feat: 完善服务监控与下游重投

2026-08-14 17:21:29 +08:00
parent d30d9ea4d0
commit 1ef4380422
50 changed files with 1279 additions and 82 deletions
@@ -0,0 +1,30 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+const root = resolve(import.meta.dirname, '..', '..');
+const read = (relativePath) => readFileSync(resolve(root, relativePath), 'utf8');
+const installer = read('tools/security/install-security-agent.sh');
+const service = read('deploy/security/cmpp-security-agent.service');
+const action = read('deploy/security/cmpp-report-only.conf');
+const placeholder = '@CMPP_SECURITY_AGENT_BIN@';
+
+for (const [label, source] of [['systemd service', service], ['Fail2ban action', action]]) {
+  if (!source.includes(placeholder)) throw new Error(`${label} is missing the security-agent executable placeholder`);
+  if (source.includes('/opt/cmpp-platform/current/bin/cmpp-security-agent')) {
+    throw new Error(`${label} still references the removed current/bin deployment layout`);
+  }
+}
+
+if (!installer.includes('agent_binary="$APP_DIR/dist/cmpp-security-agent"')) {
+  throw new Error('installer does not bind the security agent to the built dist executable');
+}
+for (const target of ['cmpp-security-agent.service', 'cmpp-report-only.conf']) {
+  if (!installer.includes(`sed "s#${placeholder}#$agent_binary#g"`) || !installer.includes(target)) {
+    throw new Error(`installer does not render ${target} with the built security-agent executable`);
+  }
+}
+if (!installer.includes("grep -Rqs '@CMPP_SECURITY_AGENT_BIN@'")) {
+  throw new Error('installer does not fail closed when an executable placeholder remains');
+}
+
+console.log('Security deployment verified: systemd and Fail2ban use the built dist security-agent executable.');