feat(single-node): 改 SQLite + 非特权 pangolin 用户 + 免 Docker(512MB 可跑)

为小内存机收尾单机栈,已在 racknerd(107.172.55.251)实跑验证通过:
- 数据库:MySQL(docker)→ SQLite 文件(DB_DRIVER=sqlite);Redis 改 apt 原生
  (免 Docker);依赖 redis-server/sqlite3/polkitd/sing-box 由 deploy.sh 自动装
- 运行身份:三 systemd 单元 User=root → User=pangolin;sing-box 经
  AmbientCapabilities 绑 443;新增 polkit 规则让 pangolin 仅可重启 sing-box
- 二进制:支持预置(机上无 go 时用交叉编译产物;SQLite 纯 Go 免 CGO)
- 端口:REALITY 默认 443/tcp(对齐 bootstrap 防火墙);deploy.sh 放行 8080/tcp
- 修 sing-box.service:ExecStart 按实际安装路径渲染(官方 .deb 在 /usr/bin)
- Hy2 默认关闭:控制面尚未下发 Hy2 TLS 证书(handler_grpc.go 仅发 ListenPort)
  → 开启会 missing certificate;待补全证书后传 HY2_PORT=443 开启
- 删 docker-compose.yml;seed TRUE→1;README 同步

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/single-node/systemd/pangolin-agent.service

@@ -11,8 +11,10 @@ EnvironmentFile=/etc/pangolin-agent/agent.env
 ExecStart=/usr/local/bin/pangolin-agent
 Restart=on-failure
 RestartSec=5
-# The agent calls `systemctl restart sing-box` after rendering config.
-User=root
+# The agent calls `systemctl restart sing-box` after rendering config;
+# a polkit rule (49-pangolin-singbox.rules) lets the unprivileged pangolin
+# user manage *only* sing-box.service.
+User=pangolin
 
 [Install]
 WantedBy=multi-user.target

deploy/single-node/systemd/pangolin-server.service

@@ -1,8 +1,8 @@
 [Unit]
 Description=Pangolin control plane (HTTP API + gRPC agent server)
 Documentation=https://github.com/wangjia/pangolin
-After=network-online.target docker.service
-Wants=network-online.target
+After=network-online.target redis-server.service
+Wants=network-online.target redis-server.service
 
 [Service]
 Type=simple
@@ -10,9 +10,9 @@ EnvironmentFile=/etc/pangolin/server.env
 ExecStart=/usr/local/bin/pangolin-server
 Restart=on-failure
 RestartSec=3
-# Control plane holds JWT/CA keys; keep them owner-only.
+# Control plane holds JWT/CA keys; keep them owner-only. Runs unprivileged.
 UMask=0077
-User=root
+User=pangolin
 
 [Install]
 WantedBy=multi-user.target

deploy/single-node/systemd/sing-box.service

@@ -13,9 +13,10 @@ ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
 Restart=on-failure
 RestartSec=5
 LimitNOFILE=1048576
+# 非特权运行;AmbientCapabilities 让 pangolin 也能绑 443(REALITY/Hy2)。
 AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
-User=root
+User=pangolin
 
 [Install]
 WantedBy=multi-user.target