build agent

2026-10-19 22:39:09 +02:00
1 parent a946c38194
commit a1389a6a61
@@ -104,25 +104,48 @@ if [[ -n "$MAX_GLIBC_FOUND" ]]; then
    log "glibc compatibility check: <= $MAX_GLIBC_FOUND"
 fi

+# The Go agent is packaged ONLY for Linux. A failure aborts the Linux branch
+# before either APT or RPM metadata is published; OPNsense/FreeBSD are separate.
+AGENT_SRC="$SRC/docker-agent"
+[[ -f "$AGENT_SRC/go.mod" ]] || fatal "RustProxy source is missing docker-agent/go.mod"
+AGENT_BINARY="$OUT/rustproxy-docker-agent"
+AGENT_PKG="$WORK/package-agent"
+log "Linux Docker Agent tests started"
+(cd "$AGENT_SRC" && GOWORK=off CGO_ENABLED=0 go test ./...)
+log "Linux Docker Agent build started"
+(cd "$AGENT_SRC" && GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-s -w -X main.version=$VERSION" -o "$AGENT_BINARY" .)
+[[ -x "$AGENT_BINARY" ]] || fatal "built Go agent not found: $AGENT_BINARY"
+
 /opt/rust-package-builder/scripts/prepare-package.sh "$SRC" "$PKG" "$BINARY_PATH"
+/opt/rust-package-builder/scripts/prepare-agent-package.sh "$SRC" "$AGENT_PKG" "$AGENT_BINARY"

 DEB_FILE="$OUT/${PACKAGE_NAME}_${VERSION}-${PACKAGE_RELEASE}_amd64.deb"
 RPM_FILE="$OUT/${PACKAGE_NAME}-${VERSION}-${PACKAGE_RELEASE}.x86_64.rpm"
+AGENT_DEB_FILE="$OUT/rustproxy-docker-agent_${VERSION}-${PACKAGE_RELEASE}_amd64.deb"
+AGENT_RPM_FILE="$OUT/rustproxy-docker-agent-${VERSION}-${PACKAGE_RELEASE}.x86_64.rpm"

-log "creating deb package"
+log "creating RustProxy and Docker Agent deb packages"
 nfpm package --config "$PKG/nfpm-deb.yaml" --packager deb --target "$DEB_FILE"
-log "creating rpm package"
+nfpm package --config "$AGENT_PKG/nfpm-deb.yaml" --packager deb --target "$AGENT_DEB_FILE"
+log "creating RustProxy and Docker Agent rpm packages"
 nfpm package --config "$PKG/nfpm-rpm.yaml" --packager rpm --target "$RPM_FILE"
+nfpm package --config "$AGENT_PKG/nfpm-rpm.yaml" --packager rpm --target "$AGENT_RPM_FILE"

-ar t "$DEB_FILE" | grep '^_gpgorigin$' >/dev/null || fatal "DEB package does not contain nFPM GPG origin signature"
-rpm -qpi "$RPM_FILE" | awk -F: '/^Signature/ && $0 !~ /\(none\)/ {ok=1} END{exit !ok}' || fatal "RPM package is not signed"
+for deb in "$DEB_FILE" "$AGENT_DEB_FILE"; do
+    ar t "$deb" | grep '^_gpgorigin$' >/dev/null || fatal "DEB package is not signed: $deb"
+done
+for rpm_file in "$RPM_FILE" "$AGENT_RPM_FILE"; do
+    rpm -qpi "$rpm_file" | awk -F: '/^Signature/ && $0 !~ /\(none\)/ {ok=1} END{exit !ok}' \
+        || fatal "RPM package is not signed: $rpm_file"
+done
 log "Linux package signatures verified"

-cp -f "$DEB_FILE" "$DATA_DIR/packages/deb/"
-cp -f "$RPM_FILE" "$DATA_DIR/packages/rpm/x86_64/"
+cp -f "$DEB_FILE" "$AGENT_DEB_FILE" "$DATA_DIR/packages/deb/"
+cp -f "$RPM_FILE" "$AGENT_RPM_FILE" "$DATA_DIR/packages/rpm/x86_64/"

 log "updating aptly internal repository"
-aptly -config="$APTLY_CONF" repo add -force-replace package-builder "$DEB_FILE" >/dev/null
+aptly -config="$APTLY_CONF" repo add -force-replace package-builder "$DEB_FILE" "$AGENT_DEB_FILE" >/dev/null
 SNAPSHOT="linux-${VERSION}-${SHORT_SHA}-$(date +%s)"
 aptly -config="$APTLY_CONF" snapshot create "$SNAPSHOT" from repo package-builder >/dev/null

@@ -181,6 +204,7 @@ cat > "$RELEASE_DIR/LINUX-BUILD-INFO.txt" <<INFO
 app_version=$VERSION
 package_release=$PACKAGE_RELEASE
 packaging_revision=$PACKAGING_REVISION
+linux_packages=$PACKAGE_NAME,rustproxy-docker-agent
 source_url=$SOURCE_REPO
 source_ref=$SOURCE_BRANCH
 source_commit=$SHA
@@ -10,9 +10,13 @@ linux_release_complete_for_commit() {
    [[ -d "$CURRENT" ]] || return 1
    [[ -f "$CURRENT/apt/dists/$REPO_DISTRIBUTION/InRelease" ]] || return 1
    [[ -f "$CURRENT/rpm/x86_64/repodata/repomd.xml" ]] || return 1
+    # Both standalone packages must exist in the current Linux snapshot.
+    find "$CURRENT/rpm/x86_64" -maxdepth 1 -type f -name 'rustproxy-docker-agent-*.rpm' -print -quit | grep -q . || return 1
+    find "$CURRENT/apt/pool" -type f -name 'rustproxy-docker-agent_*.deb' -print -quit | grep -q . || return 1
    # A new builder revision must repackage even when RustProxy's SHA is unchanged.
    [[ -f "$CURRENT/LINUX-BUILD-INFO.txt" ]] || return 1
    grep -Fqx "packaging_revision=$PACKAGING_REVISION" "$CURRENT/LINUX-BUILD-INFO.txt" || return 1
+    grep -Fq ',rustproxy-docker-agent' "$CURRENT/LINUX-BUILD-INFO.txt" || return 1

    if grep -Fqx "source_commit=$sha" "$CURRENT/LINUX-BUILD-INFO.txt"; then
        return 0
@@ -43,7 +43,7 @@ export GNUPGHOME=${GNUPGHOME:-/run/package-builder/gnupg}
 export CARGO_HOME="$DATA_DIR/cargo"
 export CARGO_TARGET_DIR="$DATA_DIR/cargo/target"

-for cmd in git cargo rustc rustup nfpm aptly createrepo_c gpg rsync python3 python3.11 \
+for cmd in git go cargo rustc rustup nfpm aptly createrepo_c gpg rsync python3 python3.11 \
    objdump ar rpm clang llvm-readelf llvm-ar llvm-ranlib file tar zstd bsdtar sha256sum; do
    require_cmd "$cmd"
 done
@@ -56,6 +56,7 @@ mkdir -p \
    "$DATA_DIR/repository/releases" \
    "$DATA_DIR/state" \
    "$DATA_DIR/cargo" \
+    "$DATA_DIR/go/cache" \
    "$DATA_DIR/work" \
    "$DATA_DIR/packages/rpm/x86_64" \
    "$DATA_DIR/packages/deb"
@@ -68,6 +68,21 @@ REPO
 sudo dnf install {h(package)}</code></pre>
 </div>

+<div class="card">
+<h2>Docker discovery agent — separate Linux package</h2>
+<p>Install <code>rustproxy-docker-agent</code> on the Docker host (systemd, Docker Engine, amd64/x86_64). This is independent from the RustProxy server and has no FreeBSD pkg.</p>
+<pre><code># Debian / Ubuntu (after adding the signed APT repo above)
+sudo apt install rustproxy-docker-agent
+
+# RHEL / Rocky / Alma / Fedora (after adding the DNF repo above)
+sudo dnf install rustproxy-docker-agent
+
+# Locally display the token and certificate fingerprint
+sudo rustproxy-docker-agent info --show-token
+sudo systemctl status rustproxy-docker-agent</code></pre>
+<p>Packages create persistent credentials and a systemd service; tokens are never printed to unattended package logs. Restrict the agent's HTTPS port to the RustProxy host.</p>
+</div>
+
 <div class="card">
 <h2>OPNsense / FreeBSD pkg</h2>
 <p>The OPNsense plugin is published separately because it uses the FreeBSD pkg format.</p>
@@ -2,7 +2,7 @@
 set -Eeuo pipefail

 # Increment when package payload/installation semantics change without a source commit.
-PACKAGING_REVISION=3
+PACKAGING_REVISION=4
 OPNSENSE_PACKAGING_REVISION=4
 FREEBSD_NATIVE_PACKAGING_REVISION=1

@@ -0,0 +1,192 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+BUILDER_ROOT=${BUILDER_ROOT:-/opt/rust-package-builder}
+source "$BUILDER_ROOT/scripts/lib.sh"
+
+SRC=${1:?source path required}
+PKG_AGENT=${2:?agent package workspace required}
+AGENT_BINARY=${3:?agent binary path required}
+: "${VERSION:?RustProxy source version is required}"
+: "${PACKAGE_RELEASE:?package release is required}"
+: "${GPG_PRIVATE_KEY_FILE:?GPG key path is required}"
+[[ -x "$AGENT_BINARY" ]] || fatal "Go agent binary not found: $AGENT_BINARY"
+[[ -r "$SRC/docker-agent/rustproxy-docker-agent.service" ]] || fatal 'missing Docker Agent systemd unit'
+[[ -r "$SRC/docker-agent/docker-agent.env.example" ]] || fatal 'missing Docker Agent environment template'
+
+AGENT_NAME=rustproxy-docker-agent
+rm -rf -- "$PKG_AGENT"
+mkdir -p "$PKG_AGENT/payload" "$PKG_AGENT/scripts"
+install -D -m 0755 "$AGENT_BINARY" "$PKG_AGENT/payload/usr/bin/$AGENT_NAME"
+sed 's@/usr/local/bin/rustproxy-docker-agent@/usr/bin/rustproxy-docker-agent@g' \
+    "$SRC/docker-agent/rustproxy-docker-agent.service" > "$PKG_AGENT/payload/agent.service"
+install -D -m 0644 "$PKG_AGENT/payload/agent.service" "$PKG_AGENT/payload/usr/lib/systemd/system/$AGENT_NAME.service"
+install -D -m 0600 "$SRC/docker-agent/docker-agent.env.example" "$PKG_AGENT/payload/etc/rustproxy/docker-agent.env"
+install -D -m 0644 "$SRC/docker-agent/README.md" "$PKG_AGENT/payload/usr/share/doc/$AGENT_NAME/README.md"
+
+cat > "$PKG_AGENT/scripts/deb-postinstall.sh" <<'SCRIPT'
+#!/bin/sh
+set -e
+if ! getent group rustproxy-docker-agent >/dev/null 2>&1; then
+    addgroup --system rustproxy-docker-agent >/dev/null
+fi
+if ! getent passwd rustproxy-docker-agent >/dev/null 2>&1; then
+    adduser --system --ingroup rustproxy-docker-agent --home /var/lib/rustproxy-docker-agent \
+        --no-create-home --disabled-password --shell /usr/sbin/nologin rustproxy-docker-agent >/dev/null
+fi
+if getent group docker >/dev/null 2>&1; then
+    usermod -a -G docker rustproxy-docker-agent
+fi
+install -d -o rustproxy-docker-agent -g rustproxy-docker-agent -m 0750 /var/lib/rustproxy-docker-agent
+install -d -m 0750 /etc/rustproxy
+/usr/bin/rustproxy-docker-agent init
+if command -v systemctl >/dev/null 2>&1; then
+    systemctl daemon-reload >/dev/null 2>&1 || true
+    systemctl enable rustproxy-docker-agent.service >/dev/null 2>&1 || true
+    if getent group docker >/dev/null 2>&1 && [ -S /var/run/docker.sock ]; then
+        systemctl restart rustproxy-docker-agent.service >/dev/null 2>&1 || true
+    else
+        echo 'RustProxy Docker Agent installed but not started: Docker group/socket unavailable.' >&2
+    fi
+fi
+exit 0
+SCRIPT
+
+cat > "$PKG_AGENT/scripts/rpm-postinstall.sh" <<'SCRIPT'
+#!/bin/sh
+set -e
+if ! getent group rustproxy-docker-agent >/dev/null 2>&1; then
+    groupadd --system rustproxy-docker-agent
+fi
+if ! getent passwd rustproxy-docker-agent >/dev/null 2>&1; then
+    useradd --system --gid rustproxy-docker-agent --home-dir /var/lib/rustproxy-docker-agent \
+        --no-create-home --shell /sbin/nologin rustproxy-docker-agent
+fi
+if getent group docker >/dev/null 2>&1; then
+    usermod -a -G docker rustproxy-docker-agent
+fi
+install -d -o rustproxy-docker-agent -g rustproxy-docker-agent -m 0750 /var/lib/rustproxy-docker-agent
+install -d -m 0750 /etc/rustproxy
+/usr/bin/rustproxy-docker-agent init
+if command -v systemctl >/dev/null 2>&1; then
+    systemctl daemon-reload >/dev/null 2>&1 || true
+    systemctl enable rustproxy-docker-agent.service >/dev/null 2>&1 || true
+    if getent group docker >/dev/null 2>&1 && [ -S /var/run/docker.sock ]; then
+        systemctl restart rustproxy-docker-agent.service >/dev/null 2>&1 || true
+    else
+        echo 'RustProxy Docker Agent installed but not started: Docker group/socket unavailable.' >&2
+    fi
+fi
+exit 0
+SCRIPT
+
+cat > "$PKG_AGENT/scripts/deb-preremove.sh" <<'SCRIPT'
+#!/bin/sh
+set -e
+case "${1:-}" in
+  remove|deconfigure) systemctl stop rustproxy-docker-agent.service >/dev/null 2>&1 || true ;;
+esac
+exit 0
+SCRIPT
+cat > "$PKG_AGENT/scripts/rpm-preremove.sh" <<'SCRIPT'
+#!/bin/sh
+set -e
+if [ "${1:-1}" -eq 0 ]; then
+    systemctl stop rustproxy-docker-agent.service >/dev/null 2>&1 || true
+    systemctl disable rustproxy-docker-agent.service >/dev/null 2>&1 || true
+fi
+exit 0
+SCRIPT
+for kind in deb rpm; do
+    cat > "$PKG_AGENT/scripts/$kind-postremove.sh" <<'SCRIPT'
+#!/bin/sh
+set -e
+systemctl daemon-reload >/dev/null 2>&1 || true
+exit 0
+SCRIPT
+done
+chmod 0755 "$PKG_AGENT/scripts/"*.sh
+
+AGENT_NAME_Q=$(yaml_quote "$AGENT_NAME")
+VERSION_Q=$(yaml_quote "$VERSION")
+MAINTAINER_Q=$(yaml_quote "$MAINTAINER")
+HOMEPAGE_Q=$(yaml_quote "$HOMEPAGE")
+GPG_Q=$(yaml_quote "$GPG_PRIVATE_KEY_FILE")
+
+cat > "$PKG_AGENT/contents.yaml" <<YAML
+  - src: $(yaml_quote "$PKG_AGENT/payload/usr/bin/$AGENT_NAME")
+    dst: /usr/bin/$AGENT_NAME
+    file_info:
+      mode: 0755
+  - src: $(yaml_quote "$PKG_AGENT/payload/usr/lib/systemd/system/$AGENT_NAME.service")
+    dst: /usr/lib/systemd/system/$AGENT_NAME.service
+    file_info:
+      mode: 0644
+  - src: $(yaml_quote "$PKG_AGENT/payload/etc/rustproxy/docker-agent.env")
+    dst: /etc/rustproxy/docker-agent.env
+    type: "config|noreplace"
+    file_info:
+      mode: 0600
+  - src: $(yaml_quote "$PKG_AGENT/payload/usr/share/doc/$AGENT_NAME/README.md")
+    dst: /usr/share/doc/$AGENT_NAME/README.md
+    file_info:
+      mode: 0644
+YAML
+
+cat > "$PKG_AGENT/nfpm-deb.yaml" <<YAML
+name: $AGENT_NAME_Q
+arch: amd64
+platform: linux
+version: $VERSION_Q
+release: "$PACKAGE_RELEASE"
+section: net
+priority: optional
+maintainer: $MAINTAINER_Q
+description: "RustProxy Docker discovery agent (HTTPS and bearer token)"
+license: "Proprietary"
+homepage: $HOMEPAGE_Q
+contents:
+$(cat "$PKG_AGENT/contents.yaml")
+depends:
+  - adduser
+  - ca-certificates
+  - systemd
+  - passwd
+scripts:
+  postinstall: "$PKG_AGENT/scripts/deb-postinstall.sh"
+  preremove: "$PKG_AGENT/scripts/deb-preremove.sh"
+  postremove: "$PKG_AGENT/scripts/deb-postremove.sh"
+deb:
+  compression: xz
+  signature:
+    key_file: $GPG_Q
+    type: origin
+YAML
+cat > "$PKG_AGENT/nfpm-rpm.yaml" <<YAML
+name: $AGENT_NAME_Q
+arch: amd64
+platform: linux
+version: $VERSION_Q
+release: "$PACKAGE_RELEASE"
+section: net
+priority: optional
+maintainer: $MAINTAINER_Q
+description: "RustProxy Docker discovery agent (HTTPS and bearer token)"
+license: "Proprietary"
+homepage: $HOMEPAGE_Q
+contents:
+$(cat "$PKG_AGENT/contents.yaml")
+depends:
+  - ca-certificates
+  - shadow-utils
+  - systemd
+scripts:
+  postinstall: "$PKG_AGENT/scripts/rpm-postinstall.sh"
+  preremove: "$PKG_AGENT/scripts/rpm-preremove.sh"
+  postremove: "$PKG_AGENT/scripts/rpm-postremove.sh"
+rpm:
+  compression: zstd
+  signature:
+    key_file: $GPG_Q
+YAML
+
+log "prepared signed Linux DEB/RPM metadata for $AGENT_NAME $VERSION-$PACKAGE_RELEASE"