Add Linux Fleet Node packaging and installer

.github/path-filters.yml

@@ -19,6 +19,7 @@ global: &global
 
 deployment_config:
   - *global
+  - deployment-files/fleetnode/**
   - deployment-files/ha/**
   - deployment-files/profiles/**
   - deployment-files/tests/**

.github/workflows/deployment-config-checks.yml

@@ -49,3 +49,16 @@ jobs:
 
       - name: Validate uninstaller updater cleanup
         run: ./deployment-files/tests/test-uninstall-updater-cleanup.sh
+
+  fleetnode-installer:
+    name: Fleet Node installer
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Validate shell syntax
+        run: bash -n deployment-files/fleetnode/install-fleetnode.sh deployment-files/fleetnode/tests/test-install-fleetnode.sh
+
+      - name: Test installer
+        run: ./deployment-files/fleetnode/tests/test-install-fleetnode.sh

.github/workflows/nightly-builds.yml

@@ -127,6 +127,13 @@ jobs:
           path: /tmp/nightly-assets/server
           merge-multiple: true
 
+      - name: Download Fleet Node artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: fleetnode-linux-*
+          path: /tmp/nightly-assets/fleetnode
+          merge-multiple: true
+
       - name: Download client artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -161,6 +168,23 @@ jobs:
             fi
           done
 
+      - name: Verify Fleet Node checksums
+        run: |
+          cd /tmp/nightly-assets/fleetnode
+          for arch in amd64 arm64; do
+            archive="fleetnode-${VERSION}-linux-${arch}.tar.gz"
+            if [[ ! -f "$archive" || ! -f "$archive.sha256" ]]; then
+              echo "::error::Missing Fleet Node archive or checksum for $arch"
+              exit 1
+            fi
+            expected_sidecar="$RUNNER_TEMP/fleetnode-${arch}.sha256"
+            sha256sum "$archive" > "$expected_sidecar"
+            if ! cmp -s "$expected_sidecar" "$archive.sha256"; then
+              echo "::error::Fleet Node checksum is not bound to $archive"
+              exit 1
+            fi
+          done
+
       - name: Create release notes
         run: |
           cat > /tmp/nightly-release-notes.md <<EOF
@@ -202,10 +226,13 @@ jobs:
             /tmp/nightly-assets/windows/installer.exe \
             /tmp/nightly-assets/windows/uninstall.exe \
             /tmp/nightly-assets/server/proto-fleet-server-${VERSION}-*.tar.gz \
+            /tmp/nightly-assets/fleetnode/fleetnode-${VERSION}-linux-*.tar.gz \
+            /tmp/nightly-assets/fleetnode/fleetnode-${VERSION}-linux-*.tar.gz.sha256 \
             /tmp/nightly-assets/client/proto-fleet-client-${VERSION}.tar.gz \
             /tmp/nightly-assets/proto-os/proto-os-${VERSION}.tar.gz \
             /tmp/nightly-assets/proto-os/proto-os_${VERSION}.ipk \
             ./deployment-files/install.sh \
+            ./deployment-files/fleetnode/install-fleetnode.sh \
             ./deployment-files/uninstall.sh \
             --draft \
             --notes-file /tmp/nightly-release-notes.md \
@@ -222,10 +249,13 @@ jobs:
             /tmp/nightly-assets/windows/installer.exe \
             /tmp/nightly-assets/windows/uninstall.exe \
             /tmp/nightly-assets/server/proto-fleet-server-${VERSION}-*.tar.gz \
+            /tmp/nightly-assets/fleetnode/fleetnode-${VERSION}-linux-*.tar.gz \
+            /tmp/nightly-assets/fleetnode/fleetnode-${VERSION}-linux-*.tar.gz.sha256 \
             /tmp/nightly-assets/client/proto-fleet-client-${VERSION}.tar.gz \
             /tmp/nightly-assets/proto-os/proto-os-${VERSION}.tar.gz \
             /tmp/nightly-assets/proto-os/proto-os_${VERSION}.ipk \
             ./deployment-files/install.sh \
+            ./deployment-files/fleetnode/install-fleetnode.sh \
             ./deployment-files/uninstall.sh \
             --clobber
 
@@ -298,10 +328,13 @@ jobs:
             echo "- \`proto-fleet-${NIGHTLY_VERSION}-arm64.tar.gz\`"
             echo "- \`proto-fleet-server-${NIGHTLY_VERSION}-amd64.tar.gz\`"
             echo "- \`proto-fleet-server-${NIGHTLY_VERSION}-arm64.tar.gz\`"
+            echo "- \`fleetnode-${NIGHTLY_VERSION}-linux-amd64.tar.gz\`"
+            echo "- \`fleetnode-${NIGHTLY_VERSION}-linux-arm64.tar.gz\`"
             echo "- \`proto-fleet-client-${NIGHTLY_VERSION}.tar.gz\`"
             echo "- \`proto-os-${NIGHTLY_VERSION}.tar.gz\`"
             echo "- \`proto-os_${NIGHTLY_VERSION}.ipk\`"
             echo "- \`installer.exe\`"
             echo "- \`uninstall.exe\`"
             echo "- \`install.sh\`"
+            echo "- \`install-fleetnode.sh\`"
           } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/proto-fleet-artifact-build.yml

@@ -237,6 +237,92 @@ jobs:
           path: ./server/proto-fleet-server-${{ needs.metadata.outputs.version }}-${{ matrix.arch }}.tar.gz
           retention-days: ${{ inputs.retention_days }}
 
+  package-fleet-node:
+    name: Package Fleet Node (${{ matrix.arch }})
+    needs: [metadata]
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    env:
+      CGO_ENABLED: 0
+      VERSION: ${{ needs.metadata.outputs.version }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Hermit
+        uses: ./.github/actions/hermit-setup
+
+      - name: Configure Go cache
+        uses: ./.github/actions/go-cache-setup
+
+      - name: Build Fleet Node and Go plugins
+        run: |
+          go work sync
+          go build -v -o server/fleetnode ./server/cmd/fleetnode
+          go build -o server/proto-plugin ./plugin/proto
+          go build -o server/antminer-plugin ./plugin/antminer
+          go build -o server/virtual-plugin ./plugin/virtual
+          cp plugin/virtual/config.json server/virtual-plugin.json
+
+          for binary in fleetnode proto-plugin antminer-plugin virtual-plugin; do
+            if ! readelf -h "server/$binary" >/dev/null; then
+              echo "::error::Unable to inspect Fleet Node binary $binary"
+              exit 1
+            fi
+            if readelf -l "server/$binary" | grep INTERP >/dev/null || readelf -d "server/$binary" | grep NEEDED >/dev/null; then
+              echo "::error::Fleet Node binary $binary must be statically linked"
+              exit 1
+            fi
+          done
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build asicrs plugin
+        run: |
+          docker buildx build \
+            --file plugin/asicrs/Dockerfile.build \
+            --output "type=local,dest=/tmp/asicrs" \
+            .
+          cp /tmp/asicrs/asicrs-plugin server/asicrs-plugin
+          cp /tmp/asicrs/asicrs-config.yaml server/asicrs-config.yaml
+
+      - name: Package Fleet Node
+        working-directory: ./server
+        run: |
+          package_dir="fleetnode-${VERSION}-linux-${{ matrix.arch }}"
+          archive="${package_dir}.tar.gz"
+
+          mkdir -p "$package_dir/plugins"
+          install -m 0755 fleetnode "$package_dir/fleetnode"
+          install -m 0644 ../deployment-files/fleetnode/fleetnode.service "$package_dir/fleetnode.service"
+          install -m 0755 proto-plugin "$package_dir/plugins/proto-plugin"
+          install -m 0755 antminer-plugin "$package_dir/plugins/antminer-plugin"
+          install -m 0755 virtual-plugin "$package_dir/plugins/virtual-plugin"
+          install -m 0644 virtual-plugin.json "$package_dir/plugins/virtual-plugin.json"
+          install -m 0755 asicrs-plugin "$package_dir/plugins/asicrs-plugin"
+          install -m 0644 asicrs-config.yaml "$package_dir/plugins/asicrs-config.yaml"
+          printf 'version: %s\n' "$VERSION" > "$package_dir/version.txt"
+
+          tar -czf "$archive" "$package_dir"
+          sha256sum "$archive" > "$archive.sha256"
+          sha256sum -c "$archive.sha256"
+
+      - name: Upload Fleet Node artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: fleetnode-linux-${{ matrix.arch }}
+          path: |
+            ./server/fleetnode-${{ needs.metadata.outputs.version }}-linux-${{ matrix.arch }}.tar.gz
+            ./server/fleetnode-${{ needs.metadata.outputs.version }}-linux-${{ matrix.arch }}.tar.gz.sha256
+          retention-days: ${{ inputs.retention_days }}
+
   build-proto-fleet-client:
     name: Build ProtoFleet client
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -92,6 +92,13 @@ jobs:
           path: /tmp/release-assets/server
           merge-multiple: true
 
+      - name: Download Fleet Node artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: fleetnode-linux-*
+          path: /tmp/release-assets/fleetnode
+          merge-multiple: true
+
       - name: Download client artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -128,6 +135,25 @@ jobs:
             fi
           done
 
+      - name: Verify Fleet Node checksums
+        env:
+          VERSION: ${{ github.ref_name }}
+        run: |
+          cd /tmp/release-assets/fleetnode
+          for arch in amd64 arm64; do
+            archive="fleetnode-${VERSION}-linux-${arch}.tar.gz"
+            if [[ ! -f "$archive" || ! -f "$archive.sha256" ]]; then
+              echo "::error::Missing Fleet Node archive or checksum for $arch"
+              exit 1
+            fi
+            expected_sidecar="$RUNNER_TEMP/fleetnode-${arch}.sha256"
+            sha256sum "$archive" > "$expected_sidecar"
+            if ! cmp -s "$expected_sidecar" "$archive.sha256"; then
+              echo "::error::Fleet Node checksum is not bound to $archive"
+              exit 1
+            fi
+          done
+
       - name: Create or refresh draft release and upload assets
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -142,10 +168,13 @@ jobs:
             /tmp/release-assets/windows/installer.exe
             /tmp/release-assets/windows/uninstall.exe
             /tmp/release-assets/server/proto-fleet-server-"$TAG_NAME"-*.tar.gz
+            /tmp/release-assets/fleetnode/fleetnode-"$TAG_NAME"-linux-*.tar.gz
+            /tmp/release-assets/fleetnode/fleetnode-"$TAG_NAME"-linux-*.tar.gz.sha256
             /tmp/release-assets/client/proto-fleet-client-"$TAG_NAME".tar.gz
             /tmp/release-assets/proto-os/proto-os-"$TAG_NAME".tar.gz
             /tmp/release-assets/proto-os/proto-os_"$TAG_NAME".ipk
             ./deployment-files/install.sh
+            ./deployment-files/fleetnode/install-fleetnode.sh
             ./deployment-files/uninstall.sh
           )
           # Refuse to clobber a non-draft release — published assets are immutable from this workflow.

deployment-files/fleetnode/fleetnode.service

@@ -0,0 +1,33 @@
+[Unit]
+Description=Proto Fleet Node
+Documentation=https://github.com/block/proto-fleet
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=fleetnode
+Group=fleetnode
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+EnvironmentFile=-/etc/fleetnode/fleetnode.env
+ExecStart=/usr/bin/env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /opt/fleetnode/fleetnode --state-dir /var/lib/fleetnode run
+Restart=on-failure
+RestartSec=5s
+TimeoutStopSec=90s
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadOnlyPaths=/opt/fleetnode /etc/fleetnode
+ReadWritePaths=/var/lib/fleetnode
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target