mrlee
828be2ea66
agent 0.11.0：新增 GET /api/v1/certs（遍历证书目录、crypto/x509 解析 fullchain.pem 到期时间、按剩余天数排序、解析失败记 warnings）与 POST /api/v1/nginx/reload（回传 nginx -t 与 reload 的失败原因，成功后失效可用性探测缓存） 应用侧：AgentClient.Certs / NginxReload + service / handler / router；agent 版本要求提到 ≥ 0.11.0（旧版本仍按 404/405 降级为升级提示） 前端：公网 Agent 页新增「VPS 证书」卡（域名/剩余天数/Fonu 证书库/到期时间，与 Fonu 证书库交叉核对）；Nginx 卡新增「重载 Nginx」并显示失败原因；VPS 资源与 VPS 证书改为并排各占半行（dep-grid 6 列 + span 分配，窄屏复位） 二进制：内嵌 fonu-agent-linux-amd64 / arm64 重编；VERSION → 1.2.5
346 lines
10 KiB
Go
346 lines
10 KiB
Go
package agent
|
||
|
||
import (
|
||
"bytes"
|
||
"crypto/x509"
|
||
"encoding/pem"
|
||
"fmt"
|
||
"io"
|
||
"math"
|
||
"net/http"
|
||
"os"
|
||
"os/exec"
|
||
"path/filepath"
|
||
"regexp"
|
||
"sort"
|
||
"strconv"
|
||
"strings"
|
||
"time"
|
||
|
||
"github.com/fonu/fonu/internal/sysinfo"
|
||
)
|
||
|
||
const (
|
||
// metricsInterval 两次 CPU 采样的最小间隔：间隔内重复调用直接返回上次结果，避免数值抖动
|
||
metricsInterval = time.Second
|
||
// maxLogLineBytes 单行日志截断长度，避免一行超长把响应撑大
|
||
maxLogLineBytes = 4 << 10
|
||
// maxLogLines 日志尾部行数上限
|
||
maxLogLines = 2000
|
||
// maxFRPSConfigBytes frps.toml 回读上限
|
||
maxFRPSConfigBytes = 256 << 10
|
||
)
|
||
|
||
// metrics 采集 VPS 主机资源（CPU / 内存 / 磁盘 / 负载 / 运行时长）。
|
||
// 复用 internal/sysinfo：agent 跑在 VPS 上，采到的天然是 VPS 自身数值。
|
||
func (s *Server) metrics(w http.ResponseWriter, _ *http.Request) {
|
||
s.metricsMu.Lock()
|
||
defer s.metricsMu.Unlock()
|
||
|
||
now := time.Now()
|
||
if s.metricsCached != nil && now.Sub(s.metricsAt) < metricsInterval {
|
||
writeJSON(w, http.StatusOK, s.metricsCached)
|
||
return
|
||
}
|
||
|
||
stats, sample := sysinfo.Read(s.metricsSample)
|
||
s.metricsSample = sample
|
||
payload := map[string]any{
|
||
"cpu_percent": math.Round(stats.CPUPercent*10) / 10,
|
||
"mem_used_bytes": stats.MemUsedBytes,
|
||
"mem_total_bytes": stats.MemTotalBytes,
|
||
"disk_used_bytes": stats.DiskUsedBytes,
|
||
"disk_total_bytes": stats.DiskTotalBytes,
|
||
// 当前只统计根文件系统（与 internal/sysinfo 的 Linux 实现一致）
|
||
"disk_path": "/",
|
||
"checked_at": now.UTC().Format(time.RFC3339),
|
||
}
|
||
if load := sysinfo.LoadAvg(); len(load) == 3 {
|
||
payload["load_avg"] = load
|
||
}
|
||
if uptime := sysinfo.UptimeSeconds(); uptime > 0 {
|
||
payload["uptime_seconds"] = uptime
|
||
}
|
||
|
||
s.metricsAt = now
|
||
s.metricsCached = payload
|
||
writeJSON(w, http.StatusOK, payload)
|
||
}
|
||
|
||
// nginxLogs 读取 VPS 上 Nginx 的 access / error 日志尾部。
|
||
// 路径不接受请求参数：只从 `nginx -T` 的实际生效配置、默认目录或环境变量目录里取，避免变成任意文件读取。
|
||
func (s *Server) nginxLogs(w http.ResponseWriter, r *http.Request) {
|
||
kind := strings.TrimSpace(r.URL.Query().Get("type"))
|
||
if kind != "access" && kind != "error" {
|
||
kind = "access"
|
||
}
|
||
lines := maxLogLines
|
||
if raw := strings.TrimSpace(r.URL.Query().Get("lines")); raw != "" {
|
||
if parsed, err := strconv.Atoi(raw); err == nil {
|
||
lines = parsed
|
||
}
|
||
}
|
||
if lines <= 0 || lines > maxLogLines {
|
||
lines = maxLogLines
|
||
}
|
||
|
||
path := s.nginxLogPath(kind)
|
||
if path == "" {
|
||
writeJSON(w, http.StatusOK, map[string]any{
|
||
"type": kind, "path": "", "lines": []string{}, "truncated": false,
|
||
"checked_at": time.Now().UTC().Format(time.RFC3339),
|
||
})
|
||
return
|
||
}
|
||
|
||
content, truncated, err := tailFile(path, lines, maxLogLineBytes)
|
||
if err != nil {
|
||
if os.IsNotExist(err) {
|
||
// 文件不存在不是错误：返回空列表 + 路径，由前端提示「未找到日志文件」
|
||
writeJSON(w, http.StatusOK, map[string]any{
|
||
"type": kind, "path": path, "lines": []string{}, "truncated": false,
|
||
"checked_at": time.Now().UTC().Format(time.RFC3339),
|
||
})
|
||
return
|
||
}
|
||
status := http.StatusInternalServerError
|
||
if os.IsPermission(err) {
|
||
status = http.StatusForbidden
|
||
}
|
||
writeJSON(w, status, map[string]any{"error": fmt.Sprintf("读取日志失败：%v", err), "path": path})
|
||
return
|
||
}
|
||
|
||
writeJSON(w, http.StatusOK, map[string]any{
|
||
"type": kind, "path": path, "lines": content, "truncated": truncated,
|
||
"checked_at": time.Now().UTC().Format(time.RFC3339),
|
||
})
|
||
}
|
||
|
||
// nginxLogPath 解析日志文件路径：优先 `nginx -T` 实际生效配置里的指令，其次环境变量目录，最后默认目录
|
||
func (s *Server) nginxLogPath(kind string) string {
|
||
directive := "access_log"
|
||
if kind == "error" {
|
||
directive = "error_log"
|
||
}
|
||
if nginx := s.nginxPath(); nginx != "" {
|
||
if out, err := exec.Command(nginx, "-T").CombinedOutput(); err == nil {
|
||
if path := logPathFromDump(string(out), directive); path != "" {
|
||
return path
|
||
}
|
||
}
|
||
}
|
||
dir := strings.TrimSpace(os.Getenv("FONU_AGENT_NGINX_LOG_DIR"))
|
||
if dir == "" {
|
||
dir = "/var/log/nginx"
|
||
}
|
||
return filepath.Join(dir, kind+".log")
|
||
}
|
||
|
||
// logPathFromDump 从 `nginx -T` 输出里取第一条绝对路径的日志指令（跳过 off / stderr / 含变量的写法）
|
||
func logPathFromDump(dump, directive string) string {
|
||
pattern := regexp.MustCompile(`(?m)^\s*` + directive + `\s+([^;\s]+)`)
|
||
for _, match := range pattern.FindAllStringSubmatch(dump, -1) {
|
||
candidate := strings.TrimSpace(match[1])
|
||
if candidate == "" || candidate == "off" || candidate == "stderr" || strings.Contains(candidate, "$") {
|
||
continue
|
||
}
|
||
// 只接受绝对路径：agent 只跑在 Linux 上，用前导斜杠判定（filepath.IsAbs 在 Windows 上对 /var/... 返回 false）
|
||
if strings.HasPrefix(candidate, "/") {
|
||
return candidate
|
||
}
|
||
}
|
||
return ""
|
||
}
|
||
|
||
// tailFile 从文件末尾倒读最多 lines 行：按块回溯，避免把整个日志读进内存；单行超长时截断
|
||
func tailFile(path string, lines int, maxLine int) ([]string, bool, error) {
|
||
file, err := os.Open(path)
|
||
if err != nil {
|
||
return nil, false, err
|
||
}
|
||
defer file.Close()
|
||
|
||
info, err := file.Stat()
|
||
if err != nil {
|
||
return nil, false, err
|
||
}
|
||
|
||
const chunkSize = 32 * 1024
|
||
var (
|
||
offset int64 = info.Size()
|
||
buffer []byte
|
||
)
|
||
for offset > 0 && bytes.Count(buffer, []byte("\n")) <= lines {
|
||
readSize := int64(chunkSize)
|
||
if offset < readSize {
|
||
readSize = offset
|
||
}
|
||
offset -= readSize
|
||
block := make([]byte, readSize)
|
||
if _, err := file.ReadAt(block, offset); err != nil && err != io.EOF {
|
||
return nil, false, err
|
||
}
|
||
buffer = append(block, buffer...)
|
||
}
|
||
|
||
rows := strings.Split(strings.TrimRight(string(buffer), "\n"), "\n")
|
||
truncated := false
|
||
if len(rows) > lines {
|
||
rows = rows[len(rows)-lines:]
|
||
truncated = true
|
||
}
|
||
out := make([]string, 0, len(rows))
|
||
for _, row := range rows {
|
||
if len(row) > maxLine {
|
||
row = row[:maxLine] + "…"
|
||
}
|
||
out = append(out, row)
|
||
}
|
||
return out, truncated, nil
|
||
}
|
||
|
||
// vpsCertificate VPS 证书目录里的一张证书
|
||
// 注意：证书按 <CertsDir>/<域名>/fullchain.pem + privkey.pem 存放（与 putCertificate 一致）。
|
||
type vpsCertificate struct {
|
||
Domain string `json:"domain"`
|
||
CertPath string `json:"cert_path"`
|
||
KeyPath string `json:"key_path"`
|
||
NotAfter string `json:"not_after,omitempty"`
|
||
DaysLeft int `json:"days_left"`
|
||
}
|
||
|
||
// certs 列出 VPS 证书目录下的域名与到期时间：用于与 Fonu 证书库交叉核对，也能看到宝塔自行申请的证书
|
||
func (s *Server) certs(w http.ResponseWriter, _ *http.Request) {
|
||
dir := strings.TrimSpace(s.cfg.CertsDir)
|
||
payload := map[string]any{
|
||
"certs": []vpsCertificate{}, "warnings": []string{}, "dir": dir,
|
||
"checked_at": time.Now().UTC().Format(time.RFC3339),
|
||
}
|
||
if dir == "" {
|
||
writeJSON(w, http.StatusOK, payload)
|
||
return
|
||
}
|
||
entries, err := os.ReadDir(dir)
|
||
if err != nil {
|
||
if os.IsNotExist(err) {
|
||
writeJSON(w, http.StatusOK, payload)
|
||
return
|
||
}
|
||
status := http.StatusInternalServerError
|
||
if os.IsPermission(err) {
|
||
status = http.StatusForbidden
|
||
}
|
||
writeJSON(w, status, map[string]string{"error": fmt.Sprintf("读取证书目录失败：%v", err)})
|
||
return
|
||
}
|
||
|
||
now := time.Now()
|
||
certs := make([]vpsCertificate, 0, len(entries))
|
||
warnings := make([]string, 0)
|
||
for _, entry := range entries {
|
||
if !entry.IsDir() {
|
||
continue
|
||
}
|
||
domain := entry.Name()
|
||
item := vpsCertificate{
|
||
Domain: domain,
|
||
CertPath: filepath.Join(dir, domain, "fullchain.pem"),
|
||
KeyPath: filepath.Join(dir, domain, "privkey.pem"),
|
||
}
|
||
notAfter, err := readCertificateNotAfter(item.CertPath)
|
||
if err != nil {
|
||
warnings = append(warnings, fmt.Sprintf("%s：%v", domain, err))
|
||
} else {
|
||
item.NotAfter = notAfter.UTC().Format(time.RFC3339)
|
||
item.DaysLeft = int(notAfter.Sub(now).Hours() / 24)
|
||
}
|
||
certs = append(certs, item)
|
||
}
|
||
// 到期最快的排在前面，便于直接看出哪张该续了
|
||
sort.Slice(certs, func(i, j int) bool { return certs[i].DaysLeft < certs[j].DaysLeft })
|
||
|
||
payload["certs"] = certs
|
||
payload["warnings"] = warnings
|
||
writeJSON(w, http.StatusOK, payload)
|
||
}
|
||
|
||
// readCertificateNotAfter 解析 PEM 证书的到期时间
|
||
func readCertificateNotAfter(path string) (time.Time, error) {
|
||
data, err := os.ReadFile(path)
|
||
if err != nil {
|
||
return time.Time{}, err
|
||
}
|
||
block, _ := pem.Decode(data)
|
||
if block == nil {
|
||
return time.Time{}, fmt.Errorf("不是有效的 PEM 证书")
|
||
}
|
||
cert, err := x509.ParseCertificate(block.Bytes)
|
||
if err != nil {
|
||
return time.Time{}, err
|
||
}
|
||
return cert.NotAfter, nil
|
||
}
|
||
|
||
// nginxReload 显式校验并重载 Nginx，把校验/重载失败的原因回传。
|
||
// 这里不加 s.mu：validateNginx / reloadNginx 的调用方约定（见 writeRoute 注释）是外部持锁，
|
||
// 而本端点是用户显式触发的排查动作，不加锁可避免与路由写入相互阻塞。
|
||
func (s *Server) nginxReload(w http.ResponseWriter, _ *http.Request) {
|
||
payload := map[string]any{"checked_at": time.Now().UTC().Format(time.RFC3339)}
|
||
if err := s.validateNginx(); err != nil {
|
||
payload["ok"] = false
|
||
payload["test_ok"] = false
|
||
payload["test_error"] = err.Error()
|
||
writeJSON(w, http.StatusOK, payload)
|
||
return
|
||
}
|
||
payload["test_ok"] = true
|
||
if err := s.reloadNginx(); err != nil {
|
||
payload["ok"] = false
|
||
payload["reload_ok"] = false
|
||
payload["reload_error"] = err.Error()
|
||
writeJSON(w, http.StatusOK, payload)
|
||
return
|
||
}
|
||
// 重载成功后让 Nginx 可用性探测的缓存失效，避免页面继续显示旧结论
|
||
s.invalidateNginxProbe()
|
||
payload["ok"] = true
|
||
payload["reload_ok"] = true
|
||
writeJSON(w, http.StatusOK, payload)
|
||
}
|
||
|
||
// frpsConfig 回读 VPS 上的 frps.toml，供应用侧与「即将下发的内容」比对，检出被手工修改的情况
|
||
func (s *Server) frpsConfig(w http.ResponseWriter, _ *http.Request) {
|
||
path := strings.TrimSpace(s.cfg.FrpsConfigPath)
|
||
payload := map[string]any{
|
||
"path": path, "exists": false, "content": "", "truncated": false,
|
||
"checked_at": time.Now().UTC().Format(time.RFC3339),
|
||
}
|
||
if path == "" {
|
||
writeJSON(w, http.StatusOK, payload)
|
||
return
|
||
}
|
||
info, err := os.Stat(path)
|
||
if err != nil {
|
||
writeJSON(w, http.StatusOK, payload)
|
||
return
|
||
}
|
||
data, err := os.ReadFile(path)
|
||
if err != nil {
|
||
status := http.StatusInternalServerError
|
||
if os.IsPermission(err) {
|
||
status = http.StatusForbidden
|
||
}
|
||
writeJSON(w, status, map[string]any{"error": fmt.Sprintf("读取 frps 配置失败：%v", err), "path": path})
|
||
return
|
||
}
|
||
if len(data) > maxFRPSConfigBytes {
|
||
data = data[:maxFRPSConfigBytes]
|
||
payload["truncated"] = true
|
||
}
|
||
payload["exists"] = true
|
||
payload["content"] = string(data)
|
||
payload["mod_time"] = info.ModTime().UTC().Format(time.RFC3339)
|
||
writeJSON(w, http.StatusOK, payload)
|
||
}
|