feat: Agent distribution with secure enrollment from the control panel
One universal Windows Agent package per version (agent_releases: version/ platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary lives on a local release-storage volume, never in PostgreSQL). An operator creates a pending installation (agent_enrollments) from Agents / Servidores -> + Nova instalação, then either downloads it directly or generates a one-time HTTPS link (short TTL, single use). Either path streams the package plus a freshly minted enrollment.json whose token is never written to storage in plaintext, only its SHA-256 hash. On the client host, gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non- HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment token immediately after, success or failure), writes an ACL-restricted .env with the newly issued permanent Agent token, and registers the Windows Service without starting it (Firebird stays unconfigured on purpose). Idempotent, replay-proof, rate-limited per IP, fully audited, never logs a secret. Migration 0022_agent_releases_enrollment (verified fresh-DB == upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION bumped to 1.1.0 as the single source of truth across code, packages, the release manifest and every published AgentRelease row. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
gti
Claude Sonnet 5
@@ -19,4 +19,4 @@ FB_PASSWORD=
|
||||
FISCAL_MODE=DRY_RUN
|
||||
FIREBIRD_WRITES=0
|
||||
POLL_INTERVAL_SECONDS=5
|
||||
AGENT_VERSION=1.0.0-rc1
|
||||
AGENT_VERSION=1.1.0
|
||||
|
||||
@@ -1,8 +1,12 @@
|
||||
<#
|
||||
GTI Fiscal Agent - Windows operations script (RC1). No Python editing needed.
|
||||
|
||||
Usage (elevated PowerShell for install/start/stop/restart/uninstall):
|
||||
.\gti-agent.ps1 install create venv, install dependencies, register the Windows Service (does NOT start it)
|
||||
Usage (elevated PowerShell for install/install-auto/start/stop/restart/uninstall):
|
||||
.\gti-agent.ps1 install-auto bundle downloaded from the panel's "Nova instalação": verifies the
|
||||
package's SHA-256, enrolls with the Hub using enrollment.json (deleted
|
||||
right after, single use), writes .env, registers the service. Does NOT
|
||||
start it — Firebird is still unconfigured; fill it in and run start.
|
||||
.\gti-agent.ps1 install manual path: create venv, install dependencies, register the Windows Service (does NOT start it)
|
||||
.\gti-agent.ps1 configure [-FromTemplate f] write <install>\.env (secrets are prompted, never echoed, never stored in the package)
|
||||
.\gti-agent.ps1 preflight PREFLIGHT=PASS|FAIL with blockers (read-only)
|
||||
.\gti-agent.ps1 start | stop | restart service control (start refuses to run when preflight fails)
|
||||
@@ -13,7 +17,7 @@
|
||||
#>
|
||||
param(
|
||||
[Parameter(Position = 0, Mandatory = $true)]
|
||||
[ValidateSet('install', 'configure', 'preflight', 'start', 'stop', 'restart', 'status', 'uninstall')]
|
||||
[ValidateSet('install', 'install-auto', 'configure', 'preflight', 'start', 'stop', 'restart', 'status', 'uninstall')]
|
||||
[string]$Command,
|
||||
[string]$FromTemplate,
|
||||
[switch]$Purge
|
||||
@@ -58,6 +62,90 @@ switch ($Command) {
|
||||
sc.exe failure $ServiceName reset= 86400 actions= restart/60000/restart/60000/restart/60000 | Out-Null
|
||||
Write-Host "Service $ServiceName registered (Automatic). Next: .\gti-agent.ps1 configure ; .\gti-agent.ps1 preflight ; .\gti-agent.ps1 start"
|
||||
}
|
||||
'install-auto' {
|
||||
Assert-Admin
|
||||
$EnrollmentFile = Join-Path $Root 'enrollment.json'
|
||||
$ManifestFile = Join-Path $Root 'MANIFEST.json'
|
||||
|
||||
# Idempotent: a second run after a successful enroll must not re-enroll,
|
||||
# re-register the service, or touch the existing identity.
|
||||
if ((Test-Path $EnvFile) -and (Select-String -Path $EnvFile -Pattern '^AGENT_TOKEN=\S' -Quiet) -and (Get-Service $ServiceName -ErrorAction SilentlyContinue)) {
|
||||
Write-Host "Already enrolled and installed ($EnvFile exists, service $ServiceName registered). Nothing to do."
|
||||
exit 0
|
||||
}
|
||||
if (-not (Test-Path $EnrollmentFile)) { throw "enrollment.json not found in $Root — this bundle was already installed, or was not downloaded from a pending installation link." }
|
||||
if (-not (Get-Command python -ErrorAction SilentlyContinue)) { throw 'Python 3.12 (64-bit) is required on PATH.' }
|
||||
|
||||
$enrollment = Get-Content $EnrollmentFile -Raw | ConvertFrom-Json
|
||||
if ($enrollment.hub_url -notmatch '^https://') { throw "Refusing: hub_url must be https:// (got: $($enrollment.hub_url))" }
|
||||
|
||||
# Package integrity: every file this manifest lists must still match its
|
||||
# recorded SHA-256 — catches a corrupted or tampered extraction before
|
||||
# anything in it runs or is installed as a service.
|
||||
if (Test-Path $ManifestFile) {
|
||||
$manifest = Get-Content $ManifestFile -Raw | ConvertFrom-Json
|
||||
$checked = 0
|
||||
foreach ($entry in $manifest.files.PSObject.Properties) {
|
||||
$target = Join-Path $Root $entry.Name
|
||||
if (-not (Test-Path $target)) { throw "SHA256_VALIDATION=FAIL: missing file $($entry.Name)" }
|
||||
$actual = (Get-FileHash -Path $target -Algorithm SHA256).Hash.ToLower()
|
||||
if ($actual -ne $entry.Value) { throw "SHA256_VALIDATION=FAIL: $($entry.Name) does not match the published manifest" }
|
||||
$checked++
|
||||
}
|
||||
Write-Host "SHA256_VALIDATION=PASS ($checked files)"
|
||||
} else {
|
||||
Write-Host 'SHA256_VALIDATION=SKIPPED (no MANIFEST.json in this bundle)'
|
||||
}
|
||||
|
||||
$agentVersion = ((Get-Content (Join-Path $Root 'VERSION') -Raw) -replace '\s', '')
|
||||
$machineId = try { (Get-CimInstance Win32_ComputerSystemProduct -ErrorAction Stop).UUID } catch { '' }
|
||||
$body = @{
|
||||
installation_id = $enrollment.installation_id
|
||||
enrollment_token = $enrollment.enrollment_token
|
||||
agent_version = $agentVersion
|
||||
hostname = $env:COMPUTERNAME
|
||||
platform = 'windows'
|
||||
machine_fingerprint = $machineId
|
||||
} | ConvertTo-Json
|
||||
|
||||
Write-Host "Enrolling installation $($enrollment.installation_id) at $($enrollment.hub_url)..."
|
||||
try {
|
||||
$response = Invoke-RestMethod -Method Post -Uri "$($enrollment.hub_url)$($enrollment.enroll_path)" -Body $body -ContentType 'application/json'
|
||||
} catch {
|
||||
throw "ENROLLMENT_REJECTED: $($_.Exception.Message)"
|
||||
}
|
||||
if ($response.hostname_mismatch) {
|
||||
Write-Warning 'hostname_mismatch=true: the operator expected a different hostname for this installation. Enrollment still succeeded — confirm this is the intended machine.'
|
||||
}
|
||||
|
||||
# The Hub already rejects any reuse of this token, but the bundle's own
|
||||
# copy is deleted immediately too, so it never lingers on disk.
|
||||
Remove-Item $EnrollmentFile -Force
|
||||
|
||||
$lines = @(
|
||||
"GTI_HUB_URL=$($response.hub_url)", "AGENT_TOKEN=$($response.agent_token)", "AGENT_ID=$($response.agent_id)",
|
||||
'FISCAL_MODE=DRY_RUN', 'FIREBIRD_WRITES=0', 'POLL_INTERVAL_SECONDS=5', "AGENT_VERSION=$agentVersion",
|
||||
'FIREBIRD_DATABASE_PATH=', 'FB_USER=SYSDBA', 'FB_PASSWORD=', 'COMPANY_CODE=', 'COMPANY_CNPJ=', 'COMPANY_CRT_SOURCE=AUTO'
|
||||
)
|
||||
Set-Content -Path $EnvFile -Value $lines -Encoding UTF8
|
||||
# Only Administrators and SYSTEM may read the file that now holds AGENT_TOKEN.
|
||||
icacls $EnvFile /inheritance:r /grant:r 'Administrators:(F)' 'SYSTEM:(F)' | Out-Null
|
||||
|
||||
if (-not (Test-Path $Py)) { python -m venv $Venv }
|
||||
& $Py -m pip install --upgrade pip | Out-Null
|
||||
& $Py -m pip install -r (Join-Path $Root 'requirements-agent.txt')
|
||||
$post = Join-Path $Venv 'Scripts\pywin32_postinstall.py'
|
||||
if (Test-Path $post) { & $Py $post -install | Out-Null }
|
||||
$svc = Join-Path $Root 'agent\service\gti_agent_windows_service.py'
|
||||
& $Py $svc --startup=auto install
|
||||
sc.exe failure $ServiceName reset= 86400 actions= restart/60000/restart/60000/restart/60000 | Out-Null
|
||||
|
||||
Write-Host ''
|
||||
Write-Host "ENROLLMENT_SUCCEEDED: agent_id=$($response.agent_id) hub=$($response.hub_url)"
|
||||
Write-Host "Service $ServiceName registered (Automatic) but NOT started — Firebird is still unconfigured (by design: this script never guesses a client's database path or credentials)."
|
||||
Write-Host "Next: edit $EnvFile (FIREBIRD_DATABASE_PATH, FB_USER, FB_PASSWORD, and COMPANY_CODE/COMPANY_CNPJ if needed),"
|
||||
Write-Host ' then: .\gti-agent.ps1 preflight ; .\gti-agent.ps1 start'
|
||||
}
|
||||
'configure' {
|
||||
if ($FromTemplate) {
|
||||
Copy-Item -Path $FromTemplate -Destination $EnvFile -Force
|
||||
@@ -76,7 +164,7 @@ switch ($Command) {
|
||||
"GTI_HUB_URL=$hub", "AGENT_TOKEN=$token", "AGENT_ID=$agentId",
|
||||
"COMPANY_CODE=$code", "COMPANY_CNPJ=$cnpj", "COMPANY_CRT_SOURCE=$crtSource",
|
||||
"FIREBIRD_DATABASE_PATH=$db", "FB_USER=$fbUser", "FB_PASSWORD=$fbPass",
|
||||
'FISCAL_MODE=DRY_RUN', 'FIREBIRD_WRITES=0', 'POLL_INTERVAL_SECONDS=5', 'AGENT_VERSION=1.0.0-rc1'
|
||||
'FISCAL_MODE=DRY_RUN', 'FIREBIRD_WRITES=0', 'POLL_INTERVAL_SECONDS=5', 'AGENT_VERSION=1.1.0'
|
||||
)
|
||||
Set-Content -Path $EnvFile -Value $lines -Encoding UTF8
|
||||
}
|
||||
|
||||
@@ -19,4 +19,4 @@ FB_PASSWORD=
|
||||
FISCAL_MODE=DRY_RUN
|
||||
FIREBIRD_WRITES=0
|
||||
POLL_INTERVAL_SECONDS=5
|
||||
AGENT_VERSION=1.0.0-rc1
|
||||
AGENT_VERSION=1.1.0
|
||||
|
||||
@@ -19,4 +19,4 @@ FB_PASSWORD=
|
||||
FISCAL_MODE=DRY_RUN
|
||||
FIREBIRD_WRITES=0
|
||||
POLL_INTERVAL_SECONDS=5
|
||||
AGENT_VERSION=1.0.0-rc1
|
||||
AGENT_VERSION=1.1.0
|
||||
|
||||
@@ -19,4 +19,4 @@ FB_PASSWORD=
|
||||
FISCAL_MODE=DRY_RUN
|
||||
FIREBIRD_WRITES=0
|
||||
POLL_INTERVAL_SECONDS=5
|
||||
AGENT_VERSION=1.0.0-rc1
|
||||
AGENT_VERSION=1.1.0
|
||||
|
||||
@@ -19,4 +19,4 @@ FB_PASSWORD=
|
||||
FISCAL_MODE=DRY_RUN
|
||||
FIREBIRD_WRITES=0
|
||||
POLL_INTERVAL_SECONDS=5
|
||||
AGENT_VERSION=1.0.0-rc1
|
||||
AGENT_VERSION=1.1.0
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# GTI Fiscal Hub — production environment (copy to .env, never commit .env)
|
||||
GTI_FISCAL_VERSION=1.0.0-rc1
|
||||
GTI_FISCAL_VERSION=1.1.0
|
||||
|
||||
# REQUIRED. URL-safe secret (used inside a connection URL): openssl rand -hex 24
|
||||
POSTGRES_PASSWORD=
|
||||
@@ -27,5 +27,11 @@ FEDERATED_SESSION_SECONDS=3600
|
||||
LOG_LEVEL=INFO
|
||||
AGENT_ONLINE_THRESHOLD_SECONDS=120
|
||||
|
||||
# Agent distribution (docs/PILOT_DEPLOYMENT.md, "Agent distribution"). Defaults
|
||||
# are safe; override only if the pilot needs a longer/shorter window.
|
||||
# AGENT_DOWNLOAD_LINK_TTL_SECONDS=1800
|
||||
# AGENT_DOWNLOAD_MAX_USES_DEFAULT=1
|
||||
# AGENT_ENROLLMENT_TTL_SECONDS=86400
|
||||
|
||||
# Directory (host) where pg_dump backups are written by backup.sh
|
||||
BACKUP_DIR=./backups
|
||||
|
||||
@@ -36,7 +36,7 @@ services:
|
||||
build:
|
||||
context: ../..
|
||||
dockerfile: central/Dockerfile
|
||||
image: gti-fiscal-hub:${GTI_FISCAL_VERSION:-1.0.0-rc1}
|
||||
image: gti-fiscal-hub:${GTI_FISCAL_VERSION:-1.1.0}
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
postgres:
|
||||
@@ -57,7 +57,16 @@ services:
|
||||
SSO_GERENCIADOR_CHAVE_PUBLICA: ${SSO_GERENCIADOR_CHAVE_PUBLICA:-}
|
||||
SSO_START_URL: ${SSO_START_URL:-}
|
||||
FEDERATED_SESSION_SECONDS: ${FEDERATED_SESSION_SECONDS:-3600}
|
||||
# AGENT_DEV_TOKEN is intentionally NOT set: real Agents are registered with central/scripts/register_agent.py.
|
||||
# AGENT_DEV_TOKEN is intentionally NOT set: real Agents are registered with central/scripts/register_agent.py
|
||||
# (manually) or auto-provisioned via a successful POST /v1/agents/enroll (secure enrollment).
|
||||
# Agent distribution (central/app/agent_distribution.py): the universal package zip lives on the
|
||||
# agent_releases volume below, never in PostgreSQL. TTLs have safe defaults; override only if needed.
|
||||
AGENT_RELEASE_STORAGE_PATH: /app/data/releases
|
||||
AGENT_DOWNLOAD_LINK_TTL_SECONDS: ${AGENT_DOWNLOAD_LINK_TTL_SECONDS:-1800}
|
||||
AGENT_DOWNLOAD_MAX_USES_DEFAULT: ${AGENT_DOWNLOAD_MAX_USES_DEFAULT:-1}
|
||||
AGENT_ENROLLMENT_TTL_SECONDS: ${AGENT_ENROLLMENT_TTL_SECONDS:-86400}
|
||||
volumes:
|
||||
- agent_releases:/app/data/releases
|
||||
ports:
|
||||
- "${HUB_BIND:-127.0.0.1}:${HUB_PORT:-8000}:8000"
|
||||
networks: [internal, edge]
|
||||
@@ -76,3 +85,4 @@ networks:
|
||||
|
||||
volumes:
|
||||
postgres_data:
|
||||
agent_releases:
|
||||
|
||||
Reference in New Issue
Block a user