commit 6256de741557ba1568c4c2489a18ce370a4c0256
Author: OverCooked <release@overcooked.invalid>
Date:   Wed Sep 2 14:58:03 2026 +0000

    release: publish customer installer

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..786fd73
--- /dev/null
+++ b/README.md
@@ -0,0 +1,10 @@
+# OverCooked Customer Installer
+
+Public customer deployment script only. No Auth source, credentials, keys, or production configuration are included.
+
+## Install
+
+Download this script and set the Auth URL, Auth public key map, and customer server IP:
+
+    curl -fsSL https://git.leee.xin/OverCooked/OverCooked-Installer/raw/branch/main/install.sh -o install.sh
+    sudo env OVERCOOKED_AUTH_URL=https://auth.example.invalid OVERCOOKED_AUTH_PUBLIC_KEYS='{"auth-1":"PUBLIC_KEY"}' OVERCOOKED_SERVER_IP=203.0.113.10 ./install.sh
diff --git a/install.sh b/install.sh
new file mode 100755
index 0000000..dc52240
--- /dev/null
+++ b/install.sh
@@ -0,0 +1,115 @@
+#!/bin/sh
+set -eu
+
+# Public customer bootstrap. Auth is an external service; no Auth image or
+# private source is downloaded by this script.
+REGISTRY="${OVERCOOKED_REGISTRY:-git.leee.xin/overcooked}"
+VERSION="${OVERCOOKED_VERSION:-20260902}"
+ROOT="${OVERCOOKED_ROOT:-/opt/overcooked}"
+SERVER_IP="${OVERCOOKED_SERVER_IP:-}"
+ACTIVATION_CODE="${OVERCOOKED_ACTIVATION_CODE:-}"
+AUTH_URL="${OVERCOOKED_AUTH_URL:-}"
+AUTH_PUBLIC_KEYS="${OVERCOOKED_AUTH_PUBLIC_KEYS:-}"
+
+die() { echo "overcooked-install: $*" >&2; exit 1; }
+[ "$(id -u)" = 0 ] || die "请使用 sudo/root 执行"
+command -v docker >/dev/null 2>&1 || die "未找到 Docker Engine"
+docker compose version >/dev/null 2>&1 || die "未找到 Docker Compose v2"
+command -v git >/dev/null 2>&1 || die "未找到 git"
+[ -n "$SERVER_IP" ] || SERVER_IP=$(hostname -I 2>/dev/null | awk '{print $1}')
+[ -n "$SERVER_IP" ] || die "无法识别服务器 IP，请设置 OVERCOOKED_SERVER_IP"
+case "$SERVER_IP" in *[!0-9.]*|*[!0-9]*) die "仅支持 IPv4 地址：$SERVER_IP";; esac
+[ -n "$AUTH_URL" ] || die "请设置 OVERCOOKED_AUTH_URL（Auth 服务地址）"
+[ -n "$AUTH_PUBLIC_KEYS" ] || die "请设置 OVERCOOKED_AUTH_PUBLIC_KEYS（Auth 公钥 JSON）"
+[ -n "$ACTIVATION_CODE" ] || printf '请输入授权码: '; [ -n "$ACTIVATION_CODE" ] || read -r ACTIVATION_CODE
+[ -n "$ACTIVATION_CODE" ] || die "授权码不能为空"
+
+install -d -m 700 "$ROOT"
+for repo in OverCooked-S Overcooked-E; do
+  if [ ! -d "$ROOT/$repo/.git" ]; then
+    git clone --depth 1 "https://git.leee.xin/OverCooked/$repo.git" "$ROOT/$repo"
+  else
+    git -C "$ROOT/$repo" fetch --depth 1 origin && git -C "$ROOT/$repo" reset --hard FETCH_HEAD
+  fi
+done
+install -d -m 700 "$ROOT/config"
+command -v openssl >/dev/null 2>&1 || die "未找到 openssl"
+secret() { openssl rand -hex 32; }
+s_db=$(secret); s_valkey=$(secret); internal=$(secret); access=$(secret); setup=$(secret)
+e_db=$(secret); ticket=$(secret); lease=$(secret); storage=$(secret); plugin=$(secret)
+cat >"$ROOT/production.env" <<EOF
+S_CONTROL_IMAGE=$REGISTRY/overcooked-s-control:$VERSION
+S_WEBUI_IMAGE=$REGISTRY/overcooked-s-webui:$VERSION
+S_POSTGRES_PASSWORD=$s_db
+S_VALKEY_PASSWORD=$s_valkey
+S_INTERNAL_KEY_ID=customer-s
+S_INTERNAL_SHARED_SECRET=$internal
+S_ACCESS_TOKEN_SECRET=$access
+S_SETUP_TOKEN=$setup
+S_E_BASE_URL=http://e-server:8096
+S_E_PUBLIC_URL=http://$SERVER_IP:8096
+S_E_KEY_ID=customer-e
+S_E_INTERNAL_SECRET=$internal
+S_E_ALLOW_INSECURE_HTTP=true
+S_AUTH_BASE_URL=$AUTH_URL
+S_AUTH_ALLOW_INSECURE_HTTP=$(case "$AUTH_URL" in http://*) echo true;; *) echo false;; esac)
+S_AUTH_PUBLIC_KEYS=$AUTH_PUBLIC_KEYS
+S_INSTANCE_ID=s-$(hostname | tr -cd '[:alnum:]' | cut -c1-24)
+S_PUBLIC_HOST=$SERVER_IP
+S_PORTAL_SERVER_URL=http://$SERVER_IP:18080
+S_PORTAL_WEB_CLIENT_URL=http://$SERVER_IP:18083/login
+S_API_PORT_MAPPING=0.0.0.0:18080:8080
+S_WEB_PORT_MAPPING=0.0.0.0:18083:3000
+PRODUCT_E_IMAGE=$REGISTRY/overcooked-e:$VERSION
+PRODUCT_E_INSTANCE_ID=e-$(hostname | tr -cd '[:alnum:]' | cut -c1-24)
+PRODUCT_E_DATABASE_URL=postgres://product_e:$e_db@postgres:5432/product_e?sslmode=disable
+PRODUCT_E_POSTGRES_PASSWORD=$e_db
+PRODUCT_E_VALKEY_PASSWORD=$s_valkey
+PRODUCT_E_CONTROL_PLANE_URL=http://s-control:8080
+PRODUCT_E_CONTROL_PLANE_KEY_ID=customer-s
+PRODUCT_E_CONTROL_PLANE_SHARED_SECRET=$internal
+PRODUCT_E_LICENSE_ENABLED=true
+PRODUCT_E_AUTH_URL=$AUTH_URL
+PRODUCT_E_AUTH_ACTIVATION_CODE=$ACTIVATION_CODE
+PRODUCT_E_AUTH_PUBLIC_KEYS=$AUTH_PUBLIC_KEYS
+PRODUCT_E_PLAYBACK_TICKET_KEY_ID=customer-playback
+PRODUCT_E_PLAYBACK_TICKET_SECRET=$ticket
+PRODUCT_E_PLAYBACK_LEASE_KEY=$lease
+PRODUCT_E_STORAGE_CREDENTIAL_KEY_ID=customer-storage
+PRODUCT_E_STORAGE_CREDENTIAL_KEY=$storage
+PRODUCT_E_PLUGIN_SECRET_KEY_ID=customer-plugin
+PRODUCT_E_PLUGIN_SECRET_KEY=$plugin
+PRODUCT_E_PLUGIN_TRUSTED_PUBLISHERS={}
+EOF
+chmod 600 "$ROOT/production.env"
+
+cat >"$ROOT/config/e-server.production.yaml" <<EOF
+service:
+  environment: production
+server:
+  address: 0.0.0.0:8096
+database:
+  url: postgres://product_e:$(grep '^PRODUCT_E_POSTGRES_PASSWORD=' "$ROOT/production.env" | cut -d= -f2)@postgres:5432/product_e?sslmode=disable
+valkey:
+  address: valkey:6379
+control_plane:
+  base_url: http://s-control:8080
+playback:
+  node_id: e-$(hostname | tr -cd '[:alnum:]' | cut -c1-24)
+EOF
+chmod 600 "$ROOT/config/e-server.production.yaml"
+cp "$ROOT/config/e-server.production.yaml" "$ROOT/Overcooked-E/deploy/compose/config/e-server.production.yaml"
+cat >"$ROOT/config/e-public.override.yml" <<'EOF'
+services:
+  e-server:
+    ports:
+      - "0.0.0.0:8096:8096"
+EOF
+docker login "${REGISTRY%%/*}"
+docker network inspect overcooked-control >/dev/null 2>&1 || docker network create overcooked-control >/dev/null
+docker compose -p overcooked-e --env-file "$ROOT/production.env" -f "$ROOT/Overcooked-E/deploy/compose/production.yml" run --rm e-server migrate
+docker compose -p overcooked-e --env-file "$ROOT/production.env" -f "$ROOT/Overcooked-E/deploy/compose/production.yml" -f "$ROOT/Overcooked-E/deploy/compose/control-plane-network.yml" -f "$ROOT/config/e-public.override.yml" up -d --no-build
+docker compose -p overcooked-s --env-file "$ROOT/production.env" -f "$ROOT/OverCooked-S/deploy/s/docker-compose.production.yml" up -d --no-build
+echo "配置已写入 $ROOT/production.env"
+echo "现在启动 S/E；首次启动后打开 http://$SERVER_IP:18083/setup 输入授权码和页面显示的 Setup Token。"
+echo "镜像来源：$REGISTRY（不包含 Auth 镜像）"