bingshuo/fifth-domain
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden lighthouse gatekeeper startup

Browse Source
This commit is contained in:
冰朔 2026-07-17 12:34:41 +08:00
parent 975ddbc42b
commit f6da1d2b10
4 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
server-tools/light-lake-node-bootstrap/guanghu-gatekeeper.service
View File

@ -12,6 +12,7 @@ Environment=NODE_ENV=production
Environment=ENGINE_HOST=127.0.0.1
Environment=ENGINE_PORT=3911
Environment=GATEKEEPER_DATA_DIR=/var/lib/guanghu/gatekeeper
Environment=GATEKEEPER_SECRET_PATH=/var/lib/guanghu/gatekeeper/secret
EnvironmentFile=-/etc/guanghu/gatekeeper.env
ExecStart=/usr/bin/node /opt/guanghu/fifth-domain/zero-point/core-channel/gatekeeper/engine-v3.js
Restart=always

11
server-tools/light-lake-node-bootstrap/health-check.sh
View File

@ -4,10 +4,19 @@ set -euo pipefail
NODE_FILE=${NODE_FILE:-/etc/guanghu/node.json}
REPO_DIR=${REPO_DIR:-/opt/guanghu/fifth-domain}
HEALTH_URL=${HEALTH_URL:-http://127.0.0.1:3911/health}
HEALTH_RETRIES=${HEALTH_RETRIES:-20}
HEALTH_RETRY_DELAY=${HEALTH_RETRY_DELAY:-1}
node_id=$(jq -r '.node_id' "$NODE_FILE")
service_state=$(systemctl is-active guanghu-gatekeeper.service)
health=$(curl -fsS "$HEALTH_URL")
health=
for ((attempt = 1; attempt <= HEALTH_RETRIES; attempt++)); do
if health=$(curl -fsS "$HEALTH_URL" 2>/dev/null); then
break
fi
sleep "$HEALTH_RETRY_DELAY"
done
[[ -n $health ]] || { echo "Gatekeeper health endpoint unavailable after ${HEALTH_RETRIES} attempts" >&2; exit 1; }
commit=$(git -C "$REPO_DIR" rev-parse --short HEAD)
disk_used=$(df --output=pcent / | tail -1 | tr -d ' ')

4
server-tools/light-lake-node-bootstrap/test/bootstrap.test.js vendored
View File

@ -48,6 +48,9 @@ test("Gatekeeper runtime accepts explicit node identity, host and data directory
assert.match(engine, /process\.env\.GATEKEEPER_SERVER_ID/);
assert.match(engine, /process\.env\.ENGINE_HOST/);
assert.match(engine, /process\.env\.GATEKEEPER_DATA_DIR/);
assert.match(engine, /process\.env\.GATEKEEPER_SECRET_PATH/);
assert.match(read("guanghu-gatekeeper.service"), /GATEKEEPER_SECRET_PATH=\/var\/lib\/guanghu\/gatekeeper\/secret/);
assert.doesNotMatch(engine, /API 密钥: ['"]?\s*\+\s*API_SECRET/);
});
test("rollback and health verification are part of the template", () => {
@ -58,4 +61,5 @@ test("rollback and health verification are part of the template", () => {
assert.match(health, /127\.0\.0\.1:3911\/health/);
assert.match(health, /curl -fsS/);
assert.match(health, /systemctl is-active/);
assert.match(health, /HEALTH_RETRIES/);
});

3
zero-point/core-channel/gatekeeper/engine-v3.js
View File

@ -45,6 +45,7 @@ const sessions = new SessionManager({ absoluteTtl: 12 * 3600, idleTtl: 3600, sta
// 密钥 — 兼容所有历史数据目录
// ═══════════════════════════════════════
const SECRET_PATHS = [
...(process.env.GATEKEEPER_SECRET_PATH ? [process.env.GATEKEEPER_SECRET_PATH] : []),
path.join(os.homedir(), '.gatekeeper', 'secret'),
path.join(os.homedir(), '.gk', 'secret'),
path.join(os.homedir(), '.guanghu-engine', 'secret'),
@ -61,7 +62,7 @@ if (!API_SECRET) {
console.log('');
console.log('══════════════════════════════════════════════');
console.log(' 🔐 光湖驱动引擎 v3 · 首次启动');
console.log(' API 密钥: ' + API_SECRET);
console.log(' API 密钥: 已生成（不写入服务日志）');
console.log(' 已保存至: ' + SECRET_PATHS[0]);
console.log(' 监听端口: ' + PORT);
console.log('══════════════════════════════════════════════');