@task-handoff/control-plane 0.0.2 → 0.0.3-alpha.2

package/bin/task-handoff-install-server

@@ -1,7 +1,8 @@
 #!/bin/sh
 set -eu
 
-REPO_DIR="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+INSTALLER_BIN_DIR="$(CDPATH= cd -- "$(dirname "$0")" && pwd)"
+REPO_DIR="$(CDPATH= cd -- "$INSTALLER_BIN_DIR/.." && pwd)"
 TASK_HANDOFF_BIN=""
 TASK_HANDOFF_COMMAND=""
 CONTROL_PLANE_BIN=""
@@ -10,7 +11,7 @@ CONTROLLED_INSTANCE_BIN=""
 CONTROL_PLANE_COMMAND=""
 NODE_AGENT_COMMAND=""
 CONTROLLED_INSTANCE_COMMAND=""
-SERVICE_USER="task-handoff"
+SERVICE_USER="root"
 ENV_DIR="/etc/task-handoff"
 CONTROL_PLANE_DATA_DIR="/var/lib/task-handoff/control-plane"
 NODE_AGENT_DATA_DIR="/var/lib/task-handoff/node-agent"
@@ -18,6 +19,7 @@ CONTROL_PLANE_HOST="0.0.0.0"
 CONTROL_PLANE_PORT="8081"
 NODE_AGENT_HOST="127.0.0.1"
 NODE_AGENT_PORT="8091"
+NODE_AGENT_IPC_PATH="/run/task-handoff/node-agent.sock"
 AUTH_MODE="password"
 STATIC_DIR=""
 
@@ -35,13 +37,14 @@ Options:
   --control-plane-bin <path>        Control-plane executable
   --node-agent-bin <path>           Node-agent executable
   --controlled-instance-bin <path>  Controlled-instance executable for local runtimes
-  --service-user <user>             systemd service user, default task-handoff
+  --service-user <user>             systemd service user, default root
   --control-plane-data-dir <path>   Control-plane data directory
   --node-agent-data-dir <path>      Node-agent data directory
   --control-plane-host <host>       Control-plane bind host, default 0.0.0.0
   --control-plane-port <port>       Control-plane port, default 8081
   --node-agent-host <host>          Local node-agent bind host, default 127.0.0.1
   --node-agent-port <port>          Local node-agent port, default 8091
+  --node-agent-ipc-path <path>      Local control socket, default /run/task-handoff/node-agent.sock
   --auth-mode <mode>                Control-plane auth mode: password or disabled
   --static-dir <path>               Built control-plane UI directory
 USAGE
@@ -68,6 +71,7 @@ while [ "$#" -gt 0 ]; do
     --control-plane-port) CONTROL_PLANE_PORT="${2:-}"; shift 2 ;;
     --node-agent-host) NODE_AGENT_HOST="${2:-}"; shift 2 ;;
     --node-agent-port) NODE_AGENT_PORT="${2:-}"; shift 2 ;;
+    --node-agent-ipc-path) NODE_AGENT_IPC_PATH="${2:-}"; shift 2 ;;
     --auth-mode) AUTH_MODE="${2:-}"; shift 2 ;;
     --static-dir) STATIC_DIR="${2:-}"; shift 2 ;;
     -h|--help) usage; exit 0 ;;
@@ -86,8 +90,8 @@ if ! command -v systemctl >/dev/null 2>&1; then
   echo "systemd is required for this installer." >&2
   exit 1
 fi
-if ! command -v curl >/dev/null 2>&1; then
-  echo "curl is required for this installer." >&2
+if ! command -v node >/dev/null 2>&1; then
+  echo "node is required for this installer." >&2
   exit 1
 fi
 
@@ -125,6 +129,15 @@ if [ -n "$TASK_HANDOFF_COMMAND" ]; then
     STATIC_DIR="$REPO_DIR/packages/control-plane-ui/dist"
   fi
 else
+  if [ -z "$CONTROL_PLANE_BIN" ] && [ -f "$INSTALLER_BIN_DIR/task-handoff-control-plane" ]; then
+    CONTROL_PLANE_BIN="$INSTALLER_BIN_DIR/task-handoff-control-plane"
+  fi
+  if [ -z "$NODE_AGENT_BIN" ] && [ -f "$INSTALLER_BIN_DIR/task-handoff-node-agent" ]; then
+    NODE_AGENT_BIN="$INSTALLER_BIN_DIR/task-handoff-node-agent"
+  fi
+  if [ -z "$CONTROLLED_INSTANCE_BIN" ] && [ -f "$INSTALLER_BIN_DIR/task-handoff-controlled-instance" ]; then
+    CONTROLLED_INSTANCE_BIN="$INSTALLER_BIN_DIR/task-handoff-controlled-instance"
+  fi
   CONTROL_PLANE_COMMAND="$(resolve_command "${CONTROL_PLANE_BIN:-task-handoff-control-plane}")"
   NODE_AGENT_COMMAND="$(resolve_command "${NODE_AGENT_BIN:-task-handoff-node-agent}")"
   CONTROLLED_INSTANCE_COMMAND="$(resolve_command "${CONTROLLED_INSTANCE_BIN:-task-handoff-controlled-instance}") web"
@@ -135,6 +148,8 @@ if [ -n "$STATIC_DIR" ]; then
   CONTROL_PLANE_STATIC_OPTION="--static-dir $STATIC_DIR"
 fi
 
+NODE_AGENT_IPC_ENDPOINT="$(node -e 'process.stdout.write(`ipc://${encodeURIComponent(process.argv[1])}`)' "$NODE_AGENT_IPC_PATH")"
+
 if [ "$SERVICE_USER" != "root" ] && ! id "$SERVICE_USER" >/dev/null 2>&1; then
   useradd --system --create-home --home-dir /var/lib/task-handoff --shell /usr/sbin/nologin "$SERVICE_USER"
 fi
@@ -142,6 +157,21 @@ if [ "$SERVICE_USER" != "root" ] && getent group docker >/dev/null 2>&1; then
   usermod -aG docker "$SERVICE_USER" || true
 fi
 
+assert_service_command_accessible() {
+  command_value="$1"
+  command_label="$2"
+  executable="${command_value%% *}"
+  if [ "$SERVICE_USER" != "root" ] && command -v runuser >/dev/null 2>&1 && ! runuser -u "$SERVICE_USER" -- test -x "$executable"; then
+    echo "$command_label is not executable by service user $SERVICE_USER: $executable" >&2
+    echo "Install Node.js and TaskHandoff under a system-wide prefix such as /usr/local, not a root-only NVM directory." >&2
+    exit 1
+  fi
+}
+
+assert_service_command_accessible "$CONTROL_PLANE_COMMAND" "Control-plane command"
+assert_service_command_accessible "$NODE_AGENT_COMMAND" "Node-agent command"
+assert_service_command_accessible "$CONTROLLED_INSTANCE_COMMAND" "Controlled-instance command"
+
 mkdir -p "$ENV_DIR" "$CONTROL_PLANE_DATA_DIR" "$NODE_AGENT_DATA_DIR"
 chown -R "$SERVICE_USER":"$SERVICE_USER" "$CONTROL_PLANE_DATA_DIR" "$NODE_AGENT_DATA_DIR" 2>/dev/null || true
 
@@ -149,6 +179,8 @@ cat > "$ENV_DIR/node-agent.env" <<EOF
 TASK_HANDOFF_NODE_AGENT_HOST=$NODE_AGENT_HOST
 TASK_HANDOFF_NODE_AGENT_PORT=$NODE_AGENT_PORT
 TASK_HANDOFF_NODE_AGENT_DATA_DIR=$NODE_AGENT_DATA_DIR
+TASK_HANDOFF_NODE_AGENT_CONNECTION_MODE=local-ipc
+TASK_HANDOFF_NODE_AGENT_IPC_PATH=$NODE_AGENT_IPC_PATH
 TASK_HANDOFF_NODE_AGENT_CONTAINER_URL=http://host.docker.internal:$NODE_AGENT_PORT
 TASK_HANDOFF_LOCAL_CONTROLLED_COMMAND=$CONTROLLED_INSTANCE_COMMAND
 EOF
@@ -161,7 +193,7 @@ TASK_HANDOFF_CONTROL_PLANE_DATA_DIR=$CONTROL_PLANE_DATA_DIR
 TASK_HANDOFF_CONTROL_PLANE_STATIC_DIR=$STATIC_DIR
 TASK_HANDOFF_CONTROL_PLANE_AUTH_MODE=$AUTH_MODE
 TASK_HANDOFF_NODE_AGENT_ENDPOINT=http://$NODE_AGENT_HOST:$NODE_AGENT_PORT
-TASK_HANDOFF_NODE_AGENT_CONTROL_ENDPOINT=http://$NODE_AGENT_HOST:$NODE_AGENT_PORT
+TASK_HANDOFF_NODE_AGENT_CONTROL_ENDPOINT=$NODE_AGENT_IPC_ENDPOINT
 TASK_HANDOFF_NODE_AGENT_CONTAINER_URL=http://host.docker.internal:$NODE_AGENT_PORT
 EOF
 chmod 0640 "$ENV_DIR/control-plane.env"
@@ -175,9 +207,11 @@ Wants=network-online.target
 [Service]
 Type=simple
 User=$SERVICE_USER
-WorkingDirectory=$REPO_DIR
+WorkingDirectory=$NODE_AGENT_DATA_DIR
+RuntimeDirectory=task-handoff
+RuntimeDirectoryMode=0700
 EnvironmentFile=-$ENV_DIR/node-agent.env
-ExecStart=$NODE_AGENT_COMMAND --host $NODE_AGENT_HOST --port $NODE_AGENT_PORT --data-dir $NODE_AGENT_DATA_DIR
+ExecStart=$NODE_AGENT_COMMAND --host $NODE_AGENT_HOST --port $NODE_AGENT_PORT --data-dir $NODE_AGENT_DATA_DIR --connection-mode local-ipc --ipc-path $NODE_AGENT_IPC_PATH
 Restart=always
 RestartSec=3
 KillSignal=SIGTERM
@@ -195,9 +229,9 @@ Wants=network-online.target task-handoff-node-agent.service
 [Service]
 Type=simple
 User=$SERVICE_USER
-WorkingDirectory=$REPO_DIR
+WorkingDirectory=$CONTROL_PLANE_DATA_DIR
 EnvironmentFile=-$ENV_DIR/control-plane.env
-ExecStartPre=/bin/sh -c 'for i in \$(seq 1 30); do curl -fsS http://$NODE_AGENT_HOST:$NODE_AGENT_PORT/api/node-agent/health >/dev/null 2>&1 && exit 0; sleep 1; done; exit 1'
+ExecStartPre=/bin/sh -c 'for i in \$(seq 1 30); do [ -S "$NODE_AGENT_IPC_PATH" ] && exit 0; sleep 1; done; exit 1'
 ExecStart=$CONTROL_PLANE_COMMAND --host $CONTROL_PLANE_HOST --port $CONTROL_PLANE_PORT --data-dir $CONTROL_PLANE_DATA_DIR $CONTROL_PLANE_STATIC_OPTION --auth-mode $AUTH_MODE
 Restart=always
 RestartSec=3