Separate Periphery runtime from configuration

README.md

@@ -26,6 +26,7 @@ curl -fsSL 'https://scripts.example.com/releases/<40位小写Git提交>/install.
 脚本通过 apt 补齐 curl、jq、git、CA，配置 systemd，复用或生成节点身份，输出公开回执。
 --check 做本地输入/身份检查，使用临时文件但不安装软件或修改主机配置；它不证明网络或 Core 状态。
 回执在 /var/lib/platform-bootstrap/receipt.json，明确标记 Core 注册未验证、主机初始化未开始。
+配置和身份在 `/etc/komodo/`，Periphery 的 Repo/Stack 工作目录在 `/var/lib/komodo/`。安装器的临时密钥材料使用受限临时目录并在退出时清除，服务日志交给 systemd journal。配置不符时停止，不自动迁移目录或创建兼容链接。
 Docker、Headscale、公钥注入和安全配置后续由 Komodo 任务处理。没有 Core API 凭据下发。
 已有身份、配置或二进制不符时停止，不自动替换身份。源文件可直接 bash install.sh --help。
 
@@ -76,7 +77,7 @@ resume/verify 可使用同一固定版本 URL 再次下载执行，或保存该
 ## 发布
 
 Caddy 同时提供 /install.sh 稳定入口与 /releases/<40位小写Git提交>/install.sh 固定版本入口；生产接入命令固定使用后者。
-发布脚本只提取 `install.sh`、`upgrade-debian12-13.sh`、`host-init.sh`、`host-baseline.sh`、`ssh-access.sh`、`tailscale.sh`、`firewall.sh`、README、artifacts.lock 及清单列出的 vendor 文件，生成 VERSION、SHA256SUMS；不暴露 .git 或工作区其他文件。新入口按提交中是否存在纳入清单，历史不可变 release 仍可核验。
+发布脚本只提取 `install.sh`、`upgrade-debian12-13.sh`、`host-init.sh`、`host-baseline.sh`、`ssh-access.sh`、`tailscale.sh`、`firewall.sh`、README、artifacts.lock 及清单列出的 vendor 文件，生成 VERSION、SHA256SUMS；不暴露 .git 或工作区其他文件。上述入口全部必需，缺少任一文件就拒绝发布，不兼容缺少基线或防火墙入口的不完整文件集。
 源代码与修复就在此仓库维护，无生成器、内嵌 Python 或第二份安装源码。
 
 ## 固定资源

install.sh

@@ -56,7 +56,8 @@ validate_inputs() {
   [[ "$core_key" =~ ^MCowBQYDK2VuAyEA[A-Za-z0-9+/]{43}=$ ]] || { fail 'Expected a single-line X25519 SPKI Core public key'; return 1; }
 }
 protected() {
-  local path=$1 parent=$1
+  local path=$1 parent=$1 kind=${2:-file}
+  [[ "$kind" == file || "$kind" == directory ]] || { fail 'Unknown installation path type'; return 1; }
   [[ "$path" == /* ]] || { fail 'Absolute installation path required'; return 1; }
   while [[ "$parent" != / ]]; do
     [[ ! -L "$parent" ]] || { fail "Symlink in installation path: $parent"; return 1; }
@@ -66,7 +67,12 @@ protected() {
     fi
     parent=$(dirname -- "$parent")
   done
-  [[ ! -e "$path" || ( -f "$path" && $(stat -c %h "$path") == 1 ) ]] || { fail "Not a regular file: $path"; return 1; }
+  if [[ -e "$path" ]]; then
+    case "$kind" in
+      file) [[ -f "$path" && $(stat -c %h "$path") == 1 ]] || { fail "Not a regular file: $path"; return 1; };;
+      directory) [[ -d "$path" ]] || { fail "Not a directory: $path"; return 1; };;
+    esac
+  fi
 }
 write_new() {
   local target=$1 source=$2 mode=$3
@@ -192,7 +198,8 @@ main() {
   local version=2.3.4
   local sha=46d50313970aea59d293bbe237648f4becea74e8abc2f30f1bb62b73456fc72e
   local binary=/usr/local/bin/periphery keys=/etc/komodo/keys state=/var/lib/platform-bootstrap
-  local config=/etc/komodo/periphery.config.toml unit=/etc/systemd/system/periphery.service item
+  local config=/etc/komodo/periphery.config.toml unit=/etc/systemd/system/periphery.service runtime=/var/lib/komodo item
+  protected "$runtime" directory
   for item in "$binary" "$config" "$unit" "$keys/periphery.key" "$keys/periphery.pub" "$keys/core.pub" "$state/binding" "$state/receipt.json" "$state/lock"; do protected "$item" || return 1; done
   for item in "$keys" "$state"; do
     [[ ! -e "$item" ]] || (( (8#$(stat -c %a "$item") & 0077) == 0 )) || { fail "Private directory must be 0700: $item"; return 1; }
@@ -207,14 +214,14 @@ main() {
   printf '%s\n%s\n%s\n%s\n' "$node_name" "$core_url" "$core_key" "$sha" > "$task_dir/binding"
   printf -- '-----BEGIN PUBLIC KEY-----\n%s\n-----END PUBLIC KEY-----\n' "$core_key" > "$task_dir/core.pub"
   cat > "$task_dir/config" <<EOF
-root_directory = "/etc/komodo"
+root_directory = "$runtime"
 core_address = "$core_url"
 connect_as = "$node_name"
-core_public_keys = "file:/etc/komodo/keys/core.pub"
-private_key = "file:/etc/komodo/keys/periphery.key"
+core_public_keys = "file:$keys/core.pub"
+private_key = "file:$keys/periphery.key"
 server_enabled = false
 EOF
-  cat > "$task_dir/unit" <<'EOF'
+  cat > "$task_dir/unit" <<EOF
 [Unit]
 Description=Komodo native Periphery
 Wants=network-online.target
@@ -222,8 +229,9 @@ After=network-online.target
 [Service]
 User=root
 Environment=HOME=/root
+WorkingDirectory=$runtime
 UMask=0077
-ExecStart=/usr/local/bin/periphery --config-path /etc/komodo/periphery.config.toml
+ExecStart=$binary --config-path $config
 Restart=on-failure
 RestartSec=5
 [Install]
@@ -271,6 +279,8 @@ EOF
   atomic_install "$task_dir/core.pub" "$keys/core.pub" 0600
   write_new "$config" "$task_dir/config" 0600
   write_new "$unit" "$task_dir/unit" 0644
+  protected "$runtime" directory
+  install -d -m 0700 "$runtime"
   systemctl daemon-reload
   systemctl enable periphery.service
   if "$changed" || ! systemctl is-active --quiet periphery.service; then systemctl restart periphery.service; fi