">低 · Low</option><option value="medium">中 · Medium</option><option value="high">高 · High</option></select></label><button id="saveGlobalSecurity" type="button">保存全局策略</button></div><div class="tablewrap"><table><thead><tr><th>节点</th><th>单机策略</th><th>有效策略</th><th>操作</th></tr></thead><tbody id="securityNodes"></tbody></table></div><p id="securityStatus"></p></article><article class="card wide">
|
||||
<div class="mcp-toolbar">
|
||||
<h2>通知</h2>
|
||||
<div style="display:flex;gap:8px">
|
||||
|
||||
Reference in New Issue
Block a user