姚章浩
910c0fcd76
build / build (push) Failing after 16s
- libraryagent：0700 目录内 0600 unix socket + SO_PEERCRED 同 uid， 固定 binary/归档/日志/项目/写入者声明，请求只能选范围与作业号 - API：POST/GET /api/v1/library/captures（入队 library.capture + 读队列状态） - worker：library.capture handler 走 socket；启动先 recover；不挂 Docker socket、 不持有来源凭据 - web：整库版本页显示真实作业状态并可发起封存（未接线/无权限给出原因） - scripts/library-agent-install.sh：构建、安装 systemd user 服务并读回权限
56 lines
2.1 KiB
Bash
Executable File
56 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install/refresh the host-side library capture agent.
|
|
#
|
|
# The agent is the only component with the Docker socket and the source
|
|
# credentials. It runs as this user (no root), listens on one 0600 unix socket and
|
|
# executes the fixed capture command with the declaration below. Containers get
|
|
# the socket path only.
|
|
set -euo pipefail
|
|
ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
|
|
UNIT_DIR="$HOME/.config/systemd/user"
|
|
SOCKET_DIR="$HOME/.local/share/knowledge-governance/agent"
|
|
mkdir -p "$UNIT_DIR" "$SOCKET_DIR"
|
|
chmod 700 "$SOCKET_DIR"
|
|
|
|
echo "=== build libraryctl + libraryagent ==="
|
|
(cd "$ROOT" && go build -o libraryctl ./cmd/libraryctl && go build -o libraryagent ./cmd/libraryagent)
|
|
|
|
echo "=== systemd user unit ==="
|
|
cat > "$UNIT_DIR/knowledge-governance-library-agent.service" <<UNIT
|
|
[Unit]
|
|
Description=Knowledge governance whole-library capture agent (host-side execution boundary)
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
WorkingDirectory=$ROOT
|
|
ExecStart=$ROOT/libraryagent \\
|
|
-socket $SOCKET_DIR/agent.sock \\
|
|
-binary $ROOT/libraryctl \\
|
|
-archive $HOME/.local/share/knowledge-governance/library \\
|
|
-journal $HOME/.local/share/knowledge-governance/freeze \\
|
|
-project weknora071full \\
|
|
-writers app
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|
|
UNIT
|
|
|
|
echo "=== enable + restart ==="
|
|
systemctl --user daemon-reload
|
|
systemctl --user enable knowledge-governance-library-agent.service >/dev/null
|
|
systemctl --user restart knowledge-governance-library-agent.service
|
|
# Keep the agent running when no login session is open (it owns no privilege
|
|
# beyond this account, but a stopped agent means the page cannot capture).
|
|
loginctl enable-linger "$(id -un)" >/dev/null 2>&1 || echo " WARN: enable-linger failed; agent stops with the last session"
|
|
|
|
echo "=== read back ==="
|
|
for _ in $(seq 1 30); do
|
|
if [ -S "$SOCKET_DIR/agent.sock" ]; then break; fi
|
|
sleep 0.2
|
|
done
|
|
[ -S "$SOCKET_DIR/agent.sock" ] || { echo "AGENT_SOCKET_MISSING"; exit 1; }
|
|
stat -c '%A %n' "$SOCKET_DIR" "$SOCKET_DIR/agent.sock"
|
|
systemctl --user is-active knowledge-governance-library-agent.service |