Merge pull request #3 from ExpTechTW/main

Release build

Author: whes1015

.github/workflows/draft-release.yml

@@ -9,6 +9,10 @@ on:
 permissions:
   contents: write
 
+concurrency:
+  group: release-artifacts-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   meta:
     runs-on: ubuntu-latest
@@ -18,22 +22,59 @@ jobs:
     steps:
       - name: Compute release version
         id: ver
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
         run: |
-          VERSION="$(date -u +%Y%m%d)+b${GITHUB_RUN_NUMBER}"
+          VERSION="$(python3 - <<'PY'
+          import json
+          import os
+          import re
+          import urllib.request
+          from datetime import datetime, timezone
+
+          token = os.environ.get("GH_TOKEN", "").strip()
+          repo = os.environ.get("GH_REPO", "").strip()
+          if not token or not repo:
+              raise SystemExit("missing GH_TOKEN or GH_REPO")
+
+          day = datetime.now(timezone.utc).strftime("%Y.%m.%d")
+          prefix = f"v{day}+build."
+          max_n = 0
+          page = 1
+          pat = re.compile(rf"^v{re.escape(day)}\+build\.(\d+)$")
+
+          while page <= 5:
+              url = f"https://api.github.com/repos/{repo}/releases?per_page=100&page={page}"
+              req = urllib.request.Request(url)
+              req.add_header("Accept", "application/vnd.github+json")
+              req.add_header("Authorization", f"Bearer {token}")
+              with urllib.request.urlopen(req, timeout=10) as resp:
+                  data = json.loads(resp.read().decode("utf-8"))
+              if not data:
+                  break
+              for rel in data:
+                  tag = (rel.get("tag_name") or "").strip()
+                  m = pat.match(tag)
+                  if not m:
+                      continue
+                  n = int(m.group(1))
+                  if n > max_n:
+                      max_n = n
+              page += 1
+
+          print(f"{day}+build.{max_n + 1}")
+          PY
+          )"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Decide release mode by branch and commit message
         id: mode
         env:
-          HEAD_MSG: ${{ github.event.head_commit.message }}
           BRANCH_NAME: ${{ github.ref_name }}
         run: |
           if [[ "$BRANCH_NAME" == "main" ]]; then
-            if printf '%s\n' "$HEAD_MSG" | grep -qi 'build:'; then
-              echo "mode=pre-release" >> "$GITHUB_OUTPUT"
-            else
-              echo "mode=none" >> "$GITHUB_OUTPUT"
-            fi
+            echo "mode=pre-release" >> "$GITHUB_OUTPUT"
           elif [[ "$BRANCH_NAME" == "release" ]]; then
             echo "mode=release" >> "$GITHUB_OUTPUT"
           else

COMMAND_ZH.md

@@ -29,7 +29,7 @@ kekkai status                              # 預設讀 /etc/kekkai/kekkai.yaml
 kekkai status /path/to/kekkai.yaml           # 指定 config 路徑
 ```
 
-需要 root 才能讀 pinned eBPF maps：
+一般情況不需要 root。若主機有額外 LSM/硬化策略擋住 bpffs 讀取，再改用 sudo：
 
 ```bash
 sudo kekkai status
@@ -620,7 +620,7 @@ RPi 的 `macb` / `bcmgenet` driver 沒有 native XDP 支援。這是驅動層限
 
 ### 9.4 `kekkai status` 回報 `open pinned stats map`
 
-代表 agent 沒在跑，或 bpffs 沒掛。
+通常代表 agent 沒在跑、bpffs 沒掛，或主機策略限制了 bpffs 讀取權限。
 
 ```bash
 systemctl is-active kekkai-agent              # 確認 agent 跑著
@@ -629,6 +629,7 @@ ls /sys/fs/bpf/kekkai/                    # 確認 pin 路徑有檔案
 ```
 
 bpffs 沒掛：`sudo mount -t bpf bpf /sys/fs/bpf`。
+若一般使用者仍 permission denied：先試 `sudo kekkai status` 驗證是否純權限問題。
 
 ### 9.5 `kekkai.sh update` 中止且 rollback
 
@@ -716,6 +717,7 @@ cat /var/run/kekkai/stats.txt > /tmp/stats-$(date +%s).txt
 | 指令 | 實作 | 說明 |
 |---|---|---|
 | `kekkai status [path]`          | ✅ | 互動式 TUI |
+| `kekkai config [path]`          | ✅ | 用 nano 編輯 config，退出後自動 reload |
 | `kekkai doctor`                 | ✅ | 全系統健康檢查（read-only） |
 | `kekkai check [path]`           | ✅ | 驗證 config (read-only) |
 | `kekkai ports [path]`           | ✅ | 彩色列出 public/private port 與 SSH 暴露狀態 |

Makefile

@@ -3,7 +3,7 @@ CLI_BIN   := kekkai
 AGENT_PKG := ./cmd/kekkai-agent
 CLI_PKG   := ./cmd/kekkai
 
-DATE_UTC := $(shell date -u +%Y%m%d)
+DATE_UTC := $(shell date -u +%Y.%m.%d)
 GIT_SHA  := $(shell git rev-parse --short HEAD 2>/dev/null || echo nosha)
 VERSION ?= $(DATE_UTC)+$(GIT_SHA)
 LDFLAGS := -ldflags "-s -w -X main.version=$(VERSION)"

cmd/kekkai-agent/main.go

@@ -29,7 +29,7 @@ import (
 )
 
 // version is injected at build time via -ldflags:
-//   -X main.version=YYYYMMDD+bN
+//   -X main.version=YYYY.MM.DD+build.N
 // Keep default empty so linker override works reliably.
 var version string
 

cmd/kekkai/main.go

@@ -26,7 +26,7 @@ import (
 )
 
 // version is injected at build time via -ldflags:
-//   -X main.version=YYYYMMDD+bN
+//   -X main.version=YYYY.MM.DD+build.N
 // Keep default empty so linker override works reliably.
 var version string
 
@@ -50,6 +50,8 @@ func main() {
 	switch cmd {
 	case "status":
 		os.Exit(cmdStatus(args))
+	case "config":
+		os.Exit(cmdConfig(args))
 	case "version", "-v", "--version":
 		cmdVersion()
 	case "check":
@@ -351,6 +353,47 @@ func cmdBypassSave(wantBypass bool, cfgPath string) int {
 	return 0
 }
 
+// cmdConfig opens config in nano and reloads the agent after editor exit.
+// Non-root users are transparently escalated with sudo when needed.
+func cmdConfig(args []string) int {
+	cfgPath := firstArgOrDefault(args, defaultConfigPath)
+
+	nanoPath, err := exec.LookPath("nano")
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "nano not found; install nano first")
+		return 1
+	}
+
+	editorArgs := []string{nanoPath, cfgPath}
+	editorCmd := exec.Command(editorArgs[0], editorArgs[1:]...)
+	if os.Geteuid() != 0 && !isWritableByCurrentUser(cfgPath) {
+		editorCmd = exec.Command("sudo", editorArgs...)
+	}
+	if code := runCommand(editorCmd, "edit config with nano"); code != 0 {
+		return code
+	}
+
+	// Reuse existing reload flow (includes config check).
+	if os.Geteuid() == 0 {
+		return cmdReload([]string{cfgPath})
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "resolve executable for reload: %v\n", err)
+		return 1
+	}
+	return runCommand(exec.Command("sudo", exe, "reload", cfgPath), "sudo reload after config edit")
+}
+
+func isWritableByCurrentUser(path string) bool {
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_APPEND, 0)
+	if err != nil {
+		return false
+	}
+	_ = f.Close()
+	return true
+}
+
 func writeFileAtomic(path string, data []byte, mode os.FileMode) error {
 	tmp := path + ".tmp"
 	if err := os.WriteFile(tmp, data, mode); err != nil {
@@ -550,6 +593,7 @@ Usage:
 
 Commands:
   status [config]            launch the live TUI (default: /etc/kekkai/kekkai.yaml)
+  config [config]            open config in nano, then auto-reload kekkai-agent
   check  [config]            validate a config file (read-only; safe as non-root)
   ports  [config]            show colorized public/private port summary
   show   [config]            print the normalised config after migration

internal/loader/loader_linux.go

@@ -213,11 +213,19 @@ func (l *linuxImpl) close() error {
 // <root>/<map-name>. Called right after NewCollection so subsequent
 // LoadPinnedMap() calls from CLI / TUI processes succeed.
 func pinMaps(coll *ebpf.Collection, root string) error {
+	// Best-effort: keep pin root traversable for non-root operator tooling
+	// (kekkai status / doctor). Some hardened systems may still enforce
+	// additional LSM checks, so permission failures are non-fatal here.
+	_ = os.Chmod(root, 0o755)
+
 	for name, m := range coll.Maps {
 		path := filepath.Join(root, name)
 		if err := m.Pin(path); err != nil {
 			return fmt.Errorf("pin %s → %s: %w", name, path, err)
 		}
+		// Make pinned map inode readable by non-root users so `kekkai status`
+		// can open maps without sudo on standard Linux setups.
+		_ = os.Chmod(path, 0o644)
 	}
 	return nil
 }

internal/tui/model.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -347,6 +348,14 @@ func normalizeSemver(v string) (string, bool) {
 	if i := strings.IndexAny(core, "-+"); i >= 0 {
 		core = core[:i]
 	}
+
+	// Backward compatibility:
+	// older builds used YYYYMMDD(+meta), e.g. 20260414+b8.
+	// Convert to loose semver-like core: YYYY.MM.DD so update checks still work.
+	if isEightDigits(core) {
+		return fmt.Sprintf("%s.%s.%s", core[:4], core[4:6], core[6:8]), true
+	}
+
 	parts := strings.Split(core, ".")
 	if len(parts) != 3 {
 		return "", false
@@ -362,6 +371,12 @@ func normalizeSemver(v string) (string, bool) {
 	return core, true
 }
 
+var eightDigitsRe = regexp.MustCompile(`^\d{8}$`)
+
+func isEightDigits(s string) bool {
+	return eightDigitsRe.MatchString(s)
+}
+
 func compareSemver(a, b string) int {
 	pa := strings.Split(a, ".")
 	pb := strings.Split(b, ".")

kekkai.sh

@@ -840,7 +840,7 @@ release_update() {
   old_sha=""; [[ -f "$AGENT_BIN" ]] && old_sha="$(sha256sum "$AGENT_BIN" | awk '{print $1}')"
   new_sha="$(sha256sum "$new_agent" | awk '{print $1}')"
   if [[ "$old_sha" == "$new_sha" ]]; then
-    log "binary unchanged — nothing to restart"
+    log "up-to-date (binary unchanged — nothing to restart)"
     print_version_transition "$old_ver" "$new_ver"
     rm -rf "$tmpdir"
     return 0
@@ -953,7 +953,7 @@ do_update() {
       old_sha=""; [[ -f "$AGENT_BIN" ]] && old_sha="$(sha256sum "$AGENT_BIN" | awk '{print $1}')"
       new_sha="$(sha256sum "$ROOT/bin/kekkai-agent" | awk '{print $1}')"
       if [[ "$old_sha" == "$new_sha" ]]; then
-        log "binary unchanged — nothing to restart"
+        log "up-to-date (binary unchanged — nothing to restart)"
         print_version_transition "$old_ver" "$new_ver"
         return 0
       fi

readme.md

@@ -53,7 +53,7 @@ bash ./kekkai.sh
 sudo nano /etc/kekkai/kekkai.yaml
 kekkai check
 sudo kekkai reload
-sudo kekkai status
+kekkai status
 ```
 
 > 注意：預設 `filter.ingress_allowlist` 會先放 `192.168.0.0/16` 避免初次啟動被 SSH 防呆擋住；請務必改成你的實際管理網段。