@forgezero/agent 0.1.86 → 0.1.87

package/dist/fz.js

@@ -4827,9 +4827,13 @@ import { hostname } from "os";
 
 // src/agent-update.ts
 var DEFAULT_AGENT_RELEASE_ROOT = "/opt/forgezero/agent";
+var DEFAULT_AGENT_CANDIDATE_LINK = `${DEFAULT_AGENT_RELEASE_ROOT}/candidate`;
 var DEFAULT_AGENT_UPDATE_SOCKET = "/run/forgezero-update/helper.sock";
 var MAX_AGENT_TARBALL_BYTES = 32 * 1024 * 1024;
 
+// src/agent-handover.ts
+var DEFAULT_AGENT_CANDIDATE_READY_SOCKET = "/run/forgezero/candidate-ready.sock";
+
 // src/agent-update-helper.ts
 var AGENT_UPDATE_GROUP = "forgezero-update";
 var AGENT_UPDATE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-agent-update-helper.service";
@@ -4838,7 +4842,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.86";
+var VERSION2 = "0.1.87";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -5455,6 +5459,7 @@ var LIFECYCLE_GROUP = "forgezero-lifecycle";
 var DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
 var AGENT_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-agent.socket";
 var AGENT_SOCKET_PROXY_UNIT_PATH = "/etc/systemd/system/forgezero-agent-proxy.service";
+var AGENT_CANDIDATE_UNIT_PATH = "/etc/systemd/system/forgezero-agent-candidate.service";
 var DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
 var ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
 var LIFECYCLE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-lifecycle-helper.service";
@@ -5566,6 +5571,7 @@ Type=simple
 User=root
 Group=${AGENT_UPDATE_GROUP}
 Environment=FZ_AGENT_UPDATE_SOCKET=${DEFAULT_AGENT_UPDATE_SOCKET}
+Environment=FZ_AGENT_PUBLIC_SOCKET=${systemdPath(options.socketPath, "agent socket")}
 ExecStart=${bin} update-helper
 Restart=always
 RestartSec=2
@@ -5610,13 +5616,11 @@ WantedBy=sockets.target
 `;
 }
 function agentSocketProxyUnit(options) {
-  const backend = agentBackendSocketPath(options.socketPath);
+  const backend = agentRoutingSocketPath(options.socketPath);
   const user = options.user ?? "forgezero";
   return `[Unit]
 Description=ForgeZero application Vault socket proxy
 Documentation=https://www.forgezero.net/docs/agent
-Requires=forgezero-agent.service
-After=forgezero-agent.service
 
 [Service]
 User=${user}
@@ -5637,12 +5641,26 @@ RestrictAddressFamilies=AF_UNIX
 `;
 }
 function agentBackendSocketPath(publicSocketPath) {
+  const socket = systemdPath(publicSocketPath, "agent socket");
+  const backend = `${socket}.backend.active`;
+  if (Buffer.byteLength(backend) > 100)
+    throw new Error("agent socket path is too long for a Unix socket");
+  return backend;
+}
+function agentRoutingSocketPath(publicSocketPath) {
   const socket = systemdPath(publicSocketPath, "agent socket");
   const backend = `${socket}.backend`;
   if (Buffer.byteLength(backend) > 100)
     throw new Error("agent socket path is too long for a Unix socket");
   return backend;
 }
+function agentCandidateSocketPath(publicSocketPath) {
+  const socket = systemdPath(publicSocketPath, "agent socket");
+  const backend = `${socket}.backend.candidate`;
+  if (Buffer.byteLength(backend) > 100)
+    throw new Error("agent socket path is too long for a Unix socket");
+  return backend;
+}
 var systemdPath = (value, label) => {
   if (!value || !/^\/[A-Za-z0-9._@/-]+$/.test(value))
     throw new Error(`invalid ${label} path`);
@@ -5926,7 +5944,11 @@ function agentUnit(options) {
   }
   const environment = [
     "NODE_ENV=production",
-    `FZ_SOCKET_PATH=${agentBackendSocketPath(options.socketPath)}`,
+    `FZ_SOCKET_PATH=${options.backendSocketPath ?? agentBackendSocketPath(options.socketPath)}`,
+    `FZ_AGENT_PUBLIC_SOCKET=${options.socketPath}`,
+    `FZ_AGENT_ROUTE_SOCKET=${agentRoutingSocketPath(options.socketPath)}`,
+    options.handoverCandidate ? "FZ_AGENT_HANDOVER_CANDIDATE=true" : null,
+    options.handoverCandidate ? `FZ_AGENT_HANDOVER_READY_SOCKET=${DEFAULT_AGENT_CANDIDATE_READY_SOCKET}` : null,
     `FZ_CONTROL_SOCKET=${controlSocketPath}`,
     `FZ_SEED_CREDENTIAL=agent-seed`,
     `FZ_AGENT_MODE=${options.mode}`,
@@ -6063,6 +6085,26 @@ ${deploymentWrites}
 WantedBy=multi-user.target
 `;
 }
+function agentCandidateUnit(options) {
+  return agentUnit({
+    ...options,
+    binPath: `${DEFAULT_AGENT_RELEASE_ROOT}/candidate/dist/fz-agent.js`,
+    backendSocketPath: agentCandidateSocketPath(options.socketPath),
+    handoverCandidate: true,
+    gitCredentialPath: undefined,
+    deploymentCredentials: {},
+    bootstrapSshCredentialPath: undefined,
+    bootstrapSshPublicKeyPath: undefined,
+    pullBootstrap: false,
+    pullDeployments: false,
+    pullMigrations: false,
+    lifecycleProfilePath: undefined,
+    bootstrapTargetTelemetryEndpoint: undefined,
+    repository: undefined,
+    bootstrapBundlePath: undefined,
+    bootstrapBundleManifestPath: undefined
+  }).replace("Description=ForgeZero node agent", "Description=ForgeZero candidate node agent");
+}
 var renderOperation = (operation) => {
   if (operation.kind === "commands")
     return operation.commands.map(({ argv: argv2 }) => argv2.join(" ")).join(`
@@ -6198,6 +6240,7 @@ function planProvision(options) {
     auxiliaryUnits: [
       { path: AGENT_SOCKET_UNIT_PATH, unit: agentSocketUnit(options) },
       { path: AGENT_SOCKET_PROXY_UNIT_PATH, unit: agentSocketProxyUnit(options) },
+      { path: AGENT_CANDIDATE_UNIT_PATH, unit: agentCandidateUnit(options) },
       { path: AGENT_UPDATE_HELPER_UNIT_PATH, unit: agentUpdateHelperUnit(options) },
       ...options.enforceEgress ? [
         { path: AGENT_EGRESS_UNIT_PATH, unit: agentEgressUnit(options) }
@@ -16041,6 +16084,7 @@ function planMetalBootstrap(config) {
       "forgezero-metal-helper.service",
       "forgezero-agent-update-helper.service",
       "forgezero-metal-agent-egress.service",
+      "forgezero-metal-agent-candidate.service",
       "forgezero-metal-agent.service"
     ],
     steps: [
@@ -16182,6 +16226,44 @@ RestrictAddressFamilies=AF_UNIX AF_NETLINK
 
 [Install]
 WantedBy=multi-user.target
+`,
+    "forgezero-metal-agent-candidate.service": `[Unit]
+Description=ForgeZero candidate physical-host Agent
+After=network-online.target ${config.hostTelemetryUnit} forgezero-agent-update-helper.service forgezero-metal-agent-egress.service
+Requires=forgezero-agent-update-helper.service forgezero-metal-agent-egress.service
+
+[Service]
+Type=simple
+User=forgezero-metal
+Group=forgezero-metal
+SupplementaryGroups=forgezero-update
+LoadCredentialEncrypted=metal-agent-seed:${SEED_CREDENTIAL_PATH}
+Environment=FZ_SEED_CREDENTIAL=metal-agent-seed
+Environment=FZ_AGENT_ROLE=metal
+Environment=FZ_AGENT_HANDOVER_CANDIDATE=true
+Environment=FZ_AGENT_HANDOVER_READY_SOCKET=/run/forgezero/candidate-ready.sock
+Environment=FZ_METAL_HOSTNAME=${config.metalHostname}
+Environment=FZ_API=${config.profile.apiUrl}
+Environment=NODE_ENV=production
+Environment=OTEL_EXPORTER_OTLP_ENDPOINT=${config.hostTelemetryEndpoint}
+Environment=OTEL_SERVICE_NAME=forgezero-metal-agent-candidate
+ExecStart=/opt/forgezero/agent/candidate/dist/fz-agent.js
+Restart=on-failure
+RestartSec=2
+RuntimeDirectory=forgezero
+RuntimeDirectoryMode=0750
+RuntimeDirectoryPreserve=yes
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+${egress}
 `,
     "forgezero-metal-agent.service": `[Unit]
 Description=ForgeZero identity-only physical-host Agent

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.86";
+var VERSION = "0.1.87";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
@@ -705,6 +705,7 @@ function planMetalBootstrap(config) {
       "forgezero-metal-helper.service",
       "forgezero-agent-update-helper.service",
       "forgezero-metal-agent-egress.service",
+      "forgezero-metal-agent-candidate.service",
       "forgezero-metal-agent.service"
     ],
     steps: [
@@ -846,6 +847,44 @@ RestrictAddressFamilies=AF_UNIX AF_NETLINK
 
 [Install]
 WantedBy=multi-user.target
+`,
+    "forgezero-metal-agent-candidate.service": `[Unit]
+Description=ForgeZero candidate physical-host Agent
+After=network-online.target ${config.hostTelemetryUnit} forgezero-agent-update-helper.service forgezero-metal-agent-egress.service
+Requires=forgezero-agent-update-helper.service forgezero-metal-agent-egress.service
+
+[Service]
+Type=simple
+User=forgezero-metal
+Group=forgezero-metal
+SupplementaryGroups=forgezero-update
+LoadCredentialEncrypted=metal-agent-seed:${SEED_CREDENTIAL_PATH}
+Environment=FZ_SEED_CREDENTIAL=metal-agent-seed
+Environment=FZ_AGENT_ROLE=metal
+Environment=FZ_AGENT_HANDOVER_CANDIDATE=true
+Environment=FZ_AGENT_HANDOVER_READY_SOCKET=/run/forgezero/candidate-ready.sock
+Environment=FZ_METAL_HOSTNAME=${config.metalHostname}
+Environment=FZ_API=${config.profile.apiUrl}
+Environment=NODE_ENV=production
+Environment=OTEL_EXPORTER_OTLP_ENDPOINT=${config.hostTelemetryEndpoint}
+Environment=OTEL_SERVICE_NAME=forgezero-metal-agent-candidate
+ExecStart=/opt/forgezero/agent/candidate/dist/fz-agent.js
+Restart=on-failure
+RestartSec=2
+RuntimeDirectory=forgezero
+RuntimeDirectoryMode=0750
+RuntimeDirectoryPreserve=yes
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+${egress}
 `,
     "forgezero-metal-agent.service": `[Unit]
 Description=ForgeZero identity-only physical-host Agent

package/dist/operator-bootstrap.js

@@ -1405,9 +1405,13 @@ import { DEFAULT_SOCKET } from "@forgezero/vault";
 
 // src/agent-update.ts
 var DEFAULT_AGENT_RELEASE_ROOT = "/opt/forgezero/agent";
+var DEFAULT_AGENT_CANDIDATE_LINK = `${DEFAULT_AGENT_RELEASE_ROOT}/candidate`;
 var DEFAULT_AGENT_UPDATE_SOCKET = "/run/forgezero-update/helper.sock";
 var MAX_AGENT_TARBALL_BYTES = 32 * 1024 * 1024;
 
+// src/agent-handover.ts
+var DEFAULT_AGENT_CANDIDATE_READY_SOCKET = "/run/forgezero/candidate-ready.sock";
+
 // src/agent-update-helper.ts
 var AGENT_UPDATE_GROUP = "forgezero-update";
 var AGENT_UPDATE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-agent-update-helper.service";
@@ -1416,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.86";
+var VERSION = "0.1.87";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -1674,6 +1678,7 @@ var LIFECYCLE_GROUP = "forgezero-lifecycle";
 var DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
 var AGENT_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-agent.socket";
 var AGENT_SOCKET_PROXY_UNIT_PATH = "/etc/systemd/system/forgezero-agent-proxy.service";
+var AGENT_CANDIDATE_UNIT_PATH = "/etc/systemd/system/forgezero-agent-candidate.service";
 var DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
 var ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
 var LIFECYCLE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-lifecycle-helper.service";
@@ -1785,6 +1790,7 @@ Type=simple
 User=root
 Group=${AGENT_UPDATE_GROUP}
 Environment=FZ_AGENT_UPDATE_SOCKET=${DEFAULT_AGENT_UPDATE_SOCKET}
+Environment=FZ_AGENT_PUBLIC_SOCKET=${systemdPath(options.socketPath, "agent socket")}
 ExecStart=${bin} update-helper
 Restart=always
 RestartSec=2
@@ -1829,13 +1835,11 @@ WantedBy=sockets.target
 `;
 }
 function agentSocketProxyUnit(options) {
-  const backend = agentBackendSocketPath(options.socketPath);
+  const backend = agentRoutingSocketPath(options.socketPath);
   const user = options.user ?? "forgezero";
   return `[Unit]
 Description=ForgeZero application Vault socket proxy
 Documentation=https://www.forgezero.net/docs/agent
-Requires=forgezero-agent.service
-After=forgezero-agent.service
 
 [Service]
 User=${user}
@@ -1856,12 +1860,26 @@ RestrictAddressFamilies=AF_UNIX
 `;
 }
 function agentBackendSocketPath(publicSocketPath) {
+  const socket = systemdPath(publicSocketPath, "agent socket");
+  const backend = `${socket}.backend.active`;
+  if (Buffer.byteLength(backend) > 100)
+    throw new Error("agent socket path is too long for a Unix socket");
+  return backend;
+}
+function agentRoutingSocketPath(publicSocketPath) {
   const socket = systemdPath(publicSocketPath, "agent socket");
   const backend = `${socket}.backend`;
   if (Buffer.byteLength(backend) > 100)
     throw new Error("agent socket path is too long for a Unix socket");
   return backend;
 }
+function agentCandidateSocketPath(publicSocketPath) {
+  const socket = systemdPath(publicSocketPath, "agent socket");
+  const backend = `${socket}.backend.candidate`;
+  if (Buffer.byteLength(backend) > 100)
+    throw new Error("agent socket path is too long for a Unix socket");
+  return backend;
+}
 var systemdPath = (value, label) => {
   if (!value || !/^\/[A-Za-z0-9._@/-]+$/.test(value))
     throw new Error(`invalid ${label} path`);
@@ -2145,7 +2163,11 @@ function agentUnit(options) {
   }
   const environment = [
     "NODE_ENV=production",
-    `FZ_SOCKET_PATH=${agentBackendSocketPath(options.socketPath)}`,
+    `FZ_SOCKET_PATH=${options.backendSocketPath ?? agentBackendSocketPath(options.socketPath)}`,
+    `FZ_AGENT_PUBLIC_SOCKET=${options.socketPath}`,
+    `FZ_AGENT_ROUTE_SOCKET=${agentRoutingSocketPath(options.socketPath)}`,
+    options.handoverCandidate ? "FZ_AGENT_HANDOVER_CANDIDATE=true" : null,
+    options.handoverCandidate ? `FZ_AGENT_HANDOVER_READY_SOCKET=${DEFAULT_AGENT_CANDIDATE_READY_SOCKET}` : null,
     `FZ_CONTROL_SOCKET=${controlSocketPath}`,
     `FZ_SEED_CREDENTIAL=agent-seed`,
     `FZ_AGENT_MODE=${options.mode}`,
@@ -2282,6 +2304,26 @@ ${deploymentWrites}
 WantedBy=multi-user.target
 `;
 }
+function agentCandidateUnit(options) {
+  return agentUnit({
+    ...options,
+    binPath: `${DEFAULT_AGENT_RELEASE_ROOT}/candidate/dist/fz-agent.js`,
+    backendSocketPath: agentCandidateSocketPath(options.socketPath),
+    handoverCandidate: true,
+    gitCredentialPath: undefined,
+    deploymentCredentials: {},
+    bootstrapSshCredentialPath: undefined,
+    bootstrapSshPublicKeyPath: undefined,
+    pullBootstrap: false,
+    pullDeployments: false,
+    pullMigrations: false,
+    lifecycleProfilePath: undefined,
+    bootstrapTargetTelemetryEndpoint: undefined,
+    repository: undefined,
+    bootstrapBundlePath: undefined,
+    bootstrapBundleManifestPath: undefined
+  }).replace("Description=ForgeZero node agent", "Description=ForgeZero candidate node agent");
+}
 var renderOperation = (operation) => {
   if (operation.kind === "commands")
     return operation.commands.map(({ argv }) => argv.join(" ")).join(`
@@ -2417,6 +2459,7 @@ function planProvision(options) {
     auxiliaryUnits: [
       { path: AGENT_SOCKET_UNIT_PATH, unit: agentSocketUnit(options) },
       { path: AGENT_SOCKET_PROXY_UNIT_PATH, unit: agentSocketProxyUnit(options) },
+      { path: AGENT_CANDIDATE_UNIT_PATH, unit: agentCandidateUnit(options) },
       { path: AGENT_UPDATE_HELPER_UNIT_PATH, unit: agentUpdateHelperUnit(options) },
       ...options.enforceEgress ? [
         { path: AGENT_EGRESS_UNIT_PATH, unit: agentEgressUnit(options) }
@@ -5397,6 +5440,7 @@ function planMetalBootstrap(config) {
       "forgezero-metal-helper.service",
       "forgezero-agent-update-helper.service",
       "forgezero-metal-agent-egress.service",
+      "forgezero-metal-agent-candidate.service",
       "forgezero-metal-agent.service"
     ],
     steps: [
@@ -5538,6 +5582,44 @@ RestrictAddressFamilies=AF_UNIX AF_NETLINK
 
 [Install]
 WantedBy=multi-user.target
+`,
+    "forgezero-metal-agent-candidate.service": `[Unit]
+Description=ForgeZero candidate physical-host Agent
+After=network-online.target ${config.hostTelemetryUnit} forgezero-agent-update-helper.service forgezero-metal-agent-egress.service
+Requires=forgezero-agent-update-helper.service forgezero-metal-agent-egress.service
+
+[Service]
+Type=simple
+User=forgezero-metal
+Group=forgezero-metal
+SupplementaryGroups=forgezero-update
+LoadCredentialEncrypted=metal-agent-seed:${SEED_CREDENTIAL_PATH}
+Environment=FZ_SEED_CREDENTIAL=metal-agent-seed
+Environment=FZ_AGENT_ROLE=metal
+Environment=FZ_AGENT_HANDOVER_CANDIDATE=true
+Environment=FZ_AGENT_HANDOVER_READY_SOCKET=/run/forgezero/candidate-ready.sock
+Environment=FZ_METAL_HOSTNAME=${config.metalHostname}
+Environment=FZ_API=${config.profile.apiUrl}
+Environment=NODE_ENV=production
+Environment=OTEL_EXPORTER_OTLP_ENDPOINT=${config.hostTelemetryEndpoint}
+Environment=OTEL_SERVICE_NAME=forgezero-metal-agent-candidate
+ExecStart=/opt/forgezero/agent/candidate/dist/fz-agent.js
+Restart=on-failure
+RestartSec=2
+RuntimeDirectory=forgezero
+RuntimeDirectoryMode=0750
+RuntimeDirectoryPreserve=yes
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+${egress}
 `,
     "forgezero-metal-agent.service": `[Unit]
 Description=ForgeZero identity-only physical-host Agent