Add probo-agent CLI and deviceagent library

Introduce the standalone device agent binary and shared library for enrollment, posture checks, self-update, and OS service integration. Include build targets, module deps, and release workflow so the agent can ship independently of server changes. Signed-off-by: Bryan Frimin <bryan@probo.com>
2026-05-26 09:01:08 -07:00
parent e643a3259c
commit 22e50b3f11
56 changed files with 7410 additions and 127 deletions
--- a/pkg/deviceagent/service/service.go
+++ b/pkg/deviceagent/service/service.go
@@ -0,0 +1,33 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+// Package service installs and uninstalls OS service units for probo-agent.
+package service
+
+// Config carries installation parameters shared across platforms.
+type Config struct {
+	// ExePath is the agent binary path.
+	ExePath string
+	// Dir is the agent state directory.
+	Dir string
+	// Label is the service identifier.
+	Label string
+}
+
+// Default service identifiers by platform.
+const (
+	DefaultLabel       = "com.getprobo.agent"
+	DefaultUnixName    = "probo-agent"
+	DefaultWindowsName = "ProboAgent"
+)
--- a/pkg/deviceagent/service/service_darwin.go
+++ b/pkg/deviceagent/service/service_darwin.go
@@ -0,0 +1,119 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package service
+
+import (
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"text/template"
+)
+
+const plistPath = "/Library/LaunchDaemons/com.getprobo.agent.plist"
+
+const launchdPlistTmpl = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
+  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>{{xml .Label}}</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>{{xml .ExePath}}</string>
+        <string>run</string>
+        <string>--dir</string>
+        <string>{{xml .Dir}}</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>/var/log/probo-agent.log</string>
+    <key>StandardErrorPath</key>
+    <string>/var/log/probo-agent.log</string>
+    <key>UserName</key>
+    <string>root</string>
+    <key>GroupName</key>
+    <string>wheel</string>
+</dict>
+</plist>
+`
+
+func xmlEscape(v string) (string, error) {
+	var sb strings.Builder
+	if err := xml.EscapeText(&sb, []byte(v)); err != nil {
+		return "", err
+	}
+
+	return sb.String(), nil
+}
+
+// Install writes and boots the launchd plist.
+func Install(cfg Config) error {
+	if cfg.ExePath == "" {
+		return errors.New("executable path is required")
+	}
+
+	if cfg.Dir == "" {
+		return errors.New("state directory is required")
+	}
+
+	if cfg.Label == "" {
+		cfg.Label = DefaultLabel
+	}
+
+	tmpl, err := template.New("plist").Funcs(template.FuncMap{"xml": xmlEscape}).Parse(launchdPlistTmpl)
+	if err != nil {
+		return fmt.Errorf("cannot parse plist template: %w", err)
+	}
+
+	if err := os.MkdirAll(filepath.Dir(plistPath), 0o755); err != nil {
+		return fmt.Errorf("cannot ensure launch daemons directory: %w", err)
+	}
+
+	f, err := os.OpenFile(plistPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
+	if err != nil {
+		return fmt.Errorf("cannot write plist (need root?): %w", err)
+	}
+	defer func() { _ = f.Close() }()
+
+	if err := tmpl.Execute(f, cfg); err != nil {
+		return fmt.Errorf("cannot render plist: %w", err)
+	}
+
+	// `bootout` first keeps install idempotent.
+	_ = exec.Command("launchctl", "bootout", "system", plistPath).Run()
+	if out, err := exec.Command("launchctl", "bootstrap", "system", plistPath).CombinedOutput(); err != nil {
+		return fmt.Errorf("cannot run launchctl bootstrap: %w: %s", err, strings.TrimSpace(string(out)))
+	}
+
+	return nil
+}
+
+// Uninstall bootouts and removes the launchd plist.
+func Uninstall(cfg Config) error {
+	_ = exec.Command("launchctl", "bootout", "system", plistPath).Run()
+	if err := os.Remove(plistPath); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("cannot remove plist: %w", err)
+	}
+
+	return nil
+}
--- a/pkg/deviceagent/service/service_freebsd.go
+++ b/pkg/deviceagent/service/service_freebsd.go
@@ -0,0 +1,97 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package service
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"text/template"
+)
+
+const (
+	rcScriptPath = "/usr/local/etc/rc.d/probo_agent"
+)
+
+// FreeBSD rc.d script template.
+const rcScriptTmpl = `#!/bin/sh
+#
+# PROVIDE: probo_agent
+# REQUIRE: NETWORKING
+# KEYWORD: shutdown
+
+. /etc/rc.subr
+
+name=probo_agent
+rcvar=probo_agent_enable
+desc="Probo device posture agent"
+pidfile="/var/run/${name}.pid"
+procname="{{.ExePath}}"
+command=/usr/sbin/daemon
+command_args="-r -P ${pidfile} -- \"{{.ExePath}}\" run --dir \"{{.Dir}}\""
+
+load_rc_config $name
+: ${probo_agent_enable:=YES}
+
+run_rc_command "$1"
+`
+
+func Install(cfg Config) error {
+	if cfg.ExePath == "" {
+		return errors.New("executable path is required")
+	}
+
+	if cfg.Dir == "" {
+		return errors.New("state directory is required")
+	}
+
+	rcTmpl, err := template.New("rc").Parse(rcScriptTmpl)
+	if err != nil {
+		return fmt.Errorf("cannot parse rc.d template: %w", err)
+	}
+
+	sf, err := os.OpenFile(rcScriptPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o755)
+	if err != nil {
+		return fmt.Errorf("cannot write rc.d script (need root?): %w", err)
+	}
+
+	defer func() { _ = sf.Close() }()
+	if err := rcTmpl.Execute(sf, cfg); err != nil {
+		return fmt.Errorf("cannot render rc.d script: %w", err)
+	}
+
+	if out, err := exec.Command("service", "probo_agent", "enable").CombinedOutput(); err != nil {
+		return fmt.Errorf("cannot run service probo_agent enable: %w: %s", err, strings.TrimSpace(string(out)))
+	}
+
+	if out, err := exec.Command("service", "probo_agent", "start").CombinedOutput(); err != nil {
+		return fmt.Errorf("cannot run service probo_agent start: %w: %s", err, strings.TrimSpace(string(out)))
+	}
+
+	return nil
+}
+
+func Uninstall(cfg Config) error {
+	_ = exec.Command("service", "probo_agent", "stop").Run()
+	_ = exec.Command("service", "probo_agent", "disable").Run()
+
+	if err := os.Remove(rcScriptPath); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("cannot remove rc.d script: %w", err)
+	}
+
+	return nil
+}
--- a/pkg/deviceagent/service/service_linux.go
+++ b/pkg/deviceagent/service/service_linux.go
@@ -0,0 +1,97 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package service
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"text/template"
+)
+
+const (
+	systemdUnitPath = "/etc/systemd/system/probo-agent.service"
+)
+
+const systemdUnitTmpl = `[Unit]
+Description=Probo device posture agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart={{.ExePath}} run --dir {{.Dir}}
+Restart=always
+RestartSec=10
+# 75 is the exit code emitted after a successful self-update.
+# Treat it as a normal exit so the unit restarts without entering
+# the "failed" state.
+SuccessExitStatus=75
+User=root
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+
+[Install]
+WantedBy=multi-user.target
+`
+
+func Install(cfg Config) error {
+	if cfg.ExePath == "" {
+		return errors.New("executable path is required")
+	}
+
+	if cfg.Dir == "" {
+		return errors.New("state directory is required")
+	}
+
+	tmpl, err := template.New("unit").Parse(systemdUnitTmpl)
+	if err != nil {
+		return fmt.Errorf("cannot parse unit template: %w", err)
+	}
+
+	f, err := os.OpenFile(systemdUnitPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
+	if err != nil {
+		return fmt.Errorf("cannot write systemd unit (need root?): %w", err)
+	}
+
+	defer func() { _ = f.Close() }()
+	if err := tmpl.Execute(f, cfg); err != nil {
+		return fmt.Errorf("cannot render systemd unit: %w", err)
+	}
+
+	if out, err := exec.Command("systemctl", "daemon-reload").CombinedOutput(); err != nil {
+		return fmt.Errorf("cannot run systemctl daemon-reload: %w: %s", err, strings.TrimSpace(string(out)))
+	}
+
+	if out, err := exec.Command("systemctl", "enable", "--now", "probo-agent.service").CombinedOutput(); err != nil {
+		return fmt.Errorf("cannot run systemctl enable --now: %w: %s", err, strings.TrimSpace(string(out)))
+	}
+
+	return nil
+}
+
+func Uninstall(cfg Config) error {
+	_ = exec.Command("systemctl", "disable", "--now", "probo-agent.service").Run()
+	if err := os.Remove(systemdUnitPath); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("cannot remove systemd unit: %w", err)
+	}
+
+	_ = exec.Command("systemctl", "daemon-reload").Run()
+
+	return nil
+}
--- a/pkg/deviceagent/service/service_windows.go
+++ b/pkg/deviceagent/service/service_windows.go
@@ -0,0 +1,73 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package service
+
+import (
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+// Install registers and starts the Windows service via sc.exe.
+func Install(cfg Config) error {
+	if cfg.ExePath == "" {
+		return errors.New("executable path is required")
+	}
+	if cfg.Dir == "" {
+		return errors.New("state directory is required")
+	}
+	name := DefaultWindowsName
+
+	bin := fmt.Sprintf(`"%s" run --dir "%s"`, cfg.ExePath, cfg.Dir)
+	if out, err := exec.Command(
+		"sc.exe",
+		"create",
+		name,
+		"binPath=",
+		bin,
+		"start=",
+		"auto",
+		"DisplayName=",
+		"Probo Device Posture Agent",
+	).CombinedOutput(); err != nil {
+		return fmt.Errorf("cannot run sc.exe create: %w: %s", err, strings.TrimSpace(string(out)))
+	}
+	// Restart on failure.
+	if out, err := exec.Command(
+		"sc.exe",
+		"failure",
+		name,
+		"reset=",
+		"86400",
+		"actions=",
+		"restart/1000/restart/1000/restart/1000",
+	).CombinedOutput(); err != nil {
+		return fmt.Errorf("cannot run sc.exe failure: %w: %s", err, strings.TrimSpace(string(out)))
+	}
+	if out, err := exec.Command("sc.exe", "start", name).CombinedOutput(); err != nil {
+		return fmt.Errorf("cannot run sc.exe start: %w: %s", err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
+func Uninstall(cfg Config) error {
+	name := DefaultWindowsName
+	_ = exec.Command("sc.exe", "stop", name).Run()
+	if out, err := exec.Command("sc.exe", "delete", name).CombinedOutput(); err != nil {
+		return fmt.Errorf("cannot run sc.exe delete: %w: %s", err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}