187 lines
7.9 KiB
Go
187 lines
7.9 KiB
Go
package frp
|
||
|
||
import (
|
||
"context"
|
||
"fmt"
|
||
"strings"
|
||
|
||
"github.com/fonu/fonu/internal/frp/agentbin"
|
||
)
|
||
|
||
// AgentInstaller 负责把内嵌的 fonu-agent 通过 SSH 装到 VPS 上，并收集安装结果。
|
||
type AgentInstaller struct {
|
||
SSH SSHInstaller
|
||
}
|
||
|
||
// Probe 返回 VPS 环境摘要：架构、nginx 是否安装、agent 是否已装、systemd 可用性。
|
||
func (i AgentInstaller) Probe(ctx context.Context) (map[string]any, error) {
|
||
client, err := i.SSH.client(ctx)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("SSH 连接失败: %w", err)
|
||
}
|
||
defer client.Close()
|
||
out := func(cmd string) string {
|
||
v, _ := runSSHSession(client, cmd)
|
||
return strings.TrimSpace(v)
|
||
}
|
||
arch := out("uname -m")
|
||
return map[string]any{
|
||
"arch": arch,
|
||
"nginx_conf": out(`conf=$(nginx -V 2>&1 | grep -o '\-\-conf-path=[^ ]*' | head -1 | cut -d= -f2-); [ -z "$conf" ] && conf=/etc/nginx/nginx.conf; grep '^[[:space:]]*include' "$conf" 2>/dev/null | grep -m1 -E 'conf\.d|sites-enabled|vhost/nginx' || ls -d /etc/nginx/conf.d 2>/dev/null`),
|
||
"agent_exist": out("test -x /usr/local/bin/fonu-agent && echo yes || echo no") == "yes",
|
||
"agent_running": out("systemctl is-active fonu-agent 2>/dev/null || true"),
|
||
"agent_version": out("/usr/local/bin/fonu-agent -version 2>/dev/null || echo 未知"),
|
||
// Token 只回「是否已配置 + 末 4 位」：明文不经过 HTTP 返回前端（库里同一字段也是掩码）
|
||
"agent_token_configured": out("test -s /etc/fonu-agent/agent.env && grep -q '^FONU_AGENT_TOKEN=' /etc/fonu-agent/agent.env && echo yes || echo no") == "yes",
|
||
"agent_token_hint": out("sed -n 's/^FONU_AGENT_TOKEN=//p' /etc/fonu-agent/agent.env 2>/dev/null | tr -d '\\n' | tail -c 4"),
|
||
"frps_alive": out("systemctl is-active frps 2>/dev/null; pgrep -x frps >/dev/null && echo active || true"),
|
||
"frps_version": out("/usr/local/bin/frps --version 2>/dev/null || echo 未安装"),
|
||
"frps_config": out("test -f /etc/frp/frps.toml && echo /etc/frp/frps.toml || echo 配置文件不存在"),
|
||
"frps_unit": out("systemctl status frps --no-pager 2>/dev/null | head -3 || echo 无 systemd 单位"),
|
||
"frps_log": out("journalctl -u frps -n 5 --no-pager 2>/dev/null || true"),
|
||
"port7000": out("ss -tlnp 2>/dev/null | grep ':7000 ' | head -1"),
|
||
"port80": out("ss -tlnp 2>/dev/null | grep ':80 ' | head -1"),
|
||
"port443": out("ss -tlnp 2>/dev/null | grep ':443 ' | head -1"),
|
||
}, nil
|
||
}
|
||
|
||
// Install 上传内嵌二进制并执行安装脚本；重复执行等于覆盖升级。返回 agent Token。
|
||
func (i AgentInstaller) Install(ctx context.Context) (string, error) {
|
||
arch, err := i.SSH.Run(ctx, "uname -m")
|
||
if err != nil {
|
||
return "", fmt.Errorf("探测架构失败: %w", err)
|
||
}
|
||
binary, ok := agentbin.BinaryForArch(strings.TrimSpace(arch))
|
||
if !ok {
|
||
return "", fmt.Errorf("不支持的 VPS 架构: %s", strings.TrimSpace(arch))
|
||
}
|
||
// 开发环境（go run / 非 Docker 构建）里内嵌的是占位文件；提前报错而不是让 VPS 上 systemd 反复 Exec format error
|
||
if !isELFBinary(binary) {
|
||
return "", fmt.Errorf("内嵌 agent 二进制无效（开发构建占位文件）。请用 Docker 构建或先执行构建脚本生成真实 agent：go build -o internal/frp/agentbin/fonu-agent-linux-amd64 ./cmd/fonu-agent（GOOS=linux GOARCH=amd64）")
|
||
}
|
||
script, err := agentInstallScript()
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
output, err := i.SSH.Install(ctx, binary, script)
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
token := extractToken(output)
|
||
if token == "" {
|
||
return "", fmt.Errorf("安装完成但未取回 Token: %s", strings.TrimSpace(output))
|
||
}
|
||
return token, nil
|
||
}
|
||
|
||
// Uninstall 停止并移除 agent 服务；--keep-data 保留路由与证书。
|
||
func (i AgentInstaller) Uninstall(ctx context.Context, keepData bool) (string, error) {
|
||
command := "/usr/local/bin/fonu-agent-uninstall"
|
||
if keepData {
|
||
command += " --keep-data"
|
||
}
|
||
out, err := i.SSH.Run(ctx, fmt.Sprintf("if [ -x %s ]; then %s; else echo 'agent 未安装'; fi", "'"+command+"'", command))
|
||
return strings.TrimSpace(out), err
|
||
}
|
||
|
||
// RestorePreviousConfig 在安全迁移验证失败时恢复安装前的 agent.env，并重启旧监听配置。
|
||
func (i AgentInstaller) RestorePreviousConfig(ctx context.Context) error {
|
||
command := `if [ -f /etc/fonu-agent/agent.env.previous ]; then cp /etc/fonu-agent/agent.env.previous /etc/fonu-agent/agent.env && chmod 600 /etc/fonu-agent/agent.env && systemctl restart fonu-agent; fi`
|
||
_, err := i.SSH.Run(ctx, command)
|
||
return err
|
||
}
|
||
|
||
// Diagnose agent 失联时走 SSH 急救：进程、端口、服务日志尾部。
|
||
func (i AgentInstaller) Diagnose(ctx context.Context) (string, error) {
|
||
return i.SSH.Run(ctx, "systemctl status fonu-agent --no-pager -l 2>/dev/null | head -20; echo '---'; journalctl -u fonu-agent -n 15 --no-pager 2>/dev/null; echo '---'; ss -tlnp 2>/dev/null | grep ':7700 ' || echo '7700 not listening'")
|
||
}
|
||
|
||
func extractToken(output string) string {
|
||
for _, line := range strings.Split(output, "\n") {
|
||
if token, found := strings.CutPrefix(strings.TrimSpace(line), "Token: "); found {
|
||
return strings.TrimSpace(token)
|
||
}
|
||
}
|
||
return ""
|
||
}
|
||
|
||
func agentInstallScript() ([]byte, error) {
|
||
// 与 scripts/agent-install.sh 同一份逻辑内嵌：支持传入二进制路径参数，卸载子命令。
|
||
return []byte(`#!/usr/bin/env bash
|
||
set -eu
|
||
if [ "$(id -u)" -ne 0 ]; then echo "请使用 root 或 sudo 运行" >&2; exit 1; fi
|
||
AGENT_BINARY=${1:-/tmp/fonu-agent}
|
||
PREFIX=/usr/local/bin/fonu-agent
|
||
CONF_DIR=/etc/fonu-agent
|
||
CONF_FILE="$CONF_DIR/agent.env"
|
||
UNIT=/etc/systemd/system/fonu-agent.service
|
||
|
||
if [ "${1:-}" = "--uninstall" ]; then
|
||
systemctl stop fonu-agent 2>/dev/null || true
|
||
systemctl disable fonu-agent 2>/dev/null || true
|
||
rm -f "$UNIT" "$PREFIX" /usr/local/bin/fonu-agent-uninstall
|
||
systemctl daemon-reload
|
||
if [ "${2:-}" != "--keep-data" ]; then rm -rf /var/lib/fonu-agent; fi
|
||
echo "fonu-agent 已卸载"
|
||
exit 0
|
||
fi
|
||
|
||
mkdir -p "$CONF_DIR" /var/lib/fonu-agent/certs
|
||
# 先停服务，再原子替换；安装后必须确认目标存在、可执行且能输出版本
|
||
systemctl stop fonu-agent 2>/dev/null || true
|
||
TMP_PREFIX="${PREFIX}.new"
|
||
install -m 0755 "$AGENT_BINARY" "$TMP_PREFIX"
|
||
if [ ! -x "$TMP_PREFIX" ]; then
|
||
echo "agent 二进制安装失败：$TMP_PREFIX 不存在或不可执行" >&2
|
||
exit 1
|
||
fi
|
||
AGENT_VERSION=$($TMP_PREFIX -version 2>/dev/null) || {
|
||
echo "agent 二进制无法执行：$TMP_PREFIX" >&2
|
||
rm -f "$TMP_PREFIX"
|
||
exit 1
|
||
}
|
||
mv -f "$TMP_PREFIX" "$PREFIX"
|
||
if [ ! -x "$PREFIX" ]; then
|
||
echo "agent 原子替换失败：$PREFIX 不存在或不可执行" >&2
|
||
exit 1
|
||
fi
|
||
printf 'agent version: %s\n' "$AGENT_VERSION"
|
||
if [ ! -f "$CONF_FILE" ]; then
|
||
umask 077
|
||
# 用 /dev/urandom 生成 64 位 hex token，不依赖 openssl（缺失时会静默写入空 token，导致 Fonu 无法认证 agent）
|
||
printf 'FONU_AGENT_TOKEN=%s\n' "$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')" > "$CONF_FILE"
|
||
fi
|
||
cp "$CONF_FILE" "$CONF_FILE.previous" 2>/dev/null || true
|
||
touch "$CONF_FILE"
|
||
sed -i '/^FONU_AGENT_LISTEN=/d; /^FONU_AGENT_ALLOW_REMOTE=/d' "$CONF_FILE"
|
||
printf 'FONU_AGENT_LISTEN=127.0.0.1:7700\nFONU_AGENT_ALLOW_REMOTE=0\n' >> "$CONF_FILE"
|
||
cat > "$UNIT" <<'UNIT'
|
||
[Unit]
|
||
Description=Fonu FRPS management agent
|
||
After=network-online.target nginx.service
|
||
Wants=network-online.target
|
||
|
||
[Service]
|
||
Type=simple
|
||
EnvironmentFile=/etc/fonu-agent/agent.env
|
||
ExecStart=/usr/local/bin/fonu-agent
|
||
Restart=on-failure
|
||
RestartSec=3
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
UNIT
|
||
systemctl daemon-reload
|
||
systemctl restart fonu-agent
|
||
systemctl enable fonu-agent
|
||
cp "$0" /usr/local/bin/fonu-agent-uninstall
|
||
echo "fonu-agent installed"
|
||
echo "Token: $(sed -n 's/^FONU_AGENT_TOKEN=//p' "$CONF_FILE")"
|
||
`), nil
|
||
}
|
||
|
||
// isELFBinary 判断内容是否为 Linux ELF 可执行（魔数 0x7F 'ELF'），用于拦截开发构建的占位文件。
|
||
func isELFBinary(data []byte) bool {
|
||
return len(data) > 4 && data[0] == 0x7F && data[1] == 'E' && data[2] == 'L' && data[3] == 'F'
|
||
}
|