[HLCC-ICE-000001][ZY-CONTRIB-20260723-001] feat: 以来光者贡献链启用冰朔第五域个人子频道

server-tools/node-bootstrap/README.md

@@ -0,0 +1,8 @@
+# 光湖服务器初始化模板
+
+所有新灯塔节点先执行同一模板：基础诊断工具、`guanghu` 系统组、root-only
+秘密目录、节点身份文件、服务器导航地图、SSH 与系统安全更新。模板不携带任何
+共享 token；节点到京东的密钥必须逐节点生成，接入后登记到 JD 路由表。
+
+JD-FD-PRIMARY 是当前首个样板节点。历史节点接入时先备份和审计，再补齐模板
+目录，不批量覆盖其现有服务。

server-tools/node-bootstrap/bootstrap.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+NODE_ID=${1:?usage: bootstrap.sh NODE_ID MAP_FILE}
+MAP_FILE=${2:?usage: bootstrap.sh NODE_ID MAP_FILE}
+test "$(id -u)" -eq 0
+test -s "$MAP_FILE"
+
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
+apt-get install -y -qq ca-certificates curl git jq openssh-server python3 rsync unattended-upgrades
+
+getent group guanghu >/dev/null || groupadd --system guanghu
+for account in guanghu-authz guanghu-sentinel; do
+  id -u "$account" >/dev/null 2>&1 || useradd --system --home /nonexistent --shell /usr/sbin/nologin "$account"
+  usermod -aG guanghu "$account"
+done
+
+install -d -o root -g guanghu -m 750 /etc/guanghu /var/lib/guanghu
+install -d -o root -g root -m 700 /etc/guanghu/secrets
+install -d -o root -g root -m 755 /etc/guanghu/navigation-maps /opt/guanghu
+install -m 644 "$MAP_FILE" "/etc/guanghu/navigation-maps/${NODE_ID}.json"
+
+cat > /etc/guanghu/node.json <<EOF
+{
+  "schema": "guanghu.node/v1",
+  "node_id": "${NODE_ID}",
+  "upstream": "JD-FD-PRIMARY",
+  "navigation_map": "/etc/guanghu/navigation-maps/${NODE_ID}.json",
+  "secret_policy": "private material stays in /etc/guanghu/secrets"
+}
+EOF
+chmod 644 /etc/guanghu/node.json
+
+systemctl enable --now ssh unattended-upgrades
+printf 'GUANGHU_NODE_READY=%s\n' "$NODE_ID"

server-tools/node-bootstrap/bootstrap.test.js

@@ -0,0 +1,16 @@
+"use strict";
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+const source = fs.readFileSync(path.join(__dirname, "bootstrap.sh"), "utf8");
+test("bootstrap creates the common Guanghu filesystem boundary", () => {
+  assert.match(source, /\/etc\/guanghu\/secrets/);
+  assert.match(source, /\/etc\/guanghu\/navigation-maps/);
+  assert.match(source, /\/var\/lib\/guanghu/);
+});
+test("bootstrap requires an explicit node id and map", () => {
+  assert.match(source, /NODE_ID=\$\{1:\?/);
+  assert.match(source, /MAP_FILE=\$\{2:\?/);
+});
+test("bootstrap never installs a shared token", () => assert.doesNotMatch(source, /zy_gtw_|Bearer\s+[A-Za-z0-9]/));