agent-bot
2ad1ef393a
- internal/bootstrap.EnsureInstance on the serve path: normalized writable roots, symlink-aware validation, data-root vs vault containment rejection, filesystem-root refusal - instance-marker.json in data root: first boot creates; foreign instance ID fails closed (explicit adopt/migrate required, KTD18) - instance.lock non-blocking flock detects duplicate starts locally without any governance tooling; ownership held until process exit - Config.InstanceID (INSTANCE_ID env/file key; default 'default') joins the instance-settings bootstrap denylist (identity cannot be self-overwritten) - auth is Bearer+localStorage per origin (no cookies) - browser isolation holds across ports; documented in the unit template - deploy/systemd/agent-system@.service template (instance %i: env file, DATA_DIR, hardened service scope) - tests: marker create/foreign reject, vault overlap, invalid IDs, root refusal, in-process duplicate-start detection
31 lines
1.1 KiB
Desktop File
31 lines
1.1 KiB
Desktop File
# agent-system 实例单元模板（KTD16/U10c）。
|
||
# 安装：cp agent-system@.service /etc/systemd/system/ && systemctl daemon-reload
|
||
# 启动实例 alpha：systemctl start agent-system@alpha
|
||
# 约定：
|
||
# /opt/agent-system/releases/<version>/agent-system 不可变程序（多实例共享）
|
||
# /etc/agent-system/<instance>/env 实例环境文件（0600）
|
||
# /var/lib/agent-system/<instance>/ 实例数据根（DATA_DIR）
|
||
# 同一浏览器不同端口为不同 origin（Bearer token + localStorage 按源隔离）。
|
||
[Unit]
|
||
Description=Agent-System instance %i
|
||
After=network-online.target postgresql.service
|
||
Wants=network-online.target
|
||
|
||
[Service]
|
||
Type=simple
|
||
User=agent-system
|
||
Group=agent-system
|
||
EnvironmentFile=/etc/agent-system/%i/env
|
||
Environment=INSTANCE_ID=%i
|
||
Environment=DATA_DIR=/var/lib/agent-system/%i
|
||
WorkingDirectory=/var/lib/agent-system/%i
|
||
ExecStart=/opt/agent-system/current/agent-system
|
||
Restart=on-failure
|
||
RestartSec=5
|
||
NoNewPrivileges=true
|
||
ProtectSystem=strict
|
||
ReadWritePaths=/var/lib/agent-system/%i
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|