v0.43.0: canonical systemd unit + publish agent binary + golden to Gitea (BUNDLE slice)

- configs/felhom-agent.service: canonical non-root unit (User=felhom-agent, sudo model); deliberately NO NoNewPrivileges (breaks sudo) and NO mount-namespacing hardening (breaks the intermediary-mount drive propagation into guests) — documented inline. - scripts/publish-agent.sh: build (optional) + PUT binary to Gitea generic + sha256 + GET round-trip. Pinned version, idempotent (delete-then-PUT). - configs/build-golden.sh: after vzdump, compute sha256 + PUT golden.tar.zst to Gitea generic (version = baked controller version). Opt-in; local auto-discovery stays fallback. - cmd/felhom-agent/main.go: version 0.42.0 -> 0.43.0. - README: process model now canonical (non-root + publish/install). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-28 08:38:01 +02:00
parent aaa276a7b9
commit 29aeaa6bb4
6 changed files with 243 additions and 5 deletions
@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# publish-agent.sh — build (optional) + publish the felhom-agent binary to Gitea as a generic package.
+#
+# Part of the BUNDLE slice: the host-bootstrap script fetches the agent binary from Gitea
+# (/api/packages/admin/generic/felhom-agent/<ver>/felhom-agent) and verifies its sha256 against the
+# hub-vouched artifact manifest before installing it. This script PUTs that binary and prints the
+# version + sha256 the operator records in the hub (Configs → "Day-0 artifacts").
+#
+# The binary is PINNED to a version (never :latest). The published path encodes the version.
+#
+# Usage:
+#   GITEA_USER=admin GITEA_TOKEN=<token> ./publish-agent.sh <version> [binary-path]
+#
+#   <version>      bare semver, e.g. 0.43.0 (MUST match the binary's `--version`)
+#   [binary-path]  path to a prebuilt felhom-agent binary. If omitted, the script builds one with
+#                  `go build -ldflags "-X main.version=<version>"` from the repo (needs a Go toolchain).
+#
+# Env:
+#   GITEA_USER / GITEA_TOKEN   Gitea credentials with package write (the build-server's admin creds).
+#                              Falls back to REGISTRY_USER / REGISTRY_TOKEN if those are unset.
+#   GITEA_BASE                 Gitea base URL (default https://gitea.dooplex.hu)
+#   GITEA_OWNER                package owner (default admin)
+#
+# Output (stdout, machine-greppable):
+#   AGENT_VERSION=<version>
+#   AGENT_SHA256=<sha256>
+set -euo pipefail
+
+GITEA_BASE="${GITEA_BASE:-https://gitea.dooplex.hu}"
+GITEA_OWNER="${GITEA_OWNER:-admin}"
+GITEA_USER="${GITEA_USER:-${REGISTRY_USER:-}}"
+GITEA_TOKEN="${GITEA_TOKEN:-${REGISTRY_TOKEN:-}}"
+
+die() { echo "[publish-agent] ERROR: $*" >&2; exit 1; }
+log() { echo "[publish-agent] $*" >&2; }
+
+VERSION="${1:-}"
+BIN="${2:-}"
+[[ -n "$VERSION" ]] || die "version required (usage: GITEA_USER=.. GITEA_TOKEN=.. $0 <version> [binary-path])"
+[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || die "version must be bare semver X.Y.Z (got '$VERSION')"
+[[ -n "$GITEA_USER" && -n "$GITEA_TOKEN" ]] || die "GITEA_USER + GITEA_TOKEN (or REGISTRY_USER/REGISTRY_TOKEN) required"
+
+# Resolve repo root from this script's location (scripts/ lives at the repo root).
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# Build the binary if no prebuilt path was given.
+CLEANUP_BIN=""
+if [[ -z "$BIN" ]]; then
+    command -v go >/dev/null || die "no binary-path given and no 'go' toolchain to build one"
+    BIN="$(mktemp -t felhom-agent.XXXXXX)"
+    CLEANUP_BIN="$BIN"
+    log "building felhom-agent $VERSION from $REPO_ROOT …"
+    ( cd "$REPO_ROOT" && CGO_ENABLED=0 go build -ldflags "-X main.version=${VERSION}" -o "$BIN" ./cmd/felhom-agent )
+fi
+[[ -f "$BIN" ]] || die "binary not found: $BIN"
+trap '[[ -n "$CLEANUP_BIN" ]] && rm -f "$CLEANUP_BIN"' EXIT
+
+# Sanity: the binary's self-reported version MUST match the publish version (catch a stale rebuild).
+BIN_VER="$("$BIN" --version 2>/dev/null | awk '{print $2}' || true)"
+if [[ -n "$BIN_VER" && "$BIN_VER" != "$VERSION" ]]; then
+    die "binary --version is '$BIN_VER' but publishing as '$VERSION' — rebuild with the right ldflags"
+fi
+
+SHA256="$(sha256sum "$BIN" | awk '{print $1}')"
+[[ -n "$SHA256" ]] || die "failed to compute sha256"
+
+URL="${GITEA_BASE}/api/packages/${GITEA_OWNER}/generic/felhom-agent/${VERSION}/felhom-agent"
+log "publishing $BIN ($(wc -c < "$BIN") bytes, sha256 ${SHA256:0:16}…) → $URL"
+
+# Generic packages reject re-upload of an existing version+file with 409/400. Delete-then-put makes
+# re-publishing a version idempotent (so a rebuild of the same version overwrites cleanly).
+code="$(curl -fsS -o /dev/null -w '%{http_code}' -u "${GITEA_USER}:${GITEA_TOKEN}" -X DELETE "$URL" 2>/dev/null || true)"
+log "pre-delete existing artifact: HTTP ${code} (404/204 expected)"
+
+code="$(curl -sS -o /dev/null -w '%{http_code}' -u "${GITEA_USER}:${GITEA_TOKEN}" -X PUT --upload-file "$BIN" "$URL")"
+[[ "$code" == "201" || "$code" == "200" ]] || die "upload failed: HTTP $code"
+log "upload OK (HTTP $code)"
+
+# GET round-trip: re-fetch and confirm the stored bytes hash to the same sha256 (proves fetchable +
+# intact end-to-end, the same path the host-install script will take).
+TMP_GET="$(mktemp -t felhom-agent-get.XXXXXX)"
+trap '[[ -n "$CLEANUP_BIN" ]] && rm -f "$CLEANUP_BIN"; rm -f "$TMP_GET"' EXIT
+curl -fsS -u "${GITEA_USER}:${GITEA_TOKEN}" -o "$TMP_GET" "$URL" || die "round-trip GET failed"
+GOT_SHA="$(sha256sum "$TMP_GET" | awk '{print $1}')"
+[[ "$GOT_SHA" == "$SHA256" ]] || die "round-trip sha256 mismatch (put $SHA256, got $GOT_SHA)"
+log "round-trip GET verified (sha256 matches)"
+
+echo "AGENT_VERSION=${VERSION}"
+echo "AGENT_SHA256=${SHA256}"
+log "DONE. Record in the hub operator UI (Configs → Day-0 artifacts): agent ${VERSION} / ${SHA256}"