jocay
245 lines
9.3 KiB
Bash
Executable File
245 lines
9.3 KiB
Bash
Executable File
#!/bin/sh
|
|
# bolt 一键安装脚本(POSIX sh,需 root; Linux 使用 systemd,macOS 使用 launchd)
|
|
#
|
|
# 用法(在目标设备上):
|
|
# 方式 A - 从 Gitea Release 下载二进制并安装:
|
|
# curl -fsSL https://git.draws.qzz.io/jocay/bolt/raw/branch/main/deploy/install.sh | sh -s -- --http 0.0.0.0:8080 --token 你的令牌
|
|
# (私有仓库下载附件需要认证:先 export BOLT_DL_TOKEN=xxx,与 --token 分开配置)
|
|
# 方式 B - 已把二进制拷到目标设备(如 scp):
|
|
# ./install.sh --binary ./bolt --http 0.0.0.0:8080 --token xxx --allow "git,docker"
|
|
#
|
|
# 选项:
|
|
# --http <addr> 监听地址,默认 127.0.0.1:8080
|
|
# --token <t> HTTP Bearer 认证令牌(监听公网时必填)
|
|
# --allow <a,b> 命令白名单
|
|
# --deny <a,b> 命令黑名单
|
|
# --timeout-ms <n> 命令默认超时(默认 30000)
|
|
# --binary <src> 二进制来源:本地路径 或 http(s) URL(默认从 Gitea Release 下载)
|
|
# --no-start 只安装不启动
|
|
# --no-enable 不设置开机自启
|
|
set -eu
|
|
|
|
HTTP_ADDR="${HTTP_ADDR:-127.0.0.1:8080}"
|
|
TOKEN="${BOLT_TOKEN:-}"
|
|
ALLOW=""
|
|
DENY=""
|
|
TIMEOUT_MS="${BOLT_TIMEOUT_MS:-30000}"
|
|
BINARY_SRC=""
|
|
NO_START=0
|
|
NO_ENABLE=0
|
|
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in
|
|
--http) HTTP_ADDR="${2:-}"; shift 2 ;;
|
|
--token) TOKEN="${2:-}"; shift 2 ;;
|
|
--allow) ALLOW="${2:-}"; shift 2 ;;
|
|
--deny) DENY="${2:-}"; shift 2 ;;
|
|
--timeout-ms) TIMEOUT_MS="${2:-}"; shift 2 ;;
|
|
--binary) BINARY_SRC="${2:-}"; shift 2 ;;
|
|
--no-start) NO_START=1; shift ;;
|
|
--no-enable) NO_ENABLE=1; shift ;;
|
|
*) echo "未知参数: $1"; echo "用法见脚本头部注释"; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
BIN_PATH=/usr/local/bin/bolt
|
|
ENV_FILE=/etc/bolt.env
|
|
UNIT_FILE=/etc/systemd/system/bolt.service
|
|
|
|
say() { printf '\033[1;32m[bolt]\033[0m %s\n' "$*"; }
|
|
die() { printf '\033[1;31m[bolt] 错误:\033[0m %s\n' "$*"; exit 1; }
|
|
|
|
[ "$(id -u)" -eq 0 ] || die "需要 root 权限"
|
|
OS=$(uname -s)
|
|
ARCH=$(uname -m)
|
|
case "$OS" in
|
|
Linux)
|
|
command -v systemctl >/dev/null 2>&1 || die "未检测到 systemd"
|
|
PLATFORM=linux
|
|
;;
|
|
Darwin)
|
|
command -v launchctl >/dev/null 2>&1 || die "未检测到 launchd"
|
|
PLATFORM=darwin
|
|
# Rosetta 下 uname 可能返回 x86_64,优先识别实际的 Apple Silicon 硬件。
|
|
if [ "$(sysctl -n hw.optional.arm64 2>/dev/null || true)" = 1 ]; then
|
|
ARCH=arm64
|
|
fi
|
|
;;
|
|
*) die "不支持的操作系统: $OS" ;;
|
|
esac
|
|
case "$ARCH" in
|
|
x86_64|amd64) ARCH=amd64 ;;
|
|
aarch64|arm64) ARCH=arm64 ;;
|
|
*) die "不支持的架构: $ARCH" ;;
|
|
esac
|
|
DL_URL="${BOLT_DL_URL:-https://git.draws.qzz.io/jocay/bolt/releases/download/${BOLT_VERSION:-v0.1.0}/bolt-$PLATFORM-$ARCH}"
|
|
say "目标平台: $PLATFORM/$ARCH"
|
|
mkdir -p /usr/local/bin
|
|
|
|
# ---------- 1. 获取二进制 ----------
|
|
if [ -n "$BINARY_SRC" ]; then
|
|
if [ -f "$BINARY_SRC" ]; then
|
|
say "使用本地二进制: $BINARY_SRC"
|
|
install -m 0755 "$BINARY_SRC" "$BIN_PATH"
|
|
elif echo "$BINARY_SRC" | grep -q '^https\?://'; then
|
|
say "下载二进制: $BINARY_SRC"
|
|
rm -f /tmp/bolt-dl.$$
|
|
if command -v curl >/dev/null 2>&1; then
|
|
if [ -n "${BOLT_DL_TOKEN:-}" ]; then
|
|
curl -fsSL --retry 3 -H "Authorization:token ${BOLT_DL_TOKEN:-}" -o /tmp/bolt-dl.$$ "$BINARY_SRC" || die "下载失败"
|
|
else
|
|
curl -fsSL --retry 3 -o /tmp/bolt-dl.$$ "$BINARY_SRC" || die "下载失败"
|
|
fi
|
|
elif command -v wget >/dev/null 2>&1; then
|
|
wget -qO /tmp/bolt-dl.$$ "$BINARY_SRC" || die "下载失败"
|
|
else
|
|
die "需要 curl 或 wget"
|
|
fi
|
|
install -m 0755 /tmp/bolt-dl.$$ "$BIN_PATH" && rm -f /tmp/bolt-dl.$$
|
|
else
|
|
die "二进制来源不存在: $BINARY_SRC"
|
|
fi
|
|
else
|
|
say "从 Release 下载: $DL_URL"
|
|
rm -f /tmp/bolt-dl.$$
|
|
if command -v curl >/dev/null 2>&1; then
|
|
if [ -n "${BOLT_DL_TOKEN:-}" ]; then
|
|
curl -fsSL --retry 3 -H "Authorization:token ${BOLT_DL_TOKEN:-}" -o /tmp/bolt-dl.$$ "$DL_URL" || die "下载失败,请确认 Release 附件存在且 BOLT_DL_TOKEN 有效"
|
|
else
|
|
curl -fsSL --retry 3 -o /tmp/bolt-dl.$$ "$DL_URL" || die "下载失败,请确认 Release 附件存在;私有仓库需设置 BOLT_DL_TOKEN"
|
|
fi
|
|
elif command -v wget >/dev/null 2>&1; then
|
|
wget -qO /tmp/bolt-dl.$$ "$DL_URL" || die "下载失败"
|
|
else
|
|
die "需要 curl 或 wget"
|
|
fi
|
|
install -m 0755 /tmp/bolt-dl.$$ "$BIN_PATH" && rm -f /tmp/bolt-dl.$$
|
|
fi
|
|
"$BIN_PATH" --help >/dev/null 2>&1 || die "二进制不可执行: $BIN_PATH"
|
|
say "二进制就绪: $BIN_PATH ($("$BIN_PATH" --help | head -1))"
|
|
|
|
# macOS 将环境配置直接写入 plist,不通过 shell 解释令牌或命令规则。
|
|
if [ "$OS" = Darwin ]; then
|
|
LABEL=io.jocay.bolt
|
|
PLIST_DIR="/Library/Application Support/bolt"
|
|
PLIST_FILE="$PLIST_DIR/$LABEL.plist"
|
|
AUTO_PLIST="/Library/LaunchDaemons/$LABEL.plist"
|
|
xml_escape() {
|
|
printf '%s' "$1" | sed 's/&/\&/g; s/</\</g; s/>/\>/g; s/"/\"/g; s/'"'"'/\'/g'
|
|
}
|
|
mkdir -p "$PLIST_DIR" /Library/LaunchDaemons /var/log/bolt
|
|
chmod 700 "$PLIST_DIR" /var/log/bolt
|
|
# 令牌所在配置仅供 root 读取。
|
|
umask 077
|
|
say "写入 launchd 配置: $PLIST_FILE"
|
|
cat > "$PLIST_FILE" <<PLISTEOF
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>Label</key><string>$LABEL</string>
|
|
<key>ProgramArguments</key>
|
|
<array>
|
|
<string>$BIN_PATH</string>
|
|
<string>--http</string><string>$(xml_escape "$HTTP_ADDR")</string>
|
|
</array>
|
|
<key>EnvironmentVariables</key>
|
|
<dict>
|
|
<key>PATH</key><string>/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
|
|
<key>BOLT_TOKEN</key><string>$(xml_escape "$TOKEN")</string>
|
|
<key>BOLT_ALLOW</key><string>$(xml_escape "$ALLOW")</string>
|
|
<key>BOLT_DENY</key><string>$(xml_escape "$DENY")</string>
|
|
<key>BOLT_TIMEOUT_MS</key><string>$(xml_escape "$TIMEOUT_MS")</string>
|
|
</dict>
|
|
<key>WorkingDirectory</key><string>/var/root</string>
|
|
<key>RunAtLoad</key><true/>
|
|
<key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>
|
|
<key>ThrottleInterval</key><integer>2</integer>
|
|
<key>ExitTimeOut</key><integer>10</integer>
|
|
<key>StandardOutPath</key><string>/var/log/bolt/stdout.log</string>
|
|
<key>StandardErrorPath</key><string>/var/log/bolt/stderr.log</string>
|
|
</dict>
|
|
</plist>
|
|
PLISTEOF
|
|
chown root:wheel "$PLIST_FILE"
|
|
chmod 600 "$PLIST_FILE"
|
|
if [ "$NO_ENABLE" -eq 0 ]; then
|
|
cp "$PLIST_FILE" "$AUTO_PLIST"
|
|
chown root:wheel "$AUTO_PLIST"
|
|
chmod 600 "$AUTO_PLIST"
|
|
say "已设置开机自启"
|
|
else
|
|
# 仅移除本脚本管理的开机配置,保留手动启动配置。
|
|
rm -f "$AUTO_PLIST"
|
|
fi
|
|
launchctl enable "system/$LABEL"
|
|
if launchctl print "system/$LABEL" >/dev/null 2>&1; then
|
|
launchctl bootout "system/$LABEL"
|
|
fi
|
|
if [ "$NO_START" -eq 0 ]; then
|
|
launchctl bootstrap system "$PLIST_FILE" || die "服务注册失败"
|
|
say "已提交服务启动: http://$HTTP_ADDR/mcp"
|
|
else
|
|
say "已安装(未启动),执行: sudo launchctl bootstrap system '$PLIST_FILE'"
|
|
fi
|
|
say "管理: sudo launchctl print system/$LABEL | sudo launchctl kickstart -k system/$LABEL"
|
|
say "日志: /var/log/bolt/stdout.log 与 /var/log/bolt/stderr.log"
|
|
exit 0
|
|
fi
|
|
|
|
# ---------- 2. 写入环境配置 ----------
|
|
say "写入配置: $ENV_FILE"
|
|
printf '# bolt 服务配置,修改后 systemctl restart bolt\n' > "$ENV_FILE"
|
|
printf 'BOLT_TIMEOUT_MS=%s\n' "$TIMEOUT_MS" >> "$ENV_FILE"
|
|
if [ -n "$TOKEN" ]; then
|
|
printf 'BOLT_TOKEN=%s\n' "$TOKEN" >> "$ENV_FILE"
|
|
fi
|
|
if [ -n "$ALLOW" ]; then
|
|
printf 'BOLT_ALLOW=%s\n' "$ALLOW" >> "$ENV_FILE"
|
|
fi
|
|
if [ -n "$DENY" ]; then
|
|
printf 'BOLT_DENY=%s\n' "$DENY" >> "$ENV_FILE"
|
|
fi
|
|
[ -z "$TOKEN" ] && [ -z "$ALLOW" ] && [ -z "$DENY" ] && \
|
|
printf '# 默认无认证无白名单;监听公网时请设置 BOLT_TOKEN 与 BOLT_ALLOW\n' >> "$ENV_FILE"
|
|
|
|
# ---------- 3. 写入 systemd 单元 ----------
|
|
say "写入服务单元: $UNIT_FILE"
|
|
cat > "$UNIT_FILE" <<UNITEOF
|
|
[Unit]
|
|
Description=bolt - 极速单文件 MCP 命令执行服务器
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=$BIN_PATH --http $HTTP_ADDR
|
|
EnvironmentFile=-$ENV_FILE
|
|
Restart=on-failure
|
|
RestartSec=2
|
|
TimeoutStopSec=10
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=bolt
|
|
LimitNOFILE=65536
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
UNITEOF
|
|
|
|
# ---------- 4. 注册并启动 ----------
|
|
systemctl daemon-reload
|
|
if [ "$NO_ENABLE" -eq 0 ]; then
|
|
systemctl enable bolt >/dev/null 2>&1 && say "已设置开机自启"
|
|
fi
|
|
if [ "$NO_START" -eq 0 ]; then
|
|
systemctl restart bolt
|
|
sleep 1
|
|
systemctl is-active bolt >/dev/null 2>&1 || { systemctl status bolt --no-pager -l | tail -15; die "服务启动失败"; }
|
|
say "服务运行中: http://$HTTP_ADDR/mcp $(systemctl show -p MainPID --value bolt)"
|
|
[ -z "$TOKEN" ] || say "已启用 Bearer 认证"
|
|
else
|
|
say "已安装(未启动),执行 systemctl start bolt 启动"
|
|
fi
|
|
say "完成!管理: systemctl status bolt | journalctl -u bolt -f | systemctl restart bolt"
|