[HLCC-ICE-000001][ZY-CONTRIB-20260723-001] feat: 以来光者贡献链启用冰朔第五域个人子频道

server-tools/personal-node-probe/README.md

@@ -0,0 +1,13 @@
+# Personal node heartbeat probe
+
+Runs on `JD-OPS-CENTER` and checks one registered node through a private SSH
+alias. The remote action is fixed and read-only: service state, disk usage and
+uptime. A JSON receipt is written under `/var/lib/guanghu/receipts/` every five
+minutes.
+
+Real addresses and SSH identity paths belong in `/etc/guanghu/nodes/ssh/config`
+on the ops center, never in this repository.
+
+`cluster-probe.sh` is the six-node generic read-only probe. The systemd instance name is resolved by `probe-from-map.sh`; callers cannot inject an address, identity path, or arbitrary SSH alias. Each node gets an independent timer and receipt.
+
+`enroll-bs-sg-001-from-console.sh` is the one-time sovereign-console bridge for the v3.2 Singapore brain. It refuses any other hostname or Gatekeeper node id and installs one source-restricted JD public key. It never accepts a token, address, command, or key from terminal input.

server-tools/personal-node-probe/cluster-probe.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+NODE_ID=${1:?node id required}
+NODE_ALIAS=${2:?ssh alias required}
+SSH_CONFIG=${SSH_CONFIG:-/etc/guanghu/nodes/ssh/config}
+RECEIPT_DIR=${RECEIPT_DIR:-/var/lib/guanghu/receipts}
+
+remote=$(ssh -F "$SSH_CONFIG" -o BatchMode=yes -o ConnectTimeout=8 "$NODE_ALIAS" '
+  set -e
+  gatekeeper=null
+  for port in 3911 3910; do
+    if curl -fsS --max-time 2 "http://127.0.0.1:$port/health" >/tmp/guanghu-node-health.json 2>/dev/null; then
+      gatekeeper=$(jq -c "{ok,service,version,auth_mode}" /tmp/guanghu-node-health.json 2>/dev/null || echo "{\"ok\":true}")
+      break
+    fi
+  done
+  rm -f /tmp/guanghu-node-health.json
+  jq -n --arg hostname "$(hostname)" --arg disk_used "$(df --output=pcent / | tail -1 | tr -d " ")" \
+    --arg uptime_seconds "$(cut -d. -f1 /proc/uptime)" --argjson gatekeeper "${gatekeeper:-null}" \
+    "{hostname:\$hostname,disk_used:\$disk_used,uptime_seconds:(\$uptime_seconds|tonumber),gatekeeper:\$gatekeeper}"
+')
+
+install -d -m 0750 -o root -g guanghu "$RECEIPT_DIR"
+target="$RECEIPT_DIR/$NODE_ID-latest.json"
+tmp=$(mktemp "$target.XXXXXX")
+trap 'rm -f "$tmp"' EXIT
+jq -n --arg node_id "$NODE_ID" --arg checked_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --argjson remote "$remote" \
+  '{schema:"guanghu.node-heartbeat/v1",ok:true,node_id:$node_id,checked_at:$checked_at,remote:$remote}' > "$tmp"
+install -m 0640 -o root -g guanghu "$tmp" "$target"
+cat "$target"

server-tools/personal-node-probe/enroll-bs-sg-001-from-console.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+NODE_ID=BS-SG-001
+EXPECTED_HOSTNAME=guanghu-lang-sg-001
+JD_SOURCE_CIDR=111.228.0.139/32
+KEY_ID=jd_ops_to_bs_sg_001
+PUBLIC_KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKJdOqsqD6UFrt3jFRYks07fKBHHsfD+NdMRQlpl+w3+ jd-ops-to-bs-sg-001-20260718'
+AUTHORIZED_KEYS=/root/.ssh/authorized_keys
+RESTRICTED_LINE="from=\"${JD_SOURCE_CIDR}\",no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty ${PUBLIC_KEY}"
+BACKUP_ROOT=/var/backups/guanghu/node-enrollment/${NODE_ID}
+RECEIPT_DIR=/var/lib/guanghu/node-enrollment
+
+if [[ ${EUID} -ne 0 ]]; then
+  echo "Run this fixed enrollment as root." >&2
+  exit 1
+fi
+
+if [[ ${1:-} == --rollback ]]; then
+  if [[ ! -f $AUTHORIZED_KEYS ]]; then
+    echo "authorized_keys does not exist; nothing to roll back"
+    exit 0
+  fi
+  temp=$(mktemp "${AUTHORIZED_KEYS}.rollback.XXXXXX")
+  trap 'rm -f "$temp"' EXIT
+  grep -vF -- "$RESTRICTED_LINE" "$AUTHORIZED_KEYS" > "$temp" || true
+  install -m 0600 -o root -g root "$temp" "$AUTHORIZED_KEYS"
+  echo "Removed only ${KEY_ID}; other authorized keys were preserved."
+  exit 0
+fi
+
+actual_hostname=$(hostname)
+if [[ $actual_hostname != "$EXPECTED_HOSTNAME" ]]; then
+  echo "Node identity mismatch: expected $EXPECTED_HOSTNAME, got $actual_hostname" >&2
+  exit 2
+fi
+
+status=$(curl -fsS --max-time 5 http://127.0.0.1:3911/status)
+server_id=$(python3 -c 'import json,sys; print(json.load(sys.stdin).get("server_id", ""))' <<<"$status")
+if [[ $server_id != "$NODE_ID" ]]; then
+  echo "Gatekeeper identity mismatch: expected $NODE_ID, got ${server_id:-missing}" >&2
+  exit 2
+fi
+
+install -d -m 0700 /root/.ssh
+touch "$AUTHORIZED_KEYS"
+chmod 0600 "$AUTHORIZED_KEYS"
+
+if grep -qxF -- "$RESTRICTED_LINE" "$AUTHORIZED_KEYS"; then
+  changed=false
+else
+  timestamp=$(date -u +%Y%m%dT%H%M%SZ)
+  backup_dir="$BACKUP_ROOT/$timestamp"
+  install -d -m 0700 "$backup_dir"
+  cp -a "$AUTHORIZED_KEYS" "$backup_dir/authorized_keys"
+  printf '%s\n' "$RESTRICTED_LINE" >> "$AUTHORIZED_KEYS"
+  changed=true
+fi
+
+install -d -m 0750 "$RECEIPT_DIR"
+python3 - "$changed" > "$RECEIPT_DIR/latest.json" <<'PY'
+import json, sys
+from datetime import datetime, timezone
+print(json.dumps({
+    "schema": "guanghu.node-enrollment-receipt/v1",
+    "node_id": "BS-SG-001",
+    "controller": "JD-OPS-CENTER",
+    "key_id": "jd_ops_to_bs_sg_001",
+    "source_restricted": True,
+    "port_forwarding": False,
+    "agent_forwarding": False,
+    "pty": False,
+    "changed": sys.argv[1] == "true",
+    "completed_at": datetime.now(timezone.utc).isoformat(),
+}, ensure_ascii=False, indent=2))
+PY
+chmod 0640 "$RECEIPT_DIR/latest.json"
+
+echo "BS-SG-001 enrollment complete. JD source restriction and non-forwarding guards are active."
+echo "Rollback: bash $0 --rollback"

server-tools/personal-node-probe/guanghu-cluster-node-probe@.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Guanghu read-only cluster probe for %i
+After=network-online.target
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/sbin/guanghu-cluster-node-probe-from-map %i
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/guanghu/receipts /root/.ssh
+

server-tools/personal-node-probe/guanghu-cluster-node-probe@.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Run Guanghu read-only cluster probe for %i every five minutes
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=5min
+RandomizedDelaySec=30
+Persistent=true
+
+[Install]
+WantedBy=timers.target

server-tools/personal-node-probe/guanghu-personal-node-probe.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Guanghu personal node read-only heartbeat probe
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=root
+EnvironmentFile=-/etc/guanghu/personal-node-probe.env
+ExecStart=/usr/local/sbin/guanghu-personal-node-probe
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=read-only
+ProtectSystem=strict
+ReadWritePaths=/var/lib/guanghu/receipts
+ReadOnlyPaths=/etc/guanghu/nodes /etc/guanghu/personal-node-probe.env

server-tools/personal-node-probe/guanghu-personal-node-probe.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Probe the first Guanghu personal node every five minutes
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=5min
+AccuracySec=30s
+Persistent=true
+
+[Install]
+WantedBy=timers.target

server-tools/personal-node-probe/probe-from-map.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+case "${1:-}" in
+  BS-GZ-006) alias_name=bs-gz-006 ;;
+  BS-SG-001) alias_name=bs-sg-001 ;;
+  BS-SG-002) alias_name=bs-sg-002 ;;
+  BS-SG-003) alias_name=bs-sg-003 ;;
+  ZY-SG-006) alias_name=zy-sg-006 ;;
+  BS-SH-005) alias_name=bs-sh-005 ;;
+  *) echo "unregistered node id" >&2; exit 2 ;;
+esac
+
+exec /usr/local/sbin/guanghu-cluster-node-probe "$1" "$alias_name"

server-tools/personal-node-probe/probe.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+NODE_ID=${NODE_ID:-BS-GZ-006}
+NODE_ALIAS=${NODE_ALIAS:-bs-gz-006}
+SSH_CONFIG=${SSH_CONFIG:-/etc/guanghu/nodes/ssh/config}
+RECEIPT_FILE=${RECEIPT_FILE:-/var/lib/guanghu/receipts/BS-GZ-006-latest.json}
+FRONT_DOOR_URL=${FRONT_DOOR_URL:-https://guanghulab.com/}
+APP_HUB_URL=${APP_HUB_URL:-https://guanghulab.com/jd/api/status}
+
+remote=$(ssh -F "$SSH_CONFIG" -o BatchMode=yes "$NODE_ALIAS" \
+  "set -e; jq -n \
+    --arg hostname \"\$(hostname)\" \
+    --arg nginx \"\$(systemctl is-active nginx)\" \
+    --arg tunnel \"\$(systemctl is-active guanghu-jd-web-tunnel.service)\" \
+    --arg disk_used \"\$(df --output=pcent / | tail -1 | tr -d ' ')\" \
+    --arg uptime_seconds \"\$(cut -d. -f1 /proc/uptime)\" \
+    '{hostname:\$hostname,nginx:\$nginx,tunnel:\$tunnel,disk_used:\$disk_used,uptime_seconds:(\$uptime_seconds|tonumber)}'")
+
+front_status=$(curl -fsS -o /dev/null -w '%{http_code}' "$FRONT_DOOR_URL")
+hub=$(curl -fsS "$APP_HUB_URL")
+tmp=$(mktemp "${RECEIPT_FILE}.XXXXXX")
+trap 'rm -f "$tmp"' EXIT
+
+jq -n \
+  --arg node_id "$NODE_ID" \
+  --arg checked_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+  --arg front_status "$front_status" \
+  --argjson remote "$remote" \
+  --argjson hub "$hub" \
+  '{schema:"guanghu.node-heartbeat/v1",ok:true,node_id:$node_id,checked_at:$checked_at,front_door_http:($front_status|tonumber),remote:$remote,jd_hub:{ok:$hub.ok,node_id:$hub.node_id,service:$hub.service}}' \
+  > "$tmp"
+install -m 0640 -o root -g guanghu "$tmp" "$RECEIPT_FILE"
+cat "$RECEIPT_FILE"

server-tools/personal-node-probe/test/enroll-bs-sg-001.test.js

@@ -0,0 +1,26 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const script = fs.readFileSync(path.join(__dirname, "..", "enroll-bs-sg-001-from-console.sh"), "utf8");
+
+test("BS-SG-001 enrollment is fixed to one node, source and public key", () => {
+  assert.match(script, /NODE_ID=BS-SG-001/);
+  assert.match(script, /EXPECTED_HOSTNAME=guanghu-lang-sg-001/);
+  assert.match(script, /JD_SOURCE_CIDR=111\.228\.0\.139\/32/);
+  assert.match(script, /jd_ops_to_bs_sg_001/);
+  assert.match(script, /no-port-forwarding/);
+  assert.match(script, /no-agent-forwarding/);
+  assert.doesNotMatch(script, /eval|bash\s+-c|\$\{cmd\}/);
+});
+
+test("enrollment validates Gatekeeper identity and provides a narrow rollback", () => {
+  assert.match(script, /127\.0\.0\.1:3911\/status/);
+  assert.match(script, /Gatekeeper identity mismatch/);
+  assert.match(script, /--rollback/);
+  assert.match(script, /grep -vF/);
+  assert.match(script, /other authorized keys were preserved/);
+});

server-tools/personal-node-probe/test/probe.test.js

@@ -0,0 +1,24 @@
+"use strict";
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+const test = require("node:test");
+
+const root = path.join(__dirname, "..");
+const probe = fs.readFileSync(path.join(root, "probe.sh"), "utf8");
+const timer = fs.readFileSync(path.join(root, "guanghu-personal-node-probe.timer"), "utf8");
+
+test("probe uses a private SSH alias and fixed read-only command", () => {
+  assert.match(probe, /NODE_ALIAS/);
+  assert.match(probe, /systemctl is-active nginx/);
+  assert.match(probe, /df --output=pcent/);
+  assert.doesNotMatch(probe, /(?:\d{1,3}\.){3}\d{1,3}/);
+  assert.doesNotMatch(probe, /token|password|private[_ -]?key/i);
+});
+
+test("probe writes a latest receipt and runs periodically", () => {
+  assert.match(probe, /RECEIPT_FILE/);
+  assert.match(timer, /OnUnitActiveSec=5min/);
+  assert.match(timer, /Persistent=true/);
+});