[#37] server install 增加重试自检

deployment/build/templates/scripts/server-install.sh

@@ -40,6 +40,8 @@ prepare_data_dirs() {
     # still ensure basic directories exist (no chown)
     mkdir -p \
       "$PKG_ROOT/private/argus/etc" \
+      "$PKG_ROOT/private/argus/log/elasticsearch" \
+      "$PKG_ROOT/private/argus/log/kibana" \
       "$PKG_ROOT/private/argus/metric/prometheus" \
       "$PKG_ROOT/private/argus/metric/prometheus/data" \
       "$PKG_ROOT/private/argus/metric/prometheus/rules" \
@@ -153,6 +155,37 @@ YAML
   (cd "$PKG_ROOT/compose" && "${COMPOSE[@]}" -p "$PROJECT_NAME" -f docker-compose.yml -f $(basename "$ov") up -d "${services[@]}")
 }
 
+# Post bootstrap container-side fixes that do not require sudo on host.
+post_bootstrap_fixes() {
+  # Kibana: ensure /usr/share/kibana/data is a symlink into mounted path to avoid EACCES
+  if docker ps --format '{{.Names}}' | grep -q '^argus-kibana-sys$'; then
+    docker exec argus-kibana-sys bash -lc '
+      set -e
+      mkdir -p /private/argus/log/kibana && chmod 777 /private/argus/log/kibana || true
+      if [ -d /usr/share/kibana/data ] && [ ! -L /usr/share/kibana/data ]; then rm -rf /usr/share/kibana/data; fi
+      if [ ! -e /usr/share/kibana/data ]; then ln -s /private/argus/log/kibana /usr/share/kibana/data; fi
+    ' >/dev/null 2>&1 || true
+  fi
+  # Elasticsearch: ensure data path points to mounted path and is writable
+  if docker ps --format '{{.Names}}' | grep -q '^argus-es-sys$'; then
+    docker exec argus-es-sys bash -lc '
+      set -e
+      mkdir -p /private/argus/log/elasticsearch && chmod 777 /private/argus/log/elasticsearch || true
+      if [ -d /usr/share/elasticsearch/data ] && [ ! -L /usr/share/elasticsearch/data ]; then rm -rf /usr/share/elasticsearch/data; fi
+      if [ ! -e /usr/share/elasticsearch/data ]; then ln -s /private/argus/log/elasticsearch /usr/share/elasticsearch/data; fi
+    ' >/dev/null 2>&1 || true
+  fi
+  # Bind9: ensure rndc.key exists
+  if docker ps --format '{{.Names}}' | grep -q '^argus-bind-sys$'; then
+    docker exec argus-bind-sys bash -lc '
+      set -e
+      mkdir -p /etc/bind
+      if [ ! -f /etc/bind/rndc.key ]; then rndc-confgen -a -c /etc/bind/rndc.key; fi
+      chmod 644 /etc/bind/rndc.key || true
+    ' >/dev/null 2>&1 || true
+  fi
+}
+
 dns_bootstrap() {
   log "DNS bootstrap: initializing shared dns.conf and container resolv.conf"
   local etc_dir="$PKG_ROOT/private/argus/etc"
@@ -206,8 +239,31 @@ dns_bootstrap() {
 }
 
 selfcheck() {
-  log "running selfcheck"
-  bash "$PKG_ROOT/scripts/server-selfcheck.sh" || { err "selfcheck failed"; exit 1; }
+  # Initial selfcheck with retries to absorb cold starts
+  local max_retries="${SELF_CHECK_RETRIES:-5}"   # 重试次数（不含首次），默认 5
+  local wait_seconds="${SELF_CHECK_WAIT_SECONDS:-30}"  # 每次重试前等待秒数，默认 30s
+
+  local attempt=0
+  while :; do
+    attempt=$((attempt+1))
+    if (( attempt == 1 )); then
+      log "running selfcheck (attempt ${attempt})"
+    else
+      log "running selfcheck (attempt ${attempt}/${max_retries}+1)"
+    fi
+
+    if bash "$PKG_ROOT/scripts/server-selfcheck.sh"; then
+      return 0
+    fi
+
+    # failed
+    if (( attempt > max_retries )); then
+      err "selfcheck failed after ${attempt} attempt(s)"
+      exit 1
+    fi
+    log "selfcheck not ready yet; retrying in ${wait_seconds}s..."
+    sleep "$wait_seconds"
+  done
 }
 
 main() {
@@ -216,6 +272,7 @@ main() {
   prepare_data_dirs
   load_images
   bring_up
+  post_bootstrap_fixes
   dns_bootstrap
   selfcheck
   log "install completed. See logs in $PKG_ROOT/logs/"