feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

scripts/install-systemd.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+BINARY="${RSMON_WORKER_BINARY:-${ROOT_DIR}/bin/rsmon-worker}"
+ENV_FILE="${RSMON_WORKER_ENV_FILE:-}"
+START_SERVICE=1
+
+usage() {
+    cat <<'USAGE'
+Usage: sudo ./scripts/install-systemd.sh [--binary PATH] [--env PATH] [--no-start]
+
+Installs rsmon-worker as /usr/local/bin/rsmon-worker and configures systemd.
+If --env is omitted on a first install, an example file is installed and the
+service is not started until its token and password are configured.
+USAGE
+}
+
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        --binary)
+            BINARY="${2:?--binary requires a path}"
+            shift 2
+            ;;
+        --env)
+            ENV_FILE="${2:?--env requires a path}"
+            shift 2
+            ;;
+        --no-start)
+            START_SERVICE=0
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            printf 'Unknown argument: %s\n' "$1" >&2
+            usage >&2
+            exit 2
+            ;;
+    esac
+done
+
+if [ "$(id -u)" -ne 0 ]; then
+    printf 'Run this installer as root.\n' >&2
+    exit 1
+fi
+
+if [ ! -x "$BINARY" ]; then
+    if command -v go >/dev/null 2>&1; then
+        make -C "$ROOT_DIR" build
+    else
+        printf 'Worker binary not found at %s and Go is unavailable.\n' "$BINARY" >&2
+        exit 1
+    fi
+fi
+
+if ! command -v chromium >/dev/null 2>&1; then
+    if command -v apt-get >/dev/null 2>&1; then
+        apt-get update
+        DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates chromium libcap2-bin tzdata
+    else
+        printf 'Warning: Chromium is not installed; browser-backed HTTP checks will fail.\n' >&2
+    fi
+fi
+
+if ! getent group rsmon-worker >/dev/null; then
+    groupadd --system rsmon-worker
+fi
+if ! id rsmon-worker >/dev/null 2>&1; then
+    useradd --system --gid rsmon-worker --home-dir /var/lib/rsmon-worker --create-home --shell /usr/sbin/nologin rsmon-worker
+fi
+
+install -d -m 0755 /etc/rsmon-worker
+install -d -o rsmon-worker -g rsmon-worker -m 0750 /var/lib/rsmon-worker /var/lib/rsmon-worker/webapp /var/lib/rsmon-worker/cluster
+install -m 0755 "$BINARY" /usr/local/bin/rsmon-worker
+install -m 0644 "$ROOT_DIR/packaging/systemd/rsmon-worker.service" /etc/systemd/system/rsmon-worker.service
+
+if [ -n "$ENV_FILE" ]; then
+    install -m 0600 "$ENV_FILE" /etc/rsmon-worker/worker.env
+elif [ ! -f /etc/rsmon-worker/worker.env ]; then
+    install -m 0600 "$ROOT_DIR/packaging/systemd/worker.env.example" /etc/rsmon-worker/worker.env
+    START_SERVICE=0
+    printf 'Installed /etc/rsmon-worker/worker.env; configure it before starting the service.\n'
+fi
+
+if command -v setcap >/dev/null 2>&1; then
+    setcap cap_net_raw=+ep /usr/local/bin/rsmon-worker || true
+fi
+
+systemctl daemon-reload
+systemctl enable rsmon-worker.service
+if [ "$START_SERVICE" -eq 1 ]; then
+    systemctl restart rsmon-worker.service
+    systemctl --no-pager --full status rsmon-worker.service
+else
+    printf 'Start after configuration with: systemctl start rsmon-worker\n'
+fi

scripts/uninstall-systemd.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$(id -u)" -ne 0 ]; then
+    printf 'Run this uninstaller as root.\n' >&2
+    exit 1
+fi
+
+systemctl disable --now rsmon-worker.service 2>/dev/null || true
+rm -f /etc/systemd/system/rsmon-worker.service /usr/local/bin/rsmon-worker
+systemctl daemon-reload
+
+printf 'Binary and service removed. Configuration and state were preserved in:\n'
+printf '  /etc/rsmon-worker\n  /var/lib/rsmon-worker\n'