Сборка: добавить production packaging flow через .deb

Добавлен package-режим в tools/build.sh: --package, --dist-dir, --version. Реализована сборка Debian-пакета, metadata/control, postinst/postrm и SHA256SUMS. Установочные пути унифицированы под /usr/sbin и /lib/systemd/system для production-модели.
2026-05-10 17:26:11 +05:00
parent 76c6b52f4e
commit 9d2d2bc0c2
9 changed files with 307 additions and 143 deletions
@@ -10,6 +10,10 @@ Unit: [`awg2-harness.service`](../awg2-harness.service).
 - Debian/Ubuntu (apt-based)
 - amd64/x86_64

+## Purpose
+
+Скрипт используется на build-machine для проверки, сборки и упаковки AWG2 Harness.
+
 ## Default mode

 ```bash
@@ -28,29 +32,38 @@ Unit: [`awg2-harness.service`](../awg2-harness.service).
 - `--prepare-runtime-env` — установить недостающие runtime-пакеты;
 - `--bootstrap-rust` — установить rustup и pinned toolchain;
 - `--build` — запустить build gate явно;
+- `--package` — собрать Debian-пакет в `dist/`;
+- `--dist-dir <path>` — директория для release artifacts;
+- `--version <version>` — переопределить версию пакета;
 - `--install` — установить бинарь + systemd unit (без enable/start);
 - `--enable` — `systemctl enable --now awg2-harness.service`;
 - `--yes` — подтверждение системных изменений (apt/rustup);
 - `--skip-fmt` — пропустить `cargo fmt --check`;
 - `--help` — справка.

-## Typical build machine flow
+## Build machine flow

 ```bash
 ./tools/build.sh --prepare-build-env --bootstrap-rust --yes
-./tools/build.sh
+./tools/build.sh --build
+./tools/build.sh --package
 ```

-## Typical production host flow
+## Production host flow
+
+В нормальном production deployment **не нужно** клонировать репозиторий на целевой хост.
+Ставится сгенерированный пакет:

 ```bash
-./tools/build.sh --prepare-runtime-env --yes
-install -d -m 0755 /etc/awg2-harness
-install -m 0644 config.toml /etc/awg2-harness/config.toml
-./tools/build.sh --install
-./tools/build.sh --enable
+apt install ./awg2-harness_*_amd64.deb
 ```

+## Manual source-tree install
+
+`--install` и `--enable` оставлены для staging/debug из checked-out source tree.
+
+Это **не рекомендуемый** production path.
+
 ## What the script intentionally does not do

 - не устанавливает Docker автоматически;
@@ -11,12 +11,16 @@ PREPARE_BUILD_ENV=false
 PREPARE_RUNTIME_ENV=false
 BOOTSTRAP_RUST=false
 DO_BUILD=false
+PACKAGE=false
 INSTALL=false
 ENABLE=false
 YES=false
 SKIP_FMT=false
 HAS_ACTION=false

+DIST_DIR="$ROOT_DIR/dist"
+PACKAGE_VERSION=""
+
 RUN_AS_ROOT=()

 BUILD_PACKAGES=(
@@ -26,6 +30,7 @@ BUILD_PACKAGES=(
  pkg-config
  file
  shellcheck
+  dpkg-dev
 )

 RUNTIME_PACKAGES=(
@@ -46,6 +51,8 @@ Usage:
  ./tools/build.sh --prepare-runtime-env --yes
  ./tools/build.sh --bootstrap-rust --yes
  ./tools/build.sh --build
+  ./tools/build.sh --package
+  ./tools/build.sh --build --package
  ./tools/build.sh --install
  ./tools/build.sh --enable

@@ -54,27 +61,45 @@ Flags:
  --prepare-runtime-env Install missing runtime dependencies via apt
  --bootstrap-rust      Install rustup/toolchain pinned by this repo
  --build               Run build gate (default when no action flags)
+  --package             Build Debian package into dist/ (runs build gate by default)
+  --dist-dir <path>     Output directory for package artifacts (default: ./dist)
+  --version <version>   Override package version (default: read from Cargo.toml)
  --install             Install binary and systemd unit (no enable/start)
  --enable              Enable and start awg2-harness.service
  --yes                 Confirm system mutations (apt/rustup)
  --skip-fmt            Skip cargo fmt --check
  --help                Show this help
+Notes:
+  --install is for manual source-tree installs (staging/debug).
+  Preferred production flow is package-based deployment via apt install ./awg2-harness_<version>_amd64.deb
 EOF
 }

-for arg in "$@"; do
-  case "$arg" in
+while [[ $# -gt 0 ]]; do
+  case "$1" in
    --prepare-build-env) PREPARE_BUILD_ENV=true; HAS_ACTION=true ;;
    --prepare-runtime-env) PREPARE_RUNTIME_ENV=true; HAS_ACTION=true ;;
    --bootstrap-rust) BOOTSTRAP_RUST=true; HAS_ACTION=true ;;
    --build) DO_BUILD=true; HAS_ACTION=true ;;
+    --package) PACKAGE=true; HAS_ACTION=true ;;
+    --dist-dir)
+      [[ $# -ge 2 ]] || { echo "--dist-dir requires value"; exit 1; }
+      DIST_DIR="$2"
+      shift
+      ;;
+    --version)
+      [[ $# -ge 2 ]] || { echo "--version requires value"; exit 1; }
+      PACKAGE_VERSION="$2"
+      shift
+      ;;
    --install) INSTALL=true; HAS_ACTION=true ;;
    --enable) ENABLE=true; HAS_ACTION=true ;;
    --yes) YES=true ;;
    --skip-fmt) SKIP_FMT=true ;;
    --help|-h) usage; exit 0 ;;
-    *) echo "Unknown arg: $arg"; usage; exit 1 ;;
+    *) echo "Unknown arg: $1"; usage; exit 1 ;;
  esac
+  shift
 done

 if [[ "$HAS_ACTION" == false ]]; then
@@ -219,15 +244,121 @@ install_artifacts() {
  fi

  setup_root_runner
-  "${RUN_AS_ROOT[@]}" install -m 0755 "$TARGET_BIN" /usr/local/bin/awg2-harness
-  "${RUN_AS_ROOT[@]}" install -m 0644 "$ROOT_DIR/awg2-harness.service" /etc/systemd/system/awg2-harness.service
+  "${RUN_AS_ROOT[@]}" install -d -m 0755 /usr/sbin
+  "${RUN_AS_ROOT[@]}" install -m 0755 "$TARGET_BIN" /usr/sbin/awg2-harness
+  "${RUN_AS_ROOT[@]}" install -d -m 0755 /lib/systemd/system
+  "${RUN_AS_ROOT[@]}" install -m 0644 "$ROOT_DIR/awg2-harness.service" /lib/systemd/system/awg2-harness.service

  if command -v systemd-analyze >/dev/null 2>&1; then
-    "${RUN_AS_ROOT[@]}" systemd-analyze verify /etc/systemd/system/awg2-harness.service
+    "${RUN_AS_ROOT[@]}" systemd-analyze verify /lib/systemd/system/awg2-harness.service
  fi
  "${RUN_AS_ROOT[@]}" systemctl daemon-reload
 }

+read_package_version_from_manifest() {
+  awk -F '"' '/^version\s*=\s*"/ { print $2; exit }' "$CRATE_MANIFEST"
+}
+
+package_deb() {
+  require_cmd dpkg-deb
+  require_cmd install
+  require_cmd sha256sum
+  require_cmd file
+  require_cmd ldd
+  require_cmd mktemp
+
+  if [[ "$DO_BUILD" != true ]]; then
+    prepare_build_gate
+  fi
+
+  if [[ ! -f "$TARGET_BIN" ]]; then
+    echo "Binary not found after build: $TARGET_BIN"
+    exit 1
+  fi
+
+  local version
+  if [[ -n "$PACKAGE_VERSION" ]]; then
+    version="$PACKAGE_VERSION"
+  else
+    version="$(read_package_version_from_manifest)"
+  fi
+
+  if [[ -z "$version" ]]; then
+    echo "Unable to determine package version"
+    exit 1
+  fi
+
+  local staging
+  staging="$(mktemp -d)"
+  trap 'rm -rf "$staging"' RETURN
+
+  install -d -m 0755 "$staging/DEBIAN"
+  install -d -m 0755 "$staging/usr/sbin"
+  install -d -m 0755 "$staging/lib/systemd/system"
+  install -d -m 0755 "$staging/usr/share/doc/awg2-harness"
+
+  install -m 0755 "$TARGET_BIN" "$staging/usr/sbin/awg2-harness"
+  install -m 0644 "$ROOT_DIR/awg2-harness.service" "$staging/lib/systemd/system/awg2-harness.service"
+  install -m 0644 "$ROOT_DIR/config.example.toml" "$staging/usr/share/doc/awg2-harness/config.example.toml"
+  install -m 0644 "$ROOT_DIR/README.md" "$staging/usr/share/doc/awg2-harness/README.md"
+  install -m 0644 "$ROOT_DIR/docs/INSTALLATION.md" "$staging/usr/share/doc/awg2-harness/INSTALLATION.md"
+
+  cat >"$staging/DEBIAN/control" <<EOF
+Package: awg2-harness
+Version: $version
+Section: net
+Priority: optional
+Architecture: amd64
+Maintainer: AWG2 Harness
+Depends: libc6, iproute2, wireguard-tools, nftables, kmod, util-linux, procps, systemd
+Recommends: docker.io
+Description: Host-side orchestrator for AmneziaWG traffic shaping and lifecycle recovery
+ AWG2 Harness manages AmneziaWG traffic shaping, IFB ingress shaping,
+ nftables anti-torrent guard, reboot scheduling, swap setup and daemonized
+ drift recovery on dedicated Debian hosts.
+EOF
+
+  cat >"$staging/DEBIAN/postinst" <<'EOF'
+#!/bin/sh
+set -e
+
+if command -v systemctl >/dev/null 2>&1; then
+  systemctl daemon-reload || true
+fi
+
+exit 0
+EOF
+
+  cat >"$staging/DEBIAN/postrm" <<'EOF'
+#!/bin/sh
+set -e
+
+if command -v systemctl >/dev/null 2>&1; then
+  systemctl daemon-reload || true
+fi
+
+exit 0
+EOF
+
+  chmod 0755 "$staging/DEBIAN/postinst" "$staging/DEBIAN/postrm"
+
+  mkdir -p "$DIST_DIR"
+  local pkg_name
+  pkg_name="awg2-harness_${version}_amd64.deb"
+  local pkg_path
+  pkg_path="$DIST_DIR/$pkg_name"
+
+  dpkg-deb --build "$staging" "$pkg_path"
+
+  (
+    cd "$DIST_DIR"
+    sha256sum "$pkg_name" > SHA256SUMS
+  )
+
+  echo "Package created: $pkg_path"
+  echo "Checksums: $DIST_DIR/SHA256SUMS"
+}
+
 enable_service() {
  require_cmd systemctl
  setup_root_runner
@@ -252,6 +383,10 @@ if [[ "$DO_BUILD" == true ]]; then
  prepare_build_gate
 fi

+if [[ "$PACKAGE" == true ]]; then
+  package_deb
+fi
+
 if [[ "$INSTALL" == true ]]; then
  install_artifacts
 fi