fix: 修复 Agent 使用 volume 映射时 PoW/WAF 运行时配置无法加载

internal/apps/agent/nginx/manager.go

@@ -275,6 +275,68 @@ func (m *Manager) writeTargetFiles(mainConfig string, routeConfig string, suppor
 	if err := os.WriteFile(m.RouteConfigPath, []byte(renderedRouteConfig), nginxConfigFilePerm); err != nil {
 		return err
 	}
+	return m.ensureOpenRestyWorkerReadAccess()
+}
+
+// ensureOpenRestyWorkerReadAccess makes runtime config and Lua paths traversable by the
+// unprivileged OpenResty worker user (typically nobody). Volume mounts may create parent
+// directories as 0700 root-owned; MkdirAll does not fix existing modes.
+func (m *Manager) ensureOpenRestyWorkerReadAccess() error {
+	targets := []string{
+		m.RuntimeConfigDir,
+		m.LuaDir,
+		filepath.Dir(m.MainConfigPath),
+		filepath.Dir(m.RouteConfigPath),
+	}
+	if m.AccessLogPath != "" {
+		targets = append(targets, filepath.Dir(m.AccessLogPath))
+	}
+	for _, target := range targets {
+		if err := ensureWorldTraversablePath(target); err != nil {
+			return err
+		}
+	}
+	if strings.TrimSpace(m.RuntimeConfigDir) == "" {
+		return nil
+	}
+	entries, err := os.ReadDir(m.RuntimeConfigDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+		path := filepath.Join(m.RuntimeConfigDir, entry.Name())
+		if chmodErr := os.Chmod(path, nginxConfigFilePerm); chmodErr != nil && !os.IsNotExist(chmodErr) {
+			return chmodErr
+		}
+	}
+	return nil
+}
+
+func ensureWorldTraversablePath(targetDir string) error {
+	const maxDepth = 12
+	current := filepath.Clean(strings.TrimSpace(targetDir))
+	if current == "" || current == "." {
+		return nil
+	}
+	for depth := 0; depth < maxDepth; depth++ {
+		if err := os.Chmod(current, nginxDirPerm); err != nil {
+			if os.IsNotExist(err) || os.IsPermission(err) {
+				break
+			}
+			return fmt.Errorf("chmod %s: %w", current, err)
+		}
+		parent := filepath.Dir(current)
+		if parent == current {
+			break
+		}
+		current = parent
+	}
 	return nil
 }
 

internal/apps/agent/nginx/manager_test.go

@@ -966,3 +966,28 @@ func TestObservabilityListenAddress(t *testing.T) {
 		t.Fatalf("unexpected path observability listen address: %s", got)
 	}
 }
+
+func TestEnsureWorldTraversableChainFixesRestrictedParentDirs(t *testing.T) {
+	tempDir := t.TempDir()
+	dataDir := filepath.Join(tempDir, "data")
+	runtimeDir := filepath.Join(dataDir, "etc", "openflare")
+	if err := os.MkdirAll(runtimeDir, 0o700); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+	configPath := filepath.Join(runtimeDir, "waf_config.json")
+	if err := os.WriteFile(configPath, []byte(`{}`), 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+
+	if err := ensureWorldTraversablePath(runtimeDir); err != nil {
+		t.Fatalf("ensureWorldTraversablePath failed: %v", err)
+	}
+
+	info, err := os.Stat(filepath.Join(dataDir, "etc"))
+	if err != nil {
+		t.Fatalf("Stat failed: %v", err)
+	}
+	if info.Mode().Perm()&0o005 == 0 {
+		t.Fatalf("expected etc directory to be world-traversable, got %o", info.Mode().Perm())
+	}
+}

internal/apps/agent/nginx/pow_assets.go

@@ -103,9 +103,14 @@ local function load_pow_config()
 
             pow_config_dict:set("_domain_keys", table.concat(domain_keys, "\n"), 0)
             pow_config_dict:set("_config_hash", current_hash, 0)
-            return
+            return true
         end
     end
+
+    if pow_config_dict:add("_pow_unreadable_config_logged", true, 60) then
+        ngx.log(ngx.WARN, "openflare pow config is not readable by worker; check directory permissions under ", "__OPENFLARE_RUNTIME_CONFIG_DIR__")
+    end
+    return false
 end
 
 load_pow_config()