Files
pangolin/server/internal/pb/agentv1/service.go
T
wangjia f03d2dc8a6 feat(agent): node agent — enroll/mTLS, heartbeat, command stream, sing-box 用户表 (tsk__R8M4jEw43JR)
与控制面同仓同 go.mod,新增节点 agent 实现:

- proto/agent/v1/agent.proto + internal/pb/agentv1:冻结的控制面↔agent gRPC 契约
  (Enroll/Register/Heartbeat/Subscribe/Ack/ReportUsage)。仓库尚无 protoc 流水线,
  暂以手写 Go 类型 + JSON gRPC codec 实现,与 proto 1:1 对应,待 protoc 接入即可替换。
- internal/agentd:
  - enroll.go:首启生成 EC 密钥+CSR,持 bootstrap token 调 Enroll 换 90d 节点证书
    (CN=node_uuid),落 /etc/pangolin-agent/,此后 mTLS。
  - conn.go(agent.go)+creds.go:mTLS 主动拨号 + 指数退避重连;重连携带 last_command_id;
    Register 取 ConfigSnapshot 全量配置覆盖本地。
  - heartbeat.go:30s 上报 peer/带宽/CPU + config_version;need_full_resync→全量同步。
  - command.go:消费 Subscribe,Upsert/Revoke/Rotate/ApplyConfig/Lifecycle 幂等处理后
    Ack(at-least-once,按 command_id 去重)。
  - singbox.go+render.go:内存用户表 + 落盘 state.json(仅 dp_uuid+expires_at);任何变更
    渲染完整 sing-box 配置(REALITY users[uuid,flow] + Hy2 users[派生口令])→ 500ms 去抖
    合并 → systemd 重启。
  - ttl.go:凭证 TTL 定时移除并上报。
  - usage.go:按 dp_uuid 聚合上报,绝无 user_id/email/目的地址。
  - derive.go:Hy2 口令 = HMAC-SHA256(key, dp_uuid),与控制面同源派生。
- cmd/agent:入口(flag/env 配置)。
- infra/cloud-init/{node.yaml.tmpl,install-node.sh,README.md}:一段式安装,下载锁定版本
  二进制并校验 SHA-256,systemd 拉管,首启即 Enroll/Register。shellcheck -S warning 通过。

测试(bufconn mock 控制面,无需 docker):Enroll→Register→Heartbeat 全流转;Upsert/Revoke
渲染正确;Rotate 宽限期新旧并存到点移除;TTL 自动移除并上报;断流重连 last_command_id
续发不丢不重;need_full_resync 触发重注册;state.json 恢复;去抖合并;扫描确认无身份字段。
go test -race ./internal/agentd/... ./internal/pb/... 通过;go vet ./... 通过。

落实 doc/04 §2 节点无状态化与 doc/06 §3 数据面红线(节点仅见 dp_uuid)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-13 12:26:58 +08:00

239 lines
8.8 KiB
Go

package agentv1
import (
"context"
"google.golang.org/grpc"
)
// ServiceName is the fully-qualified gRPC service name. It MUST match the value
// the mTLS interceptor whitelists for Enroll (server/internal/mtls/identity.go).
const ServiceName = "pangolin.agent.v1.AgentService"
// Fully-qualified method names.
const (
MethodEnroll = "/" + ServiceName + "/Enroll"
MethodRegister = "/" + ServiceName + "/Register"
MethodHeartbeat = "/" + ServiceName + "/Heartbeat"
MethodSubscribe = "/" + ServiceName + "/Subscribe"
MethodAck = "/" + ServiceName + "/Ack"
MethodReportUsage = "/" + ServiceName + "/ReportUsage"
)
// withCodec forces the JSON content-subtype on every call so the contract does
// not depend on the caller remembering to set dial-level call options.
func withCodec(opts []grpc.CallOption) []grpc.CallOption {
return append([]grpc.CallOption{grpc.CallContentSubtype(CodecName)}, opts...)
}
// ─── server interface ──────────────────────────────────────────────────────────
// AgentServiceServer is implemented by the control plane.
type AgentServiceServer interface {
Enroll(context.Context, *EnrollRequest) (*EnrollResponse, error)
Register(context.Context, *RegisterRequest) (*ConfigSnapshot, error)
Heartbeat(context.Context, *HeartbeatRequest) (*HeartbeatResponse, error)
Subscribe(*SubscribeRequest, AgentService_SubscribeServer) error
Ack(context.Context, *AckRequest) (*AckResponse, error)
ReportUsage(context.Context, *UsageReport) (*UsageAck, error)
}
// AgentService_SubscribeServer is the server side of the Command stream.
type AgentService_SubscribeServer interface {
Send(*Command) error
grpc.ServerStream
}
type subscribeServer struct{ grpc.ServerStream }
func (s *subscribeServer) Send(m *Command) error { return s.ServerStream.SendMsg(m) }
// RegisterAgentServiceServer wires srv into a gRPC server (or any ServiceRegistrar).
func RegisterAgentServiceServer(s grpc.ServiceRegistrar, srv AgentServiceServer) {
s.RegisterService(&serviceDesc, srv)
}
func handlerEnroll(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
in := new(EnrollRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(AgentServiceServer).Enroll(ctx, in)
}
info := &grpc.UnaryServerInfo{Server: srv, FullMethod: MethodEnroll}
return interceptor(ctx, in, info, func(ctx context.Context, req any) (any, error) {
return srv.(AgentServiceServer).Enroll(ctx, req.(*EnrollRequest))
})
}
func handlerRegister(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
in := new(RegisterRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(AgentServiceServer).Register(ctx, in)
}
info := &grpc.UnaryServerInfo{Server: srv, FullMethod: MethodRegister}
return interceptor(ctx, in, info, func(ctx context.Context, req any) (any, error) {
return srv.(AgentServiceServer).Register(ctx, req.(*RegisterRequest))
})
}
func handlerHeartbeat(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
in := new(HeartbeatRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(AgentServiceServer).Heartbeat(ctx, in)
}
info := &grpc.UnaryServerInfo{Server: srv, FullMethod: MethodHeartbeat}
return interceptor(ctx, in, info, func(ctx context.Context, req any) (any, error) {
return srv.(AgentServiceServer).Heartbeat(ctx, req.(*HeartbeatRequest))
})
}
func handlerAck(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
in := new(AckRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(AgentServiceServer).Ack(ctx, in)
}
info := &grpc.UnaryServerInfo{Server: srv, FullMethod: MethodAck}
return interceptor(ctx, in, info, func(ctx context.Context, req any) (any, error) {
return srv.(AgentServiceServer).Ack(ctx, req.(*AckRequest))
})
}
func handlerReportUsage(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
in := new(UsageReport)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(AgentServiceServer).ReportUsage(ctx, in)
}
info := &grpc.UnaryServerInfo{Server: srv, FullMethod: MethodReportUsage}
return interceptor(ctx, in, info, func(ctx context.Context, req any) (any, error) {
return srv.(AgentServiceServer).ReportUsage(ctx, req.(*UsageReport))
})
}
func handlerSubscribe(srv any, stream grpc.ServerStream) error {
m := new(SubscribeRequest)
if err := stream.RecvMsg(m); err != nil {
return err
}
return srv.(AgentServiceServer).Subscribe(m, &subscribeServer{stream})
}
var serviceDesc = grpc.ServiceDesc{
ServiceName: ServiceName,
HandlerType: (*AgentServiceServer)(nil),
Methods: []grpc.MethodDesc{
{MethodName: "Enroll", Handler: handlerEnroll},
{MethodName: "Register", Handler: handlerRegister},
{MethodName: "Heartbeat", Handler: handlerHeartbeat},
{MethodName: "Ack", Handler: handlerAck},
{MethodName: "ReportUsage", Handler: handlerReportUsage},
},
Streams: []grpc.StreamDesc{
{StreamName: "Subscribe", Handler: handlerSubscribe, ServerStreams: true},
},
Metadata: "proto/agent/v1/agent.proto",
}
// ─── client ─────────────────────────────────────────────────────────────────────
// AgentServiceClient is consumed by the node agent.
type AgentServiceClient interface {
Enroll(ctx context.Context, in *EnrollRequest, opts ...grpc.CallOption) (*EnrollResponse, error)
Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*ConfigSnapshot, error)
Heartbeat(ctx context.Context, in *HeartbeatRequest, opts ...grpc.CallOption) (*HeartbeatResponse, error)
Subscribe(ctx context.Context, in *SubscribeRequest, opts ...grpc.CallOption) (AgentService_SubscribeClient, error)
Ack(ctx context.Context, in *AckRequest, opts ...grpc.CallOption) (*AckResponse, error)
ReportUsage(ctx context.Context, in *UsageReport, opts ...grpc.CallOption) (*UsageAck, error)
}
// AgentService_SubscribeClient is the client side of the Command stream.
type AgentService_SubscribeClient interface {
Recv() (*Command, error)
grpc.ClientStream
}
type subscribeClient struct{ grpc.ClientStream }
func (c *subscribeClient) Recv() (*Command, error) {
m := new(Command)
if err := c.ClientStream.RecvMsg(m); err != nil {
return nil, err
}
return m, nil
}
type agentServiceClient struct{ cc grpc.ClientConnInterface }
// NewAgentServiceClient returns a client bound to cc. All calls use the JSON codec.
func NewAgentServiceClient(cc grpc.ClientConnInterface) AgentServiceClient {
return &agentServiceClient{cc}
}
func (c *agentServiceClient) Enroll(ctx context.Context, in *EnrollRequest, opts ...grpc.CallOption) (*EnrollResponse, error) {
out := new(EnrollResponse)
if err := c.cc.Invoke(ctx, MethodEnroll, in, out, withCodec(opts)...); err != nil {
return nil, err
}
return out, nil
}
func (c *agentServiceClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*ConfigSnapshot, error) {
out := new(ConfigSnapshot)
if err := c.cc.Invoke(ctx, MethodRegister, in, out, withCodec(opts)...); err != nil {
return nil, err
}
return out, nil
}
func (c *agentServiceClient) Heartbeat(ctx context.Context, in *HeartbeatRequest, opts ...grpc.CallOption) (*HeartbeatResponse, error) {
out := new(HeartbeatResponse)
if err := c.cc.Invoke(ctx, MethodHeartbeat, in, out, withCodec(opts)...); err != nil {
return nil, err
}
return out, nil
}
func (c *agentServiceClient) Ack(ctx context.Context, in *AckRequest, opts ...grpc.CallOption) (*AckResponse, error) {
out := new(AckResponse)
if err := c.cc.Invoke(ctx, MethodAck, in, out, withCodec(opts)...); err != nil {
return nil, err
}
return out, nil
}
func (c *agentServiceClient) ReportUsage(ctx context.Context, in *UsageReport, opts ...grpc.CallOption) (*UsageAck, error) {
out := new(UsageAck)
if err := c.cc.Invoke(ctx, MethodReportUsage, in, out, withCodec(opts)...); err != nil {
return nil, err
}
return out, nil
}
func (c *agentServiceClient) Subscribe(ctx context.Context, in *SubscribeRequest, opts ...grpc.CallOption) (AgentService_SubscribeClient, error) {
stream, err := c.cc.NewStream(ctx, &serviceDesc.Streams[0], MethodSubscribe, withCodec(opts)...)
if err != nil {
return nil, err
}
x := &subscribeClient{stream}
if err := x.ClientStream.SendMsg(in); err != nil {
return nil, err
}
if err := x.ClientStream.CloseSend(); err != nil {
return nil, err
}
return x, nil
}