platform-admin/bootstrap-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Separate Periphery runtime from configuration

Browse Source
This commit is contained in:
kaka
2026-11-04 17:28:52 +08:00
parent 873933af35
commit 9887d50f47
2 changed files with 20 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
install.sh
View File

@@ -56,7 +56,8 @@ validate_inputs() {
[[ "$core_key" =~ ^MCowBQYDK2VuAyEA[A-Za-z0-9+/]{43}=$ ]] || { fail 'Expected a single-line X25519 SPKI Core public key'; return 1; }
}
protected() {
local path=$1 parent=$1
local path=$1 parent=$1 kind=${2:-file}
[[ "$kind" == file || "$kind" == directory ]] || { fail 'Unknown installation path type'; return 1; }
[[ "$path" == /* ]] || { fail 'Absolute installation path required'; return 1; }
while [[ "$parent" != / ]]; do
[[ ! -L "$parent" ]] || { fail "Symlink in installation path: $parent"; return 1; }
@@ -66,7 +67,12 @@ protected() {
fi
parent=$(dirname -- "$parent")
done
[[ ! -e "$path" || ( -f "$path" && $(stat -c %h "$path") == 1 ) ]] || { fail "Not a regular file: $path"; return 1; }
if [[ -e "$path" ]]; then
case "$kind" in
file) [[ -f "$path" && $(stat -c %h "$path") == 1 ]] || { fail "Not a regular file: $path"; return 1; };;
directory) [[ -d "$path" ]] || { fail "Not a directory: $path"; return 1; };;
esac
fi
}
write_new() {
local target=$1 source=$2 mode=$3
@@ -192,7 +198,8 @@ main() {
local version=2.3.4
local sha=46d50313970aea59d293bbe237648f4becea74e8abc2f30f1bb62b73456fc72e
local binary=/usr/local/bin/periphery keys=/etc/komodo/keys state=/var/lib/platform-bootstrap
local config=/etc/komodo/periphery.config.toml unit=/etc/systemd/system/periphery.service item
local config=/etc/komodo/periphery.config.toml unit=/etc/systemd/system/periphery.service runtime=/var/lib/komodo item
protected "$runtime" directory
for item in "$binary" "$config" "$unit" "$keys/periphery.key" "$keys/periphery.pub" "$keys/core.pub" "$state/binding" "$state/receipt.json" "$state/lock"; do protected "$item" || return 1; done
for item in "$keys" "$state"; do
[[ ! -e "$item" ]] || (( (8#$(stat -c %a "$item") & 0077) == 0 )) || { fail "Private directory must be 0700: $item"; return 1; }
@@ -207,14 +214,14 @@ main() {
printf '%s\n%s\n%s\n%s\n' "$node_name" "$core_url" "$core_key" "$sha" > "$task_dir/binding"
printf -- '-----BEGIN PUBLIC KEY-----\n%s\n-----END PUBLIC KEY-----\n' "$core_key" > "$task_dir/core.pub"
cat > "$task_dir/config" <<EOF
root_directory = "/etc/komodo"
root_directory = "$runtime"
core_address = "$core_url"
connect_as = "$node_name"
core_public_keys = "file:/etc/komodo/keys/core.pub"
private_key = "file:/etc/komodo/keys/periphery.key"
core_public_keys = "file:$keys/core.pub"
private_key = "file:$keys/periphery.key"
server_enabled = false
EOF
cat > "$task_dir/unit" <<'EOF'
cat > "$task_dir/unit" <<EOF
[Unit]
Description=Komodo native Periphery
Wants=network-online.target
@@ -222,8 +229,9 @@ After=network-online.target
[Service]
User=root
Environment=HOME=/root
WorkingDirectory=$runtime
UMask=0077
ExecStart=/usr/local/bin/periphery --config-path /etc/komodo/periphery.config.toml
ExecStart=$binary --config-path $config
Restart=on-failure
RestartSec=5
[Install]
@@ -271,6 +279,8 @@ EOF
atomic_install "$task_dir/core.pub" "$keys/core.pub" 0600
write_new "$config" "$task_dir/config" 0600
write_new "$unit" "$task_dir/unit" 0644
protected "$runtime" directory
install -d -m 0700 "$runtime"
systemctl daemon-reload
systemctl enable periphery.service
if "$changed" || ! systemctl is-active --quiet periphery.service; then systemctl restart periphery.service; fi