feat: add worker install and deploy

README.md

@@ -37,6 +37,9 @@ docker compose up -d
 docker compose logs -f worker
 ```
 
+Compose pulls `reg.rsxx.ru/rsmon/rsmon-worker:latest` by default. Set
+`RSMON_WORKER_IMAGE` to use another published tag.
+
 The operator console is bound to `127.0.0.1:27401` by default. Set
 `WORKER_BIND_IP` only when a firewall or TLS reverse proxy protects the port.
 Persistent web and cluster state is stored in the `worker-data` volume.
@@ -44,13 +47,13 @@ Persistent web and cluster state is stored in the `worker-data` volume.
 ## Docker
 
 ```bash
-docker build -t rsmon-worker:local .
+docker pull reg.rsxx.ru/rsmon/rsmon-worker:latest
 docker run --rm \
   --cap-add NET_RAW \
   --env-file .env \
   -p 127.0.0.1:27401:27401 \
   -v rsmon-worker-data:/var/lib/rsmon-worker \
-  rsmon-worker:local
+  reg.rsxx.ru/rsmon/rsmon-worker:latest
 ```
 
 Published images use these tags:
@@ -73,16 +76,36 @@ sudo apt-get update
 sudo apt-get install -y ca-certificates chromium libcap2-bin tzdata
 ```
 
-Build and install:
+Build and install with a token file so the token does not enter shell history or
+the process list:
 
 ```bash
 make build
-cp packaging/systemd/worker.env.example worker.env
-# Edit worker.env.
-sudo ./scripts/install-systemd.sh --env ./worker.env
+printf '%s\n' 'WORKER_TOKEN' > worker-token
+chmod 600 worker-token
+sudo ./bin/rsmon-worker install --token-file worker-token
+rm worker-token
 ```
 
-To install an already downloaded release binary:
+`install` copies the running binary to `/usr/local/bin/rsmon-worker`, writes the
+mode-0600 configuration at `/etc/rsmon-worker/worker.env`, installs a simple
+root-run systemd unit, and enables and starts it. Use `--url` to override
+`https://rsmon.ru`, `--binary` to install another binary, or `--no-start` to
+configure without starting.
+
+The Docker alternative pulls the prebuilt image and installs a systemd unit
+that runs it:
+
+```bash
+sudo ./bin/rsmon-worker install --docker --token-file worker-token
+```
+
+The image defaults to `reg.rsxx.ru/rsmon/rsmon-worker:latest`; override it with
+`--image`.
+
+The token can also be passed as `--token` or `--api-key`, but that can expose it
+through shell history and process inspection. The legacy repository-based
+installer remains available:
 
 ```bash
 sudo ./scripts/install-systemd.sh --binary ./rsmon-worker --env ./worker.env
@@ -96,9 +119,40 @@ journalctl -u rsmon-worker -f
 sudo systemctl restart rsmon-worker
 ```
 
-The service runs as the dedicated `rsmon-worker` user, stores state below
-`/var/lib/rsmon-worker`, reads secrets from `/etc/rsmon-worker/worker.env`, and
-has only `CAP_NET_RAW` for ICMP checks.
+The service runs as root, reads secrets from
+`/etc/rsmon-worker/worker.env`, and can execute ICMP checks without additional
+capability setup.
+
+## SSH deployment
+
+`deploy` uploads the selected worker binary and a temporary mode-0600
+configuration over SSH, then runs the binary's `install` command through root or
+`sudo`. The remote host needs Linux, systemd, `base64`, and either root SSH or
+sudo access.
+
+```bash
+./bin/rsmon-worker deploy \
+  --host worker.example.com \
+  --user deploy \
+  --identity-file ~/.ssh/id_ed25519 \
+  --token-file worker-token
+```
+
+Add `--docker` to install remotely by uploading only the configuration and
+systemd unit, then running `docker pull` on the target. This mode does not upload
+or execute the local worker binary, so the local and remote architectures may
+differ.
+
+The default SSH port is 22 and the default RSMon URL is `https://rsmon.ru`.
+Encrypted keys use `--key-passphrase-file`; password authentication uses
+`--password-file`; password-protected sudo uses `--sudo-password-file`. Direct
+secret flags are supported for interactive convenience but file options are
+safer for automation.
+
+SSH host keys are checked against `~/.ssh/known_hosts` by default. Use
+`--known-hosts PATH` or pin `--host-key-fingerprint SHA256:...`. The explicit
+`--insecure-host-key` option disables host authentication and should only be
+used in a trusted disposable environment.
 
 ## Configuration