Rogue
5ca22ec340
agent_nodes gains probe_only; getConfig always serves the flag and withholds the sing-box payload (null config, empty hash) for flagged nodes while probe tasks, fast interval, stat iface and update intents ride as usual. The agent gates both core branches when the local agent.json preset or the master flag is on, retires a running core once (best-effort tail flush, switchover bookkeeping untouched so turning the flag off self-heals through the existing hash-current-but-not-running path), and makes the traffic cycle an explicit no-op. Panel: node create/update accept probeOnly, the node view overlays it from the binding, the node form gains a switch (carried into the generated install command), the list shows a probe-only tag in the core-version cell, and install-agent.sh --probe-only writes the preset, skips the core download/self-check and inherits the flag on no-arg reruns.
385 lines
16 KiB
Go
385 lines
16 KiB
Go
package service
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/mhsanaei/3x-ui/v3/internal/config"
|
|
"github.com/mhsanaei/3x-ui/v3/internal/database"
|
|
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
|
"github.com/mhsanaei/3x-ui/v3/internal/util/common"
|
|
)
|
|
|
|
// NodeView is the browser/API read contract for nodes. Credentials are
|
|
// write-only: responses expose only whether a node has a token configured.
|
|
type NodeView struct {
|
|
Id int `json:"id" example:"1"`
|
|
Name string `json:"name" example:"edge-1"`
|
|
Remark string `json:"remark" example:"Primary edge"`
|
|
Scheme string `json:"scheme" example:"https"`
|
|
Address string `json:"address" example:"node.example.com"`
|
|
Port int `json:"port" example:"2053"`
|
|
BasePath string `json:"basePath" example:"/"`
|
|
HasApiToken bool `json:"hasApiToken" example:"true"`
|
|
Enable bool `json:"enable" example:"true"`
|
|
AllowPrivateAddress bool `json:"allowPrivateAddress" example:"false"`
|
|
TlsVerifyMode string `json:"tlsVerifyMode" example:"verify"`
|
|
PinnedCertSha256 string `json:"pinnedCertSha256" example:""`
|
|
InboundSyncMode string `json:"inboundSyncMode" example:"all"`
|
|
InboundTags []string `json:"inboundTags" example:"[\"in-443-tcp\"]"`
|
|
OutboundTag string `json:"outboundTag" example:"direct"`
|
|
// NodeType is "agent" for lightweight agent-managed nodes (an agent is
|
|
// bound to the node) and "traditional" otherwise. It is derived from the
|
|
// agent binding, not stored on the node row; read paths that serve the
|
|
// panel UI annotate it via annotateNodeTypes. Empty on views built
|
|
// outside those paths.
|
|
NodeType string `json:"nodeType,omitempty" example:"traditional"`
|
|
// Ipv4/Ipv6 carry the resolved externally usable host addresses for
|
|
// agent nodes (P13 telemetry, public-address resolution on top).
|
|
// The nodes page renders them as plain text on agent rows instead
|
|
// of the panel-URL link used for traditional nodes. Empty for
|
|
// traditional nodes and for agents with no known address yet.
|
|
Ipv4 string `json:"ipv4,omitempty" example:"203.0.113.7"`
|
|
Ipv6 string `json:"ipv6,omitempty" example:"2001:db8::7"`
|
|
// ProbeOnly marks an agent node as probe-only (V2.1.0): no core
|
|
// runs on it, only the probe channels. Overlaid from the bound
|
|
// agent row like the update bookkeeping below; false (and absent)
|
|
// for traditional nodes and unflagged agents.
|
|
ProbeOnly bool `json:"probeOnly,omitempty" example:"false"`
|
|
// Agent one-click update bookkeeping (item 20), agent nodes only:
|
|
// the last intent's state/target and, on failure, its error.
|
|
AgentUpdateState string `json:"agentUpdateState,omitempty" example:"failed"`
|
|
AgentUpdateError string `json:"agentUpdateError,omitempty" example:""`
|
|
AgentUpdateTarget string `json:"agentUpdateTarget,omitempty" example:"A1.0.1"`
|
|
Guid string `json:"guid" example:"node-guid"`
|
|
Status string `json:"status" example:"online"`
|
|
LastHeartbeat int64 `json:"lastHeartbeat" example:"1700000000"`
|
|
LatencyMs int `json:"latencyMs" example:"42"`
|
|
XrayVersion string `json:"xrayVersion" example:"25.10.31"`
|
|
// SingboxVersion is the bound agent's sing-box core version
|
|
// (V2.0.1 ②), overlaid from agent telemetry like XrayVersion;
|
|
// empty for traditional nodes and agents that never reported
|
|
// one. The nodes page prefers it over XrayVersion when set.
|
|
SingboxVersion string `json:"singboxVersion" example:"1.13.21"`
|
|
PanelVersion string `json:"panelVersion" example:"v3.x.x"`
|
|
CpuPct float64 `json:"cpuPct" example:"12.5"`
|
|
MemPct float64 `json:"memPct" example:"45.2"`
|
|
UptimeSecs uint64 `json:"uptimeSecs" example:"86400"`
|
|
NetUp uint64 `json:"netUp" example:"2097152"`
|
|
NetDown uint64 `json:"netDown" example:"1048576"`
|
|
LastError string `json:"lastError" example:""`
|
|
XrayState string `json:"xrayState" example:"running"`
|
|
XrayError string `json:"xrayError" example:""`
|
|
ConfigDirty bool `json:"configDirty" example:"false"`
|
|
ConfigDirtyAt int64 `json:"configDirtyAt" example:"0"`
|
|
InboundCount int `json:"inboundCount" example:"3"`
|
|
ClientCount int `json:"clientCount" example:"25"`
|
|
OnlineCount int `json:"onlineCount" example:"5"`
|
|
ActiveCount int `json:"activeCount" example:"20"`
|
|
DisabledCount int `json:"disabledCount" example:"2"`
|
|
DepletedCount int `json:"depletedCount" example:"1"`
|
|
// Per-category client email lists behind the counts above, from the
|
|
// same attribution bucketing, so the nodes page category chips can
|
|
// pop over the actual usernames. Empty when the category is empty.
|
|
OnlineEmails []string `json:"onlineEmails,omitempty" example:"[\"a@example.com\"]"`
|
|
ActiveEmails []string `json:"activeEmails,omitempty" example:"[\"a@example.com\"]"`
|
|
DisabledEmails []string `json:"disabledEmails,omitempty" example:"[\"b@example.com\"]"`
|
|
DepletedEmails []string `json:"depletedEmails,omitempty" example:"[\"c@example.com\"]"`
|
|
ParentGuid string `json:"parentGuid,omitempty" example:""`
|
|
Transitive bool `json:"transitive,omitempty" example:"false"`
|
|
CreatedAt int64 `json:"createdAt" example:"1700000000"`
|
|
UpdatedAt int64 `json:"updatedAt" example:"1700003600"`
|
|
}
|
|
|
|
func toNodeView(n *model.Node) *NodeView {
|
|
if n == nil {
|
|
return nil
|
|
}
|
|
return &NodeView{
|
|
Id: n.Id,
|
|
Name: n.Name,
|
|
Remark: n.Remark,
|
|
Scheme: n.Scheme,
|
|
Address: n.Address,
|
|
Port: n.Port,
|
|
BasePath: n.BasePath,
|
|
HasApiToken: n.ApiToken != "",
|
|
Enable: n.Enable,
|
|
AllowPrivateAddress: n.AllowPrivateAddress,
|
|
TlsVerifyMode: n.TlsVerifyMode,
|
|
PinnedCertSha256: n.PinnedCertSha256,
|
|
InboundSyncMode: n.InboundSyncMode,
|
|
InboundTags: n.InboundTags,
|
|
OutboundTag: n.OutboundTag,
|
|
Guid: n.Guid,
|
|
Status: n.Status,
|
|
LastHeartbeat: n.LastHeartbeat,
|
|
LatencyMs: n.LatencyMs,
|
|
XrayVersion: n.XrayVersion,
|
|
PanelVersion: n.PanelVersion,
|
|
CpuPct: n.CpuPct,
|
|
MemPct: n.MemPct,
|
|
UptimeSecs: n.UptimeSecs,
|
|
NetUp: n.NetUp,
|
|
NetDown: n.NetDown,
|
|
LastError: n.LastError,
|
|
XrayState: n.XrayState,
|
|
XrayError: n.XrayError,
|
|
ConfigDirty: n.ConfigDirty,
|
|
ConfigDirtyAt: n.ConfigDirtyAt,
|
|
InboundCount: n.InboundCount,
|
|
ClientCount: n.ClientCount,
|
|
OnlineCount: n.OnlineCount,
|
|
ActiveCount: n.ActiveCount,
|
|
DisabledCount: n.DisabledCount,
|
|
DepletedCount: n.DepletedCount,
|
|
OnlineEmails: n.OnlineEmails,
|
|
ActiveEmails: n.ActiveEmails,
|
|
DisabledEmails: n.DisabledEmails,
|
|
DepletedEmails: n.DepletedEmails,
|
|
ParentGuid: n.ParentGuid,
|
|
Transitive: n.Transitive,
|
|
CreatedAt: n.CreatedAt,
|
|
UpdatedAt: n.UpdatedAt,
|
|
}
|
|
}
|
|
|
|
func toNodeViews(nodes []*model.Node) []*NodeView {
|
|
views := make([]*NodeView, 0, len(nodes))
|
|
for _, node := range nodes {
|
|
views = append(views, toNodeView(node))
|
|
}
|
|
return views
|
|
}
|
|
|
|
// agentManagedNodeIDs returns the set of node ids with at least one agent
|
|
// bound to them — the definition of an "agent node" in this codebase (the
|
|
// heartbeat job's probe skip uses the same test).
|
|
func agentManagedNodeIDs() map[int]bool {
|
|
ids := map[int]bool{}
|
|
var rows []int
|
|
_ = database.GetDB().Model(&model.AgentNode{}).
|
|
Where("node_id IS NOT NULL").
|
|
Distinct().
|
|
Pluck("node_id", &rows).Error
|
|
for _, id := range rows {
|
|
ids[id] = true
|
|
}
|
|
return ids
|
|
}
|
|
|
|
// IsAgentManaged reports whether the node has an agent bound to it.
|
|
func (s *NodeService) IsAgentManaged(id int) bool {
|
|
var count int64
|
|
_ = database.GetDB().Model(&model.AgentNode{}).Where("node_id = ?", id).Count(&count).Error
|
|
return count > 0
|
|
}
|
|
|
|
// annotateNodeTypes fills NodeType on views from the agent bindings so the
|
|
// UI can tell agent nodes apart from traditional panel nodes when editing.
|
|
func annotateNodeTypes(views []*NodeView) {
|
|
if len(views) == 0 {
|
|
return
|
|
}
|
|
agents := agentManagedNodeIDs()
|
|
for _, v := range views {
|
|
if agents[v.Id] {
|
|
v.NodeType = "agent"
|
|
} else {
|
|
v.NodeType = "traditional"
|
|
}
|
|
}
|
|
}
|
|
|
|
// annotateAgentTelemetry overlays the latest heartbeat telemetry reported
|
|
// by each node's bound agent onto its view (P13): xray version, the
|
|
// "agent <version>" panel-version label, host uptime, node->master latency,
|
|
// CPU/memory percentages and the host IPv4/IPv6 pair. The address pair is
|
|
// the resolved externally usable one (ResolveAgentAddresses), not the raw
|
|
// telemetry — a NAT'd agent only ever reports its private interface
|
|
// address. Views for traditional nodes (and agent nodes whose agent never
|
|
// reported telemetry) are left exactly as built. Must run after
|
|
// annotateNodeTypes.
|
|
func annotateAgentTelemetry(views []*NodeView) {
|
|
if len(views) == 0 {
|
|
return
|
|
}
|
|
var agents []model.AgentNode
|
|
// Latest reporter wins when more than one token is bound to a node.
|
|
_ = database.GetDB().Model(&model.AgentNode{}).
|
|
Where("node_id IS NOT NULL").
|
|
Order("last_seen DESC").
|
|
Find(&agents).Error
|
|
byNode := make(map[int]*model.AgentNode, len(agents))
|
|
for i := range agents {
|
|
if agents[i].NodeID == nil {
|
|
continue
|
|
}
|
|
if _, ok := byNode[*agents[i].NodeID]; !ok {
|
|
byNode[*agents[i].NodeID] = &agents[i]
|
|
}
|
|
}
|
|
for _, v := range views {
|
|
if v.NodeType != "agent" {
|
|
continue
|
|
}
|
|
ag, ok := byNode[v.Id]
|
|
if !ok {
|
|
continue
|
|
}
|
|
// Address resolution applies to every bound agent, even before
|
|
// its first telemetry report: an agent that has only registered
|
|
// already has a master-observed source address.
|
|
v.Ipv4, v.Ipv6 = ResolveAgentAddresses(ag)
|
|
// Probe-only (V2.1.0) is a stored flag, not telemetry: it must
|
|
// show even before the agent's first report, so it is overlaid
|
|
// here, ahead of the telemetry early-exit below.
|
|
v.ProbeOnly = ag.ProbeOnly
|
|
if ag.TelemetryAt == 0 {
|
|
continue
|
|
}
|
|
if ag.XrayVersion != "" {
|
|
v.XrayVersion = ag.XrayVersion
|
|
}
|
|
if ag.SingboxVersion != "" {
|
|
v.SingboxVersion = ag.SingboxVersion
|
|
}
|
|
if ag.AgentVersion != "" {
|
|
// New agents report the A-series display version, shown
|
|
// verbatim; older agents report the internal build version
|
|
// and keep the historical "agent " prefix.
|
|
if _, ok := config.ParseDisplayVersion(ag.AgentVersion); ok && strings.HasPrefix(ag.AgentVersion, "A") {
|
|
v.PanelVersion = ag.AgentVersion
|
|
} else {
|
|
v.PanelVersion = "agent " + ag.AgentVersion
|
|
}
|
|
v.AgentUpdateState = ag.UpdateState
|
|
v.AgentUpdateError = ag.UpdateError
|
|
v.AgentUpdateTarget = ag.UpdateTarget
|
|
}
|
|
v.UptimeSecs = ag.UptimeSecs
|
|
v.LatencyMs = ag.LatencyMs
|
|
v.CpuPct = ag.CpuPct
|
|
v.MemPct = ag.MemPct
|
|
}
|
|
}
|
|
|
|
// NodeMutationRequest is the node write/probe contract. ApiToken is accepted
|
|
// only as input. On update, nil means keep the stored token; replacement and
|
|
// clearing are explicit and mutually exclusive.
|
|
type NodeMutationRequest struct {
|
|
Id int `json:"id" form:"id"`
|
|
Name string `json:"name" form:"name" validate:"required"`
|
|
Remark string `json:"remark" form:"remark"`
|
|
Scheme string `json:"scheme" form:"scheme" validate:"omitempty,oneof=http https"`
|
|
Address string `json:"address" form:"address"`
|
|
Port int `json:"port" form:"port" validate:"gte=0,lte=65535"`
|
|
BasePath string `json:"basePath" form:"basePath"`
|
|
ApiToken *string `json:"apiToken,omitempty" form:"apiToken"`
|
|
ClearApiToken bool `json:"clearApiToken,omitempty" form:"clearApiToken"`
|
|
Enable bool `json:"enable" form:"enable"`
|
|
AllowPrivateAddress bool `json:"allowPrivateAddress" form:"allowPrivateAddress"`
|
|
TlsVerifyMode string `json:"tlsVerifyMode" form:"tlsVerifyMode" validate:"omitempty,oneof=verify skip pin mtls"`
|
|
PinnedCertSha256 string `json:"pinnedCertSha256" form:"pinnedCertSha256"`
|
|
InboundSyncMode string `json:"inboundSyncMode" form:"inboundSyncMode" validate:"omitempty,oneof=all selected"`
|
|
InboundTags []string `json:"inboundTags" form:"inboundTags"`
|
|
OutboundTag string `json:"outboundTag" form:"outboundTag"`
|
|
// NodeType distinguishes traditional panel-to-panel nodes from lightweight
|
|
// agent nodes. Agent nodes skip the panel reachability probe and the API
|
|
// token requirement; an agent token is issued on creation instead.
|
|
NodeType string `json:"nodeType,omitempty" form:"nodeType" validate:"omitempty,oneof=traditional agent"`
|
|
// ProbeOnly (V2.1.0) flips an agent node into probe-only mode. A
|
|
// pointer so updates can tell "leave the flag alone" (nil) from an
|
|
// explicit on/off; applied to the bound agent rows, agent nodes
|
|
// only. On create it presets the flag on the freshly issued agent.
|
|
ProbeOnly *bool `json:"probeOnly,omitempty" form:"probeOnly"`
|
|
}
|
|
|
|
func (r *NodeMutationRequest) validateCredentials(create bool) error {
|
|
if r == nil {
|
|
return common.NewError("node request is required")
|
|
}
|
|
// Agent nodes dial out to the master; address/port are not needed.
|
|
// Traditional nodes still require them.
|
|
if r.NodeType != "agent" {
|
|
if strings.TrimSpace(r.Address) == "" {
|
|
return common.NewError("address is required")
|
|
}
|
|
if r.Port < 1 || r.Port > 65535 {
|
|
return common.NewError("port must be between 1 and 65535")
|
|
}
|
|
}
|
|
if r.ApiToken != nil && r.ClearApiToken {
|
|
return common.NewError("apiToken and clearApiToken are mutually exclusive")
|
|
}
|
|
if r.ApiToken != nil {
|
|
*r.ApiToken = strings.TrimSpace(*r.ApiToken)
|
|
if *r.ApiToken == "" {
|
|
if create {
|
|
return common.NewError("apiToken is required unless mtls is enabled")
|
|
}
|
|
r.ApiToken = nil
|
|
}
|
|
}
|
|
if create {
|
|
if r.ClearApiToken {
|
|
return common.NewError("credentials cannot be cleared while creating a node")
|
|
}
|
|
// Agent nodes authenticate via agent token, not panel API token.
|
|
if r.NodeType != "agent" && r.ApiToken == nil && r.TlsVerifyMode != "mtls" {
|
|
return common.NewError("apiToken is required unless mtls is enabled")
|
|
}
|
|
}
|
|
if r.ClearApiToken && r.Enable && r.TlsVerifyMode != "mtls" {
|
|
return common.NewError("disable the node or enable mtls before clearing its apiToken")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// isAgentPlaceholderAddress reports whether addr is the placeholder the
|
|
// node form submits for agent nodes ("agent": they dial out to the master
|
|
// and have no panel endpoint to store). Keep in sync with the guard in
|
|
// internal/web/runtime's baseURL, which refuses to dial the placeholder
|
|
// for rows written before this sanitization existed.
|
|
func isAgentPlaceholderAddress(addr string) bool {
|
|
return strings.EqualFold(strings.TrimSpace(addr), "agent")
|
|
}
|
|
|
|
// sanitizeAgentEndpoint rewrites an agent-node write's endpoint fields so
|
|
// the form placeholder never reaches the nodes table: a placeholder (or
|
|
// empty) address is replaced by the node's currently resolved address —
|
|
// "" when none is known yet (a new node, or an agent that never
|
|
// reported) — and the port is dropped to 0, since an agent node has no
|
|
// panel port either. A real address submitted for an agent node is kept
|
|
// verbatim, port included.
|
|
func sanitizeAgentEndpoint(req *NodeMutationRequest, resolved string) {
|
|
addr := strings.TrimSpace(req.Address)
|
|
if addr != "" && !isAgentPlaceholderAddress(addr) {
|
|
return
|
|
}
|
|
req.Address = resolved
|
|
req.Port = 0
|
|
}
|
|
|
|
func (r *NodeMutationRequest) toNode() *model.Node {
|
|
n := &model.Node{
|
|
Id: r.Id,
|
|
Name: r.Name,
|
|
Remark: r.Remark,
|
|
Scheme: r.Scheme,
|
|
Address: r.Address,
|
|
Port: r.Port,
|
|
BasePath: r.BasePath,
|
|
Enable: r.Enable,
|
|
AllowPrivateAddress: r.AllowPrivateAddress,
|
|
TlsVerifyMode: r.TlsVerifyMode,
|
|
PinnedCertSha256: r.PinnedCertSha256,
|
|
InboundSyncMode: r.InboundSyncMode,
|
|
InboundTags: r.InboundTags,
|
|
OutboundTag: r.OutboundTag,
|
|
}
|
|
if r.ApiToken != nil {
|
|
n.ApiToken = *r.ApiToken
|
|
}
|
|
return n
|
|
}
|