feat(deploy): harden restricted-network agent installs

server/internal/installscript/templates/agent-compose.yml.tmpl

@@ -1,14 +1,22 @@
-# BackupX Agent docker-compose 片段
+# BackupX Agent Compose 片段
 # 生成于 {{.MasterURL}} · 节点 ID {{.NodeID}}
-version: "3.8"
+# 文件包含长期节点 Token，请保存为 0600 权限并在部署完成后限制访问。
 services:
   backupx-agent:
     image: awuqing/backupx:{{.AgentVersion}}
     command: ["agent"]
+    user: "0:0"
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     environment:
       BACKUPX_AGENT_MASTER: "{{.MasterURL}}"
       BACKUPX_AGENT_TOKEN: "{{.AgentToken}}"
       BACKUPX_AGENT_TEMP_DIR: "/var/lib/backupx-agent/tmp"
-    volumes:
+{{if .ProxyURL}}      BACKUPX_AGENT_PROXY_URL: "{{.ProxyURL}}"
+{{end}}{{if .CACertFile}}      BACKUPX_AGENT_CA_CERT_FILE: "{{.CACertFile}}"
+{{end}}    volumes:
       - /var/lib/backupx-agent:/var/lib/backupx-agent
+{{if .CACertFile}}      - {{.CACertFile}}:{{.CACertFile}}:ro
+{{end}}      # 备份宿主机文件时，必须按需添加只读源目录挂载：
+      # - /srv/data:/srv/data:ro