feat: add one-click installer and server Docker bundle

On-Device Agent (curl|bash):
- dist/install-agent.sh: interactive full installer — apt deps,
  downloads agent payload from server, runs pi-agent/install/install.sh,
  registers node via /api/agents/register, installs Alloy log forwarder
- dist/build-agent-payload.sh: packages pi-agent/ into aads-agent.tgz
- pi-agent/alloy/config.alloy.tmpl: Alloy config template with
  __NODE_ID__/__LOKI_URL__ placeholders filled at install time

Server Docker bundle (prebuilt registry images):
- docker-compose.prod.yaml: mirrors dev compose but pulls
  ghcr.io/bs10081/aads-* images; mounts ./dist into dashboard for
  self-serve agent installer downloads
- dist/bootstrap-server.sh: interactive server bootstrap — generates
  secrets, writes .env, builds agent payload, compose pull+up, verifies
  DB, prints ready-to-paste agent install command
- .github/workflows/build-images.yml: builds and pushes 6 service
  images to GHCR on tag push; attaches agent payload to releases

Supporting changes:
- dashboard/app.py: add /install-agent.sh and /aads-agent.tgz static
  routes so targets download payload from the server without external net
- .env.example: add AADS_IMAGE_REGISTRY/TAG keys for prod compose
- .gitignore: stop ignoring dist/ scripts; only ignore dist/aads-agent.tgz
- DEPLOYMENT.md: rewrite for one-click server-first → agent flow
- docs/lab-deploy-plan.md: track lab deploy plan (untracked file)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: bs10081

.env.example

@@ -2,6 +2,14 @@
 # AI Auto Debug System - Environment Variables
 # ============================================
 
+# ============================================
+# Prebuilt service images (docker-compose.prod.yaml)
+# ============================================
+# Where the 6 custom service images are pulled from. Built/pushed by
+# .github/workflows/build-images.yml. Used only by docker-compose.prod.yaml.
+AADS_IMAGE_REGISTRY=ghcr.io/bs10081
+AADS_IMAGE_TAG=latest
+
 # ============================================
 # Layer 0: TimescaleDB 持久化存儲
 # ============================================

.github/workflows/build-images.yml

@@ -0,0 +1,82 @@
+name: build-images
+
+# Build & push the 6 custom AADS service images to GHCR, and publish the
+# On-Device Agent payload as a release asset. The server bootstrap
+# (dist/bootstrap-server.sh) pulls these images; targets download the payload.
+#
+# Triggers on version tags (v*) and can be run manually (pushes :latest).
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+
+jobs:
+  images:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        include:
+          - name: aads-layer1-filter
+            context: ./layer1-filter
+          - name: aads-ingester
+            context: ./layer1-filter/ingester
+          - name: aads-layer2-analyzer
+            context: ./layer2-analyzer
+          - name: aads-layer4-executor
+            context: ./layer4-executor
+          - name: aads-dashboard
+            context: ./dashboard
+          - name: aads-log-archiver
+            context: ./layer0-storage/sync
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.name }}
+          tags: |
+            type=ref,event=tag
+            type=raw,value=latest
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ matrix.context }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  agent-payload:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build agent payload
+        run: bash dist/build-agent-payload.sh "$GITHUB_WORKSPACE/dist/aads-agent.tgz"
+
+      - name: Attach to release
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/aads-agent.tgz
+            dist/install-agent.sh

.gitignore

@@ -9,9 +9,11 @@ venv/
 .venv/
 .venv-test/
 *.egg-info/
-dist/
 build/
 
+# Deployment scripts live in dist/ (tracked); only the built agent payload is ignored.
+dist/aads-agent.tgz
+
 # PyTorch/Transformers models
 *.bin
 *.pt

DEPLOYMENT.md

@@ -1,36 +1,79 @@
 # 🚀 Deployment Guide
 
+AADS has two sides: a **server** (Docker Compose stack) and one or more
+**on-device agents** (installed on the machines you want auto-debugged).
+Deploy the server first — it mints the token the agents need.
+
+## One-Click Deployment (recommended)
+
+### 1. Server (run on the controller host)
+
+From a repo checkout or the server bundle:
+
+```bash
+bash dist/bootstrap-server.sh
+```
+
+It interactively collects the upstream LLM API key (the only required value),
+auto-generates the remaining secrets, pulls the prebuilt images
+(`ghcr.io/bs10081/aads-*`), starts the stack, verifies the database, and prints
+the exact agent install command — with the token already filled in.
+
+> Private registry? Authenticate once before running:
+> `echo $GHCR_TOKEN | docker login ghcr.io -u <github-user> --password-stdin`
+
+### 2. On-Device Agent (run on each target)
+
+Copy-paste the command the server printed. It looks like:
+
+```bash
+curl -fsSL http://<server>:5000/install-agent.sh | sudo \
+  AADS_SERVER=<server> \
+  AADS_AGENT_TOKEN=<token> \
+  AADS_ADMIN_API_KEY=<admin-key> bash
+```
+
+This installs the On-Device Agent (V2 runner), auto-registers the node with the
+server, and installs the Alloy log forwarder pointed at the server's Loki. The
+installer downloads its payload (`aads-agent.tgz`) from the server itself — no
+external/GitHub access needed. Every prompt can be pre-set via environment
+variables (see the header of `dist/install-agent.sh`).
+
+### 3. Verify
+
+```bash
+# server
+docker compose -f docker-compose.prod.yaml --env-file .env ps
+curl -H "X-Admin-API-Key: <admin-key>" http://<server>:5000/api/agents
+
+# target
+curl -H "Authorization: Bearer <token>" http://<target>:8090/v1/node/facts
+systemctl is-active aads-agent alloy
+```
+
+## Building / publishing images
+
+Images are built and pushed by `.github/workflows/build-images.yml` on a
+version tag (`git tag v1.0.0 && git push --tags`). It also attaches
+`aads-agent.tgz` + `install-agent.sh` to the GitHub release, so agents can
+alternatively pull from the release by setting `AADS_RELEASE_BASE_URL`.
+
+## Manual / Dev Start (build locally)
+
+```bash
+git clone https://github.com/bs10081/AADS
+cd AADS
+cp .env.example .env   # edit secrets
+docker compose up -d --build   # builds images locally instead of pulling
+docker compose ps
+curl http://localhost:8000/health  # Ingester
+curl http://localhost:8080/health  # Layer 2 Analyzer
+```
+
 ## Prerequisites
 
-- Docker & Docker Compose
-- NVIDIA GPU (for LogBERT)
-- NVIDIA Container Toolkit
-
-## Quick Start
-
-1. **Clone the repository**
-   ```bash
-   git clone https://github.com/bs10081/ADDS
-   cd ADDS
-   ```
-
-2. **Validate Alloy configuration**
-   ```bash
-   docker run --rm -v $(pwd)/layer0-collector/alloy:/config \
-     grafana/alloy:latest validate /config/config.alloy
-   ```
-
-3. **Start all services**
-   ```bash
-   docker compose up -d
-   ```
-
-4. **Verify health**
-   ```bash
-   docker compose ps
-   curl http://localhost:8000/health  # Ingester
-   curl http://localhost:8080/health  # Layer 2 Analyzer
-   ```
+- Docker & Docker Compose v2
+- (Optional) NVIDIA GPU + Container Toolkit for the GPU LogBERT profile
 
 ## Architecture
 

dashboard/app.py

@@ -2,7 +2,7 @@
 Simple Dashboard for AI Auto-Debug System
 Display anomalies and diagnosis reports
 """
-from flask import Flask, render_template, jsonify, request
+from flask import Flask, render_template, jsonify, request, send_from_directory
 import asyncpg
 import asyncio
 import hashlib
@@ -262,6 +262,23 @@ def index():
     return render_template('index.html')
 
 
+# Self-serve On-Device Agent installer. The bootstrap script drops
+# install-agent.sh + aads-agent.tgz into AADS_DIST_DIR (mounted from ./dist),
+# so targets can `curl -fsSL http://<server>:5000/install-agent.sh | sudo bash`
+# without any external download source.
+DIST_DIR = os.getenv('AADS_DIST_DIR', '/app/dist')
+
+
+@app.route('/install-agent.sh')
+def serve_install_agent():
+    return send_from_directory(DIST_DIR, 'install-agent.sh', mimetype='text/x-shellscript')
+
+
+@app.route('/aads-agent.tgz')
+def serve_agent_payload():
+    return send_from_directory(DIST_DIR, 'aads-agent.tgz', mimetype='application/gzip')
+
+
 @app.route('/api/diagnosis')
 def api_diagnosis():
     """API endpoint for diagnosis reports"""