From f6da1d2b10eaf474c11f2a8346e552fe874374c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com>
Date: Fri, 17 Jul 2026 12:34:41 +0800
Subject: [PATCH] fix: harden lighthouse gatekeeper startup

---
 .../guanghu-gatekeeper.service                        |  1 +
 .../light-lake-node-bootstrap/health-check.sh         | 11 ++++++++++-
 .../light-lake-node-bootstrap/test/bootstrap.test.js  |  4 ++++
 zero-point/core-channel/gatekeeper/engine-v3.js       |  3 ++-
 4 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/server-tools/light-lake-node-bootstrap/guanghu-gatekeeper.service b/server-tools/light-lake-node-bootstrap/guanghu-gatekeeper.service
index d1403d9..6192d29 100644
--- a/server-tools/light-lake-node-bootstrap/guanghu-gatekeeper.service
+++ b/server-tools/light-lake-node-bootstrap/guanghu-gatekeeper.service
@@ -12,6 +12,7 @@ Environment=NODE_ENV=production
 Environment=ENGINE_HOST=127.0.0.1
 Environment=ENGINE_PORT=3911
 Environment=GATEKEEPER_DATA_DIR=/var/lib/guanghu/gatekeeper
+Environment=GATEKEEPER_SECRET_PATH=/var/lib/guanghu/gatekeeper/secret
 EnvironmentFile=-/etc/guanghu/gatekeeper.env
 ExecStart=/usr/bin/node /opt/guanghu/fifth-domain/zero-point/core-channel/gatekeeper/engine-v3.js
 Restart=always
diff --git a/server-tools/light-lake-node-bootstrap/health-check.sh b/server-tools/light-lake-node-bootstrap/health-check.sh
index 2f0ce0e..3a799d7 100755
--- a/server-tools/light-lake-node-bootstrap/health-check.sh
+++ b/server-tools/light-lake-node-bootstrap/health-check.sh
@@ -4,10 +4,19 @@ set -euo pipefail
 NODE_FILE=${NODE_FILE:-/etc/guanghu/node.json}
 REPO_DIR=${REPO_DIR:-/opt/guanghu/fifth-domain}
 HEALTH_URL=${HEALTH_URL:-http://127.0.0.1:3911/health}
+HEALTH_RETRIES=${HEALTH_RETRIES:-20}
+HEALTH_RETRY_DELAY=${HEALTH_RETRY_DELAY:-1}
 
 node_id=$(jq -r '.node_id' "$NODE_FILE")
 service_state=$(systemctl is-active guanghu-gatekeeper.service)
-health=$(curl -fsS "$HEALTH_URL")
+health=
+for ((attempt = 1; attempt <= HEALTH_RETRIES; attempt++)); do
+  if health=$(curl -fsS "$HEALTH_URL" 2>/dev/null); then
+    break
+  fi
+  sleep "$HEALTH_RETRY_DELAY"
+done
+[[ -n $health ]] || { echo "Gatekeeper health endpoint unavailable after ${HEALTH_RETRIES} attempts" >&2; exit 1; }
 commit=$(git -C "$REPO_DIR" rev-parse --short HEAD)
 disk_used=$(df --output=pcent / | tail -1 | tr -d ' ')
 
diff --git a/server-tools/light-lake-node-bootstrap/test/bootstrap.test.js b/server-tools/light-lake-node-bootstrap/test/bootstrap.test.js
index ae8b2de..ed095bd 100644
--- a/server-tools/light-lake-node-bootstrap/test/bootstrap.test.js
+++ b/server-tools/light-lake-node-bootstrap/test/bootstrap.test.js
@@ -48,6 +48,9 @@ test("Gatekeeper runtime accepts explicit node identity, host and data directory
   assert.match(engine, /process\.env\.GATEKEEPER_SERVER_ID/);
   assert.match(engine, /process\.env\.ENGINE_HOST/);
   assert.match(engine, /process\.env\.GATEKEEPER_DATA_DIR/);
+  assert.match(engine, /process\.env\.GATEKEEPER_SECRET_PATH/);
+  assert.match(read("guanghu-gatekeeper.service"), /GATEKEEPER_SECRET_PATH=\/var\/lib\/guanghu\/gatekeeper\/secret/);
+  assert.doesNotMatch(engine, /API 密钥: ['"]?\s*\+\s*API_SECRET/);
 });
 
 test("rollback and health verification are part of the template", () => {
@@ -58,4 +61,5 @@ test("rollback and health verification are part of the template", () => {
   assert.match(health, /127\.0\.0\.1:3911\/health/);
   assert.match(health, /curl -fsS/);
   assert.match(health, /systemctl is-active/);
+  assert.match(health, /HEALTH_RETRIES/);
 });
diff --git a/zero-point/core-channel/gatekeeper/engine-v3.js b/zero-point/core-channel/gatekeeper/engine-v3.js
index dd3fc02..382ec84 100644
--- a/zero-point/core-channel/gatekeeper/engine-v3.js
+++ b/zero-point/core-channel/gatekeeper/engine-v3.js
@@ -45,6 +45,7 @@ const sessions = new SessionManager({ absoluteTtl: 12 * 3600, idleTtl: 3600, sta
 // 密钥 — 兼容所有历史数据目录
 // ═══════════════════════════════════════
 const SECRET_PATHS = [
+  ...(process.env.GATEKEEPER_SECRET_PATH ? [process.env.GATEKEEPER_SECRET_PATH] : []),
   path.join(os.homedir(), '.gatekeeper', 'secret'),
   path.join(os.homedir(), '.gk', 'secret'),
   path.join(os.homedir(), '.guanghu-engine', 'secret'),
@@ -61,7 +62,7 @@ if (!API_SECRET) {
   console.log('');
   console.log('══════════════════════════════════════════════');
   console.log('  🔐 光湖驱动引擎 v3 · 首次启动');
-  console.log('  API 密钥: ' + API_SECRET);
+  console.log('  API 密钥: 已生成（不写入服务日志）');
   console.log('  已保存至: ' + SECRET_PATHS[0]);
   console.log('  监听端口: ' + PORT);
   console.log('══════════════════════════════════════════════');