homeway-server 0.0.1 → 2026.10.4-03b2e7d6

package/README.md

@@ -1 +1,23 @@
 # homeway-server
+
+Homeway server binaries for linux-amd64 and linux-arm64, plus the host installer
+`install-release.sh`. Binaries are xz-compressed; the installer decompresses only the ones a host runs.
+It is not a library; there is nothing to `require()`.
+
+| Path | Contents |
+|---|---|
+| `bin/linux-<arch>/tunneld.xz` | control plane |
+| `bin/linux-<arch>/ingress-agent.xz` | ingress agent (runs sing-box) |
+| `bin/linux-<arch>/sing-box.xz` | sing-box built from the pinned tag with Homeway's patches |
+| `bin/linux-<arch>/relay.xz` | SNI / Host relay |
+| `build-info.json` | version, commit, build time, sing-box version and commit |
+| `SHA256SUMS` | checksums of every file above |
+
+Every `main` commit that passes CI is tagged `vYYYY.M.D-<8-char-commit>` and
+published here without the leading `v`, e.g. `homeway-server@2026.10.4-abcdef12`.
+A host installs a version with `install-release.sh <version|latest>`, which
+verifies the registry integrity and `SHA256SUMS`, stages only the binaries the
+host needs, restarts its services and rolls back on its own if they do not come
+up.
+
+`0.0.1` is an empty placeholder that reserved the name.

package/SHA256SUMS

@@ -0,0 +1,10 @@
+504310bb0c5ff137a544b606e58394a1c6d3c0228d9b8fa8be72db437a9ceb38  bin/linux-amd64/ingress-agent.xz
+d6adc9b44ea6fa4fb1e73b4dae04c6d7c6b1f4b9e81f71ab0fddf19ebc3f4985  bin/linux-amd64/relay.xz
+1139312b7d8c78a9d6fff2f0fb01a50a59c432dc5062b98d93f88d73df456d7e  bin/linux-amd64/sing-box.xz
+27061b92d1c44efda1b2a94e63adb6bdbcdb2b9a418e89770f461623aca5d855  bin/linux-amd64/tunneld.xz
+d61cdfcdca5935975ac2dfb235a8aa8e95635e918103a01367bf735e49d2a682  bin/linux-arm64/ingress-agent.xz
+b7dc55cb19b89fbe41dfd881ac9b46417cc838513c4bb54fff57ac4d4de0dcac  bin/linux-arm64/relay.xz
+a7edec3b3f5a571bcd5594f1a74a5fa16332c65644b3f23fc528da63ce2de4c0  bin/linux-arm64/sing-box.xz
+b0cf93a5d2d40f95820b389f6ff5f27f8d6478cc47f50b742d7e186177ed6c12  bin/linux-arm64/tunneld.xz
+38df2c9df98088eba3586a57a43725f8871e2da9ee22108a1ed3e6f7375750ca  build-info.json
+6dc73b7783acb3edd159035d5d5d84d011a27985010db0adc42033f266fd79a5  install-release.sh

package/build-info.json

@@ -0,0 +1,9 @@
+{
+  "version": "2026.10.4-03b2e7d6",
+  "commit": "03b2e7d627f1797246ecb113b2c3a2f149f16663",
+  "buildTime": "2026-10-04T11:38:46Z",
+  "singBox": {
+    "version": "v1.14.1",
+    "commit": "1ac1a339cb1223e9c70eae14c44411c75033c02d"
+  }
+}

package/install-release.sh

@@ -0,0 +1,610 @@
+#!/bin/bash
+# 把本机切到 homeway-server 的另一个发布 (或本机仍保留的旧发布)，确认各组件起来了；没起来就自动回滚。
+#
+#   install-release.sh <version|installed-release-name|latest>
+#   install-release.sh --adopt-legacy      # 一次性迁移：把旧布局的二进制收为 releases/legacy 并指向 current
+#   install-release.sh --request [auto|<file>]   # homeway-release.service 运行：执行组件写的发布请求 (管理后台发布)
+#
+# --request：组件 (tunneld、ingress-agent、relay) 以非特权用户运行，收到管理后台的发布目标后只在自己的状态目录写
+# release-request.json；homeway-release.path 看到后以 root 启动 homeway-release.service 运行本脚本。请求来自非特权进程，
+# 当作不可信输入：只认固定路径 (control /var/lib/homeway，ingress / relay 为 DynamicUser 的 /var/lib/private/homeway-*)，
+# 必须是普通文件 (不是链接)、属主为非 root 且与所在状态目录的属主相同 (control 另须为 homeway)、目录不可被组或他人写；
+# 内容只取 .target 且必须是发布版本号 (不接受 latest 与已安装的其他名字)。先删除全部请求文件 (path 单元在文件存在时
+# 一直触发)，组件须在本机 COMPONENTS 里，之后与手动安装该版本相同。
+#
+# 本机跑哪些组件由 /etc/homeway/release.conf 的 COMPONENTS 决定 (control / ingress / relay，空格分隔)：
+#   sg: COMPONENTS="control ingress"   hk: COMPONENTS="ingress"   jd1–jd4: COMPONENTS="relay"
+#
+# 版本从 npm registry (默认 npmmirror，国内主机也快) 下载 homeway-server 包，核对 registry 给的 sha512
+# integrity、包内 SHA256SUMS 与 build-info.json 的版本，只把本机架构、本机组件需要的二进制放到
+# /opt/homeway/releases/<version>/，先逐个执行 -version 证明能在本机运行，再原子切换 /opt/homeway/current。
+# 本机已有的发布直接切换，不访问网络。
+#
+# 切换前，组件含 control 时用正在运行的 tunneld 备份数据库 (新二进制启动时会先迁移)；切换后按
+# control → ingress → relay 的顺序重启并逐个验证：
+#   control  /readyz 就绪且 /version 的 commit 与包一致
+#   ingress  单元 active、主进程来自新发布、TCP 39843 在监听、与控制面同步成功 (日志里没有同步错误)
+#   relay    单元 active、主进程来自新发布、TCP 39880 在监听
+# 任一失败则切回上一个发布并重启全部组件。未 enable 的单元 (还没有令牌的入口) 只切换不启动。
+# 目标就是当前发布时，只重启还没跑在它上面的组件与 HOMEWAY_RESTART="control ingress" 点名的组件。
+# 保留最新 3 个发布 (HOMEWAY_KEEP_RELEASES)；current 与上一个 (回滚目标) 即使更旧也保留。
+#
+# 环境变量：HOMEWAY_NPM_REGISTRY (默认 release.conf 的 NPM_REGISTRY，再默认 https://registry.npmmirror.com)、
+# HOMEWAY_RESTART、HOMEWAY_INGRESS_REQUIRE_SYNC=0 (控制面不可用时跳过入口的同步检查)、
+# HOMEWAY_STATE_ROOT (请求文件所在的 /var/lib，测试用)。
+#
+# 以 root 运行。进度与最近一次的日志在 /var/lib/homeway-release/{status.json,job.log}。
+# 依赖 curl、jq、openssl、flock、sha256sum、ss、systemd-run。
+set -Eeuo pipefail
+umask 022
+
+root=${HOMEWAY_ROOT:-/opt/homeway}
+conf_file=${HOMEWAY_RELEASE_CONF:-/etc/homeway/release.conf}
+status_dir=${HOMEWAY_RELEASE_STATUS_DIR:-/var/lib/homeway-release}
+keep_releases=${HOMEWAY_KEEP_RELEASES:-3}
+package=homeway-server
+releases_root=$root/releases
+installed_script=$root/bin/install-release.sh
+state_root=${HOMEWAY_STATE_ROOT:-/var/lib}
+
+# 与 scripts/release-version.sh 一致
+version_pattern='^[0-9]{4}\.([1-9]|1[0-2])\.([1-9]|[12][0-9]|3[01])-[0-9a-f]{8}$'
+name_pattern='^[0-9A-Za-z][0-9A-Za-z._-]{0,79}$'
+
+# 控制面 (tunneld) 的服务用户、环境与数据目录，与 deploy/control-plane 一致
+tunneld_user=homeway
+tunneld_env=/etc/homeway/tunneld.env
+tunneld_home=/var/lib/homeway
+ingress_port=39843
+relay_port=39880
+
+log() { printf '%s %s\n' "$(date -u +%H:%M:%S)" "$*"; }
+
+# 配置文件里一个值。按行匹配，不 source。
+conf_value() { # file name default
+  local value
+  value=$(sed -n "s/^[[:space:]]*$2=//p" "$1" 2>/dev/null | tail -n 1)
+  value=${value%\"}; value=${value#\"}; value=${value%\'}; value=${value#\'}
+  echo "${value:-$3}"
+}
+
+# ---- 组件 ----------------------------------------------------------------
+unit_of() {
+  case $1 in
+    control) echo homeway-tunneld.service ;;
+    ingress) echo homeway-ingress.service ;;
+    relay) echo homeway-relay.service ;;
+  esac
+}
+binaries_of() {
+  case $1 in
+    control) echo tunneld ;;
+    ingress) echo ingress-agent sing-box ;;
+    relay) echo relay ;;
+  esac
+}
+
+# --- 任务状态 -------------------------------------------------------------
+job_target="" job_release="" job_previous="" job_started=""
+write_status() { # state message
+  [ -d "$status_dir" ] || return 0
+  local finished=""
+  case $1 in running) ;; *) finished=$(date -u +%Y-%m-%dT%H:%M:%SZ) ;; esac
+  jq -n --arg state "$1" --arg message "$2" --arg target "$job_target" \
+    --arg release "$job_release" --arg previous "$job_previous" \
+    --arg started "$job_started" --arg finished "$finished" \
+    '{state:$state,message:$message,target:$target,release:$release,previous:$previous}
+     + (if $started == "" then {} else {started_at:$started} end)
+     + (if $finished == "" then {} else {finished_at:$finished} end)' \
+    > "$status_dir/status.json.next"
+  chmod 0644 "$status_dir/status.json.next"
+  mv -f "$status_dir/status.json.next" "$status_dir/status.json"
+}
+
+die() {
+  trap - ERR
+  log "error: $*"
+  write_status failed "$*"
+  exit 1
+}
+
+switch_to() { # release-dir
+  ln -sfn "$1" "$root/current.next"
+  mv -Tf "$root/current.next" "$root/current"
+}
+
+# ---- 发布请求 (--request) ------------------------------------------------
+# 组件的状态目录：control 为 homeway 用户的 StateDirectory；ingress / relay 为 DynamicUser，真实目录在 private/ 下
+request_file_of() { # component
+  case $1 in
+    control) echo "$state_root/homeway/release-request.json" ;;
+    ingress) echo "$state_root/private/homeway-ingress/release-request.json" ;;
+    relay) echo "$state_root/private/homeway-relay/release-request.json" ;;
+  esac
+}
+
+# 校验一个请求文件并输出其中的版本号；不合格返回 1 (原因写标准错误，不回显文件内容)。
+read_request() { # file component
+  local file=$1 dir uid mode value
+  dir=$(dirname "$file")
+  if [ -L "$file" ] || [ ! -f "$file" ]; then echo "$2: request is not a regular file" >&2; return 1; fi
+  if [ -L "$dir" ] || [ ! -d "$dir" ]; then echo "$2: request directory is a link" >&2; return 1; fi
+  uid=$(stat -c %u "$file")
+  if [ "$uid" = 0 ] || [ "$uid" != "$(stat -c %u "$dir")" ]; then
+    echo "$2: request is not owned by the service user that owns $dir" >&2
+    return 1
+  fi
+  if [ "$2" = control ] && [ "$(stat -c %U "$file")" != "$tunneld_user" ]; then
+    echo "$2: request is not owned by $tunneld_user" >&2
+    return 1
+  fi
+  mode=$(stat -c %a "$dir")
+  if (((8#$mode & 8#022) != 0)); then echo "$2: $dir is writable by others" >&2; return 1; fi
+  if [ "$(stat -c %h "$file")" != 1 ]; then echo "$2: request has other hard links" >&2; return 1; fi
+  value=$(head -c 4096 -- "$file" | jq -r 'if type == "object" and (.target | type) == "string" then .target else empty end' 2>/dev/null || true)
+  if ! [[ $value =~ $version_pattern ]]; then echo "$2: request does not name a release version" >&2; return 1; fi
+  echo "$value"
+}
+
+# 取走请求：全部请求文件先读后删 (不论是否合格，path 单元在文件存在时一直触发)，按 control → ingress → relay
+# 取第一个合格的。只给 file 时只认这个文件 (须是上面的固定路径之一)。输出 "<component> <version>"。
+take_request() { # auto|file
+  local component file found="" value
+  for component in control ingress relay; do
+    file=$(request_file_of "$component")
+    [ -e "$file" ] || [ -L "$file" ] || continue
+    if [ "$1" != auto ] && [ "$file" != "$1" ]; then continue; fi
+    if value=$(read_request "$file" "$component") && [ -z "$found" ]; then
+      found="$component $value"
+    fi
+    # 链接只删链接本身；目录 (组件自己建的) 也删，否则 path 单元一直触发
+    rm -rf --one-file-system -- "$file"
+  done
+  [ -n "$found" ] || return 1
+  echo "$found"
+}
+
+# ---- 参数 ----------------------------------------------------------------
+target=${1:-}
+requested_by=${HOMEWAY_REQUESTED_BY:-${SUDO_USER:-$(id -un)}}
+case $target in
+  -h | --help | "")
+    sed -n '2,37p' "$0"
+    exit 2
+    ;;
+esac
+[ "$(id -u)" = 0 ] || { echo "run as root" >&2; exit 1; }
+request_component=""
+if [ "$target" = --request ]; then
+  request=${2:-auto}
+  if ! taken=$(take_request "$request"); then
+    echo "no valid release request ($request)" >&2
+    exit 1
+  fi
+  request_component=${taken%% *}
+  target=${taken#* }
+  requested_by="console via $request_component"
+fi
+[ -f "$conf_file" ] || { echo "$conf_file is missing (COMPONENTS=\"control ingress relay\")" >&2; exit 1; }
+
+read -r -a components <<< "$(conf_value "$conf_file" COMPONENTS "")"
+[ "${#components[@]}" -gt 0 ] || { echo "COMPONENTS is empty in $conf_file" >&2; exit 1; }
+for component in "${components[@]}"; do
+  case $component in
+    control | ingress | relay) ;;
+    *) echo "unknown component $component in $conf_file" >&2; exit 1 ;;
+  esac
+done
+if [ -n "$request_component" ] && [[ " ${components[*]} " != *" $request_component "* ]]; then
+  echo "ignoring a release request from $request_component, which does not run on this host" >&2
+  exit 1
+fi
+# 固定顺序：控制面先起，入口才同步得到
+ordered=()
+for component in control ingress relay; do
+  for c in "${components[@]}"; do
+    if [ "$c" = "$component" ]; then ordered+=("$component"); break; fi
+  done
+done
+needed=()
+for component in "${ordered[@]}"; do
+  read -r -a bins <<< "$(binaries_of "$component")"
+  needed+=("${bins[@]}")
+done
+
+registry=${HOMEWAY_NPM_REGISTRY:-$(conf_value "$conf_file" NPM_REGISTRY https://registry.npmmirror.com)}
+registry=${registry%/}
+
+case $(uname -m) in
+  x86_64 | amd64) arch=amd64 ;;
+  aarch64 | arm64) arch=arm64 ;;
+  *) echo "unsupported architecture $(uname -m)" >&2; exit 1 ;;
+esac
+
+mkdir -p "$status_dir" "$releases_root" "$root/bin"
+chmod 0755 "$status_dir"
+
+# 同一时间只做一次切换
+exec 9> /run/lock/homeway-release.lock
+flock -w 30 9 || { echo "another release change is running" >&2; exit 1; }
+
+# ---- 一次性迁移：旧布局 → releases/legacy -------------------------------
+# 旧部署把二进制放在各自目录里。把它们复制成一个名为 legacy 的发布并让 current 指向它，
+# 这样换成新单元 (ExecStart=/opt/homeway/current/…) 后，第一次安装失败也有可以回滚的发布。
+if [ "$target" = --adopt-legacy ]; then
+  if [ -e "$root/current" ]; then
+    log "$root/current already exists ($(readlink -f "$root/current")); nothing to adopt"
+    exit 0
+  fi
+  legacy=$releases_root/legacy
+  rm -rf "$legacy.staging"
+  mkdir -p "$legacy.staging"
+  found=0
+  for pair in /opt/homeway-control/bin/tunneld:tunneld /opt/homeway-ingress/bin/ingress-agent:ingress-agent \
+    /opt/homeway-ingress/bin/sing-box:sing-box /opt/homeway/bin/relay:relay; do
+    if [ -x "${pair%%:*}" ]; then
+      install -m 0755 "${pair%%:*}" "$legacy.staging/${pair#*:}"
+      found=1
+    fi
+  done
+  if [ "$found" = 0 ]; then
+    rm -rf "$legacy.staging"
+    log "no legacy binaries found; a fresh host starts from its first release"
+    exit 0
+  fi
+  rm -rf "$legacy"
+  mv "$legacy.staging" "$legacy"
+  switch_to "$legacy"
+  log "adopted legacy binaries as $legacy: $(cd "$legacy" && echo *)"
+  exit 0
+fi
+
+# 输出同时写 job.log。自我刷新后的重新执行继承同一个 tee (调用方的终端照样看得到后续输出)，不再另起。
+# tee 不能继承锁，否则重新执行时它还拿着锁
+if [ "${HOMEWAY_INSTALLER_REEXEC:-}" != 1 ]; then
+  : > "$status_dir/job.log"
+  chmod 0644 "$status_dir/job.log"
+  exec > >(exec 9>&-; tee -a "$status_dir/job.log") 2>&1
+fi
+
+job_target=$target
+job_started=${HOMEWAY_JOB_STARTED:-$(date -u +%Y-%m-%dT%H:%M:%SZ)}
+work=""
+cleanup() { [ -z "$work" ] || rm -rf "$work"; }
+failed() {
+  local code=$? command=$BASH_COMMAND
+  trap - ERR
+  log "error: '$command' exited with $code"
+  write_status failed "'$command' exited with $code; see the log"
+  exit "$code"
+}
+trap failed ERR
+trap cleanup EXIT
+
+[[ $target =~ $name_pattern ]] || die "invalid release target"
+write_status running "started"
+log "release change to $target (components: ${ordered[*]}, linux-$arch) requested by $requested_by"
+
+previous_dir=$(readlink -f "$root/current" 2>/dev/null || true)
+if [ ! -d "$previous_dir" ]; then previous_dir=""; fi
+job_previous=${previous_dir:+$(basename "$previous_dir")}
+
+# ---- 解析目标 ------------------------------------------------------------
+fetch() { curl -fsSL --retry 3 --connect-timeout 10 --max-time 600 "$@"; }
+
+if [ "$target" = latest ]; then
+  target=$(fetch "$registry/$package/latest" | jq -r '.version // empty')
+  [[ $target =~ $version_pattern ]] || die "the registry has no usable latest release"
+  log "latest is $target"
+  job_target=$target
+fi
+
+has_binaries() { # dir
+  local binary
+  for binary in "${needed[@]}"; do
+    [ -x "$1/$binary" ] || return 1
+  done
+}
+
+release_dir=$releases_root/$target
+if has_binaries "$release_dir"; then
+  log "using installed release $target"
+elif [[ $target =~ $version_pattern ]]; then
+  if [ -n "${HOMEWAY_INSTALLER_PACKAGE_DIR:-}" ]; then
+    package_dir=$HOMEWAY_INSTALLER_PACKAGE_DIR
+    work=$(dirname "$(dirname "$package_dir")")
+  else
+    work=$(mktemp -d /tmp/homeway-release.XXXXXX)
+    log "fetching $package@$target from $registry"
+    fetch "$registry/$package/$target" > "$work/manifest.json" ||
+      die "$package@$target could not be fetched from $registry (npmmirror not synced yet? https://npmmirror.com/sync/$package)"
+    integrity=$(jq -r '.dist.integrity // empty' "$work/manifest.json")
+    case $integrity in
+      sha512-*) ;;
+      *) die "the registry gave no sha512 integrity" ;;
+    esac
+    # registry 的固定布局，在这里拼出，不用 manifest 里的地址
+    fetch "$registry/$package/-/$package-$target.tgz" > "$work/package.tgz" ||
+      die "the $package@$target tarball could not be downloaded"
+    actual="sha512-$(openssl dgst -sha512 -binary "$work/package.tgz" | base64 -w0)"
+    [ "$actual" = "$integrity" ] || die "package integrity mismatch"
+    mkdir "$work/extract"
+    tar -xzf "$work/package.tgz" -C "$work/extract" --no-same-owner --no-same-permissions
+    package_dir=$work/extract/package
+  fi
+  (cd "$package_dir" && sha256sum --quiet -c SHA256SUMS) ||
+    die "package checksums do not match SHA256SUMS"
+  packaged=$(jq -r .version "$package_dir/build-info.json")
+  [ "$packaged" = "$target" ] || die "package build-info names $packaged, not $target"
+  # 先刷新本安装脚本再继续 (在检查包内容之前)：需要新安装逻辑的发布不能被旧逻辑拒绝。先做语法检查，
+  # 坏掉的安装脚本没法修复自己。最多跳一次。
+  if [ -f "$package_dir/install-release.sh" ] && ! cmp -s "$package_dir/install-release.sh" "$installed_script"; then
+    bash -n "$package_dir/install-release.sh" || die "the packaged installer does not parse"
+    install -m 0755 "$package_dir/install-release.sh" "$installed_script.next"
+    mv -f "$installed_script.next" "$installed_script"
+    log "refreshed install-release.sh from $target"
+    if [ "${HOMEWAY_INSTALLER_REEXEC:-}" != 1 ]; then
+      log "continuing under the refreshed installer"
+      trap - ERR EXIT
+      HOMEWAY_INSTALLER_REEXEC=1 \
+        HOMEWAY_INSTALLER_PACKAGE_DIR=$package_dir \
+        HOMEWAY_JOB_STARTED=$job_started \
+        HOMEWAY_NPM_REGISTRY=$registry \
+        HOMEWAY_REQUESTED_BY=$requested_by \
+        exec 9>&- "$installed_script" "$target"
+    fi
+  fi
+
+  # 包里的二进制是 <名字>.xz (xz 压缩，包小约 30%) 或未压缩的 <名字>；只解出本机组件用到的
+  packaged_binary() { # binary
+    local base=$package_dir/bin/linux-$arch/$1
+    if [ -f "$base.xz" ]; then echo "$base.xz"; elif [ -f "$base" ]; then echo "$base"; fi
+  }
+  for binary in "${needed[@]}"; do
+    [ -n "$(packaged_binary "$binary")" ] || die "package is missing bin/linux-$arch/$binary"
+  done
+  command -v xz > /dev/null || [ -z "$(find "$package_dir/bin/linux-$arch" -name '*.xz' -print -quit)" ] ||
+    die "the package has xz-compressed binaries but xz is not installed (apt-get install -y xz-utils)"
+  # 放到 dest：.xz 先解压到旁边的临时文件，校验过的包内容 (SHA256SUMS) 加上 xz 自带的校验
+  place_binary() { # binary dest
+    local src
+    src=$(packaged_binary "$1")
+    case $src in
+      *.xz) xz -dc "$src" > "$2.tmp" ;;
+      *) cp "$src" "$2.tmp" ;;
+    esac
+    chmod 0755 "$2.tmp"
+    mv -f "$2.tmp" "$2"
+  }
+
+  if [ -d "$release_dir" ]; then
+    # 已有该发布但缺本机新增组件的二进制 (例如 sg 先迁移了 control，再迁移 ingress)：只补缺的，
+    # 不整体替换目录 (它可能正是 current)
+    for binary in "${needed[@]}"; do
+      [ -x "$release_dir/$binary" ] && continue
+      place_binary "$binary" "$release_dir/$binary"
+      log "added $binary to $release_dir"
+    done
+  else
+    staging=$releases_root/.$target.staging
+    rm -rf "$staging"
+    mkdir -p "$staging"
+    for binary in "${needed[@]}"; do
+      place_binary "$binary" "$staging/$binary"
+    done
+    install -m 0644 "$package_dir/build-info.json" "$staging/build-info.json"
+    mv "$staging" "$release_dir"
+    log "staged $release_dir"
+  fi
+else
+  die "$target is neither installed (with ${needed[*]}) nor a release version"
+fi
+job_release=$(basename "$release_dir")
+
+# ---- 证明新二进制能在本机运行 -------------------------------------------
+# 迁移时收进来的 legacy 没有 build-info.json，旧 relay 也不认 -version，跳过
+expected_commit=""
+if [ -f "$release_dir/build-info.json" ]; then
+  expected_commit=$(jq -r '.commit // empty' "$release_dir/build-info.json")
+  for binary in "${needed[@]}"; do
+    case $binary in
+      tunneld) out=$("$release_dir/tunneld" version 2>&1) ;;
+      sing-box) out=$("$release_dir/$binary" version 2>&1) ;;
+      *) out=$("$release_dir/$binary" -version 2>&1) ;;
+    esac || die "$release_dir/$binary does not run on this host: $out"
+    log "$binary: $(head -n 1 <<< "$out")"
+    if [ "$binary" != sing-box ] && [ -n "$expected_commit" ] &&
+      [ "$(jq -r '.commit // empty' <<< "$out" 2>/dev/null)" != "$expected_commit" ]; then
+      die "$binary reports a different commit than build-info.json"
+    fi
+  done
+fi
+
+http_address() {
+  local address
+  address=$(conf_value "$tunneld_env" HTTP_ADDR :8080)
+  case $address in :*) address=127.0.0.1$address ;; 0.0.0.0:*) address=127.0.0.1:${address#*:} ;; esac
+  echo "$address"
+}
+
+main_exe_in() { # unit release-dir
+  local pid
+  pid=$(systemctl show -p MainPID --value "$1")
+  [ -n "$pid" ] && [ "$pid" != 0 ] || return 1
+  case $(readlink -f "/proc/$pid/exe" 2>/dev/null) in
+    "$(readlink -f "$2")"/*) return 0 ;;
+  esac
+  return 1
+}
+
+listening() { # port
+  [ -n "$(ss -Hltn "sport = :$1" 2>/dev/null)" ]
+}
+
+verify_control() { # release-dir
+  local address expected="" served deadline=$((SECONDS + 90))
+  address=$(http_address)
+  if [ -f "$1/build-info.json" ]; then expected=$(jq -r '.commit // empty' "$1/build-info.json"); fi
+  while [ "$SECONDS" -lt "$deadline" ]; do
+    sleep 2
+    systemctl is-active --quiet homeway-tunneld.service || continue
+    curl -fsS --max-time 5 "http://$address/readyz" > /dev/null 2>&1 || continue
+    # 读不到 /version 的旧版本 (legacy) 只看 readyz
+    served=$(curl -fsS --max-time 5 "http://$address/version" 2>/dev/null | jq -r '.commit // empty' 2>/dev/null || true)
+    if [ -z "$expected" ] || [ "$served" = "$expected" ]; then
+      log "control: ready, /version commit ${served:-n/a}"
+      return 0
+    fi
+  done
+  return 1
+}
+
+# ingress-agent 启动后立即同步一次：失败记 {"msg":"sync",…}，之后恢复记 "sync recovered"；
+# 有变化记 "synced"，没变化 (304) 什么也不记。所以 15 s 内没有同步错误即算成功。
+verify_ingress() { # release-dir since
+  local logs deadline=$((SECONDS + 60)) started=$SECONDS
+  while [ "$SECONDS" -lt "$deadline" ]; do
+    sleep 3
+    systemctl is-active --quiet homeway-ingress.service || continue
+    main_exe_in homeway-ingress.service "$1" || continue
+    listening "$ingress_port" || continue
+    [ "${HOMEWAY_INGRESS_REQUIRE_SYNC:-1}" = 1 ] || { log "ingress: active, :$ingress_port listening"; return 0; }
+    logs=$(journalctl -u homeway-ingress.service --since "$2" -o cat --no-pager 2>/dev/null || true)
+    if grep -Eq '"msg":"(synced|sync recovered)"' <<< "$logs"; then
+      log "ingress: active, :$ingress_port listening, synced with the control plane"
+      return 0
+    fi
+    if ! grep -q '"msg":"sync"' <<< "$logs" && [ $((SECONDS - started)) -ge 15 ]; then
+      log "ingress: active, :$ingress_port listening, no sync errors"
+      return 0
+    fi
+  done
+  return 1
+}
+
+verify_relay() { # release-dir
+  local deadline=$((SECONDS + 30))
+  while [ "$SECONDS" -lt "$deadline" ]; do
+    sleep 2
+    systemctl is-active --quiet homeway-relay.service || continue
+    main_exe_in homeway-relay.service "$1" || continue
+    listening "$relay_port" || continue
+    log "relay: active, :$relay_port listening"
+    return 0
+  done
+  return 1
+}
+
+unit_enabled() { # unit
+  systemctl is-enabled --quiet "$1" 2>/dev/null
+}
+
+# ---- 要重启哪些组件 ------------------------------------------------------
+# 换了发布：全部重启。发布没变：只重启还没跑在它上面的组件 (例如 sg 迁移时后补的 ingress)，
+# 以及 HOMEWAY_RESTART 点名的组件 (部署脚本改了单元文件时传入，如 HOMEWAY_RESTART=control)。
+# 未 enable 的单元 (例如还没有令牌的入口) 只切换，不启动。
+restart_list=()
+same_release=0
+if [ "$(readlink -f "$release_dir")" = "$previous_dir" ]; then
+  same_release=1
+  for component in "${ordered[@]}"; do
+    unit=$(unit_of "$component")
+    unit_enabled "$unit" || continue
+    if [[ " ${HOMEWAY_RESTART:-} " == *" $component "* ]] || ! main_exe_in "$unit" "$release_dir"; then
+      restart_list+=("$component")
+    fi
+  done
+  if [ "${#restart_list[@]}" = 0 ]; then
+    write_status succeeded "$job_release is already current"
+    log "$job_release is already current"
+    exit 0
+  fi
+  log "$job_release is already current; restarting ${restart_list[*]}"
+else
+  restart_list=("${ordered[@]}")
+fi
+
+# ---- 备份、切换、重启、验证 ---------------------------------------------
+if [ "$same_release" = 0 ] && [[ " ${restart_list[*]} " == *" control "* ]] && [ -n "$previous_dir" ] &&
+  [ -x "$previous_dir/tunneld" ] && unit_enabled homeway-tunneld.service &&
+  [ -f "$(conf_value "$tunneld_env" DATABASE_PATH "$tunneld_home/tunneld.db")" ]; then
+  backup_dir=$tunneld_home/release-backups
+  install -d -o "$tunneld_user" -g "$tunneld_user" -m 0750 "$backup_dir"
+  backup_file=$backup_dir/pre-$job_release-$(date -u +%Y%m%d-%H%M%S).db
+  log "backing up the database with the running release to $backup_file"
+  # 与单元相同的用户、环境文件与工作目录，由 systemd 解析，和服务看到的一样
+  systemd-run --wait --pipe --quiet --collect \
+    -p User="$tunneld_user" -p Group="$tunneld_user" -p UMask=0077 \
+    -p EnvironmentFile="$tunneld_env" -p WorkingDirectory="$tunneld_home" \
+    "$previous_dir/tunneld" backup "$backup_file" 9>&- ||
+    die "the pre-switch database backup failed; nothing was changed"
+  # 只留最近 5 份
+  find "$backup_dir" -maxdepth 1 -type f -name 'pre-*.db' -printf '%T@ %p\n' | sort -rn |
+    tail -n +6 | cut -d' ' -f2- | while IFS= read -r old; do rm -f "$old"; done
+fi
+
+# 按顺序重启并验证，记下第一个失败的组件
+restart_all() { # release-dir
+  local component unit since
+  for component in "${restart_list[@]}"; do
+    unit=$(unit_of "$component")
+    if ! unit_enabled "$unit"; then
+      log "$unit is not enabled; switched without starting it"
+      continue
+    fi
+    since=$(date '+%Y-%m-%d %H:%M:%S')
+    log "restarting $unit"
+    systemctl restart "$unit" 9>&- || true
+    if ! "verify_$component" "$1" "$since"; then
+      log "$component did not come up on $(basename "$1")"
+      journalctl -u "$unit" -n 40 --no-pager || true
+      failed_component=$component
+      return 1
+    fi
+  done
+}
+
+failed_component=""
+if [ "$same_release" = 1 ]; then
+  restart_all "$release_dir" ||
+    die "$failed_component did not come up on $job_release (to go back: install-release.sh <an older release under $releases_root>)"
+  trap - ERR
+  write_status succeeded "$job_release is serving (restarted ${restart_list[*]})"
+  log "done: $job_release"
+  exit 0
+fi
+
+log "switching current to $job_release"
+switch_to "$release_dir"
+if ! restart_all "$release_dir"; then
+  if [ -n "$previous_dir" ]; then
+    log "rolling back to $job_previous"
+    switch_to "$previous_dir"
+    if restart_all "$previous_dir"; then
+      trap - ERR
+      write_status rolled_back "$job_release: $failed_component did not come up; $job_previous is serving again"
+      exit 1
+    fi
+    die "$job_release did not come up and $job_previous did not come back either ($failed_component)"
+  fi
+  die "$job_release: $failed_component did not come up and there is no previous release"
+fi
+
+# ---- 清理 ----------------------------------------------------------------
+# 按安装时间保留最新的几个，current 与上一个 (回滚目标) 无论新旧都保留
+seen=0
+while IFS= read -r candidate; do
+  candidate=${candidate%/}
+  [ -d "$candidate" ] || continue
+  seen=$((seen + 1))
+  [ "$seen" -gt "$keep_releases" ] || continue
+  resolved=$(readlink -f "$candidate")
+  [ "$resolved" = "$(readlink -f "$release_dir")" ] && continue
+  [ "$resolved" = "$previous_dir" ] && continue
+  rm -rf "$candidate"
+  log "pruned $(basename "$candidate")"
+done < <(find "$releases_root" -mindepth 1 -maxdepth 1 -type d ! -name '.*' -printf '%T@ %p\n' | sort -rn | cut -d' ' -f2-)
+
+trap - ERR
+write_status succeeded "$job_release is serving"
+log "done: $job_release"

package/package.json

@@ -1,6 +1,24 @@
 {
   "name": "homeway-server",
-  "version": "0.0.1",
-  "description": "Homeway server binaries (placeholder; real releases are published from CI).",
-  "license": "UNLICENSED"
+  "version": "2026.10.4-03b2e7d6",
+  "description": "Homeway server binaries (Go + patched sing-box) for linux amd64/arm64 and the host installer. Published from CI for every main commit; installed on hosts by install-release.sh.",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/homeway-tv/homeway.git"
+  },
+  "os": [
+    "linux"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "files": [
+    "bin/",
+    "install-release.sh",
+    "build-info.json",
+    "SHA256SUMS"
+  ],
+  "scripts": {}
 }