feat: 对齐 xxxig/proxy 打包规范并迁移配置至 /etc/mond

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -9,7 +9,7 @@ on:
 env:
   DOCKER_BUILDKIT: "1"
   PRODUCT_NAME: "mond"
-  MONERO_VERSION: "v0.18.4.6"
+  PACKAGE_VERSION: "0.18.5.0"
   BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
 
 jobs:
@@ -35,11 +35,7 @@ jobs:
       - name: Build binaries
         run: |
           PLATFORM="linux/${{ matrix.arch }}"
-
-          echo "🏗️ Building ${PLATFORM} on native ${{ matrix.arch }} runner"
-          echo "📦 Using Ubuntu 20.04 with depends system"
-          echo "📦 Monero Version: ${MONERO_VERSION}"
-          echo "🔗 Static linking enabled"
+          MONERO_VERSION="v${PACKAGE_VERSION}"   # 上游 Monero git tag 带 v 前缀，需补回
 
           # 设置 BuildKit 优化参数
           export BUILDKIT_PROGRESS=plain
@@ -53,7 +49,7 @@ jobs:
       - name: Package and test
         run: |
           DIR="./output/linux_${{ matrix.arch }}"
-          VERSION=${MONERO_VERSION#v}  # 移除前导 v
+          VERSION=${PACKAGE_VERSION}
           TARGZ="${PRODUCT_NAME}-${{ matrix.arch }}-ubuntu-${VERSION}.tar.gz"
 
           tar -czf "${TARGZ}" -C "$DIR" .
@@ -64,6 +60,9 @@ jobs:
           # 快速验证
           mkdir -p test && tar -xzf "${TARGZ}" -C test
           test/mond --version 2>/dev/null || echo "⚠️ 跳过版本检查"
+          # 纯静态校验（depends 系统应产出无动态依赖的二进制）
+          ldd test/mond 2>&1 | grep -q "not a dynamic executable" \
+            && echo "✅ 纯静态链接" || echo "⚠️ 非纯静态二进制"
           rm -rf test
 
       - name: Build Debian package
@@ -71,12 +70,12 @@ jobs:
           # 安装 dpkg-deb（如果需要）
           sudo apt-get update && sudo apt-get install -y dpkg-dev
 
-          DIR="./output/linux_${{ matrix.arch }}"
-          VERSION=${MONERO_VERSION#v}  # 移除前导 v
+          VERSION=${PACKAGE_VERSION}
+          TARGZ="${PRODUCT_NAME}-${{ matrix.arch }}-ubuntu-${VERSION}.tar.gz"
 
           echo "📦 Building Debian package for ${{ matrix.arch }}..."
           chmod +x debian/build-deb.sh
-          ./debian/build-deb.sh ${{ matrix.arch }} ${VERSION} "${DIR}"
+          ./debian/build-deb.sh ${{ matrix.arch }} ${VERSION} "${TARGZ}"
 
           ls -lh *.deb
 
@@ -110,12 +109,13 @@ jobs:
           REGISTRY=$(echo "${{ gitea.server_url }}" | sed 's|https\?://||')
           OWNER="${{ gitea.repository_owner }}"
           REPO_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f2)
+          VERSION="${TAG#v}"   # 包版本：去掉 git tag 的 v 前缀（registry 路径/下载名/Release 标题统一用）
 
           echo "📦 上传包到 Generic Package Registry..."
           echo "  Registry: ${REGISTRY}"
           echo "  Owner: ${OWNER}"
           echo "  Package: ${PRODUCT_NAME}"
-          echo "  Version: ${TAG}"
+          echo "  Version: ${VERSION}"
 
           # 上传所有 tar.gz 包到 Generic Package Registry
           for file in *.tar.gz; do
@@ -124,7 +124,7 @@ jobs:
             curl -fsSL -X PUT \
               -H "Authorization: token ${TOKEN}" \
               --upload-file "$file" \
-              "https://${REGISTRY}/api/packages/${OWNER}/generic/${PRODUCT_NAME}/${TAG}/$file" || {
+              "https://${REGISTRY}/api/packages/${OWNER}/generic/${PRODUCT_NAME}/${VERSION}/$file" || {
               echo "❌ 上传失败: $file"
               exit 1
             }
@@ -147,12 +147,35 @@ jobs:
             }
           done
 
-          # 生成 Release JSON payload
+          # 生成 Release 描述
           echo ""
           echo "📝 生成 Release..."
 
-          export REGISTRY OWNER TAG
-          RELEASE_DATA=$(python3 -c 'import json,glob,os;r=os.environ["REGISTRY"];o=os.environ["OWNER"];p=os.environ["PRODUCT_NAME"];t=os.environ["TAG"];b=["## Release "+t,"","Mond 是 Monero 守护进程 (monerod) 的定制版本。","","### ✨ 主要特性","","- 🔗 **纯静态链接** - 无需依赖，可在任意 Linux 系统运行","- 🏗️ **多架构支持** - 原生支持 AMD64 和 ARM64","- 📦 **官方构建系统** - 使用 Monero 官方 depends 系统构建，确保可靠性","","### 📥 下载方式","","#### 方式一：直接下载（推荐）","","点击下方 **Assets** 区域的文件名直接下载。","","**可用安装包：**",""]+[f"- [`{f}`](https://{r}/api/packages/{o}/generic/{p}/{t}/{f})" for f in sorted(glob.glob("*.tar.gz"))]+["","#### 方式二：通用软件包仓库","","通过命令行下载：",""]+[f"```bash\nwget https://{r}/api/packages/{o}/generic/{p}/{t}/{f}\n```" for f in sorted(glob.glob("*.tar.gz"))[:1]]+["","#### 方式三：Debian 软件源","","```bash","# 下载 GPG 密钥",f"sudo curl https://{r}/api/packages/{o}/debian/repository.key -o /etc/apt/keyrings/gitea-{o}.asc","","# 添加软件源",f"echo \"deb [signed-by=/etc/apt/keyrings/gitea-{o}.asc] https://{r}/api/packages/{o}/debian stable main\" | sudo tee -a /etc/apt/sources.list.d/{o}.list","","# 更新并安装","sudo apt-get update","sudo apt-get install mond","```"];print(json.dumps({"tag_name":t,"name":f"Release {t}","body":"\n".join(b),"draft":False,"prerelease":False}))')
+          # 拼接 tar.gz 下载链接
+          ASSETS=$(for f in *.tar.gz; do
+            [ -f "$f" ] || continue
+            echo "- [\`$f\`](https://${REGISTRY}/api/packages/${OWNER}/generic/${PRODUCT_NAME}/${VERSION}/$f)"
+          done)
+
+          BODY=$(cat <<EOF
+          ## Release ${VERSION}
+
+          ### 📥 Debian/Ubuntu 安装
+
+          \`\`\`bash
+          sudo curl https://${REGISTRY}/api/packages/${OWNER}/debian/repository.key -o /etc/apt/keyrings/gitea-${OWNER}.asc
+          echo "deb [signed-by=/etc/apt/keyrings/gitea-${OWNER}.asc] https://${REGISTRY}/api/packages/${OWNER}/debian stable main" | sudo tee /etc/apt/sources.list.d/${OWNER}.list
+          sudo apt-get update && sudo apt-get install ${PRODUCT_NAME}
+          \`\`\`
+
+          ### 📦 tar.gz 下载
+
+          ${ASSETS}
+          EOF
+          )
+
+          RELEASE_DATA=$(jq -n --arg tag "$TAG" --arg ver "$VERSION" --arg body "$BODY" \
+            '{tag_name: $tag, name: "Release \($ver)", body: $body, draft: false, prerelease: false}')
 
           # 创建 Release
           echo ""

.gitignore

@@ -8,3 +8,9 @@
 llmdoc/
 example/
 .source/
+
+# 构建产物
+*.deb
+*.tar.gz
+output/
+packages/

CLAUDE.md

@@ -0,0 +1,57 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## 仓库性质
+
+本仓库**只包含构建与打包基础设施**，不含 mond 源码。源码在编译时从外部仓库克隆（见 [docker/Dockerfile.ubuntu](docker/Dockerfile.ubuntu)）：
+
+- 源码仓库：`github.com/monero-project/monero.git`（**Monero 官方仓库**，非换名仓库）
+- 发布仓库：Gitea `gitea.bcde.io` 下 `wangdefa/mond` 的 Generic / Debian 包仓库
+
+mond 是 Monero 守护进程 `monerod` 的定制换名构建。换名通过 [init.sh](init.sh) 在编译期对源码做 `sed` 改写完成：`project(monero)→project(mond)`、二进制 `OUTPUT_NAME monerod→mond`、`MONERO_VERSION_*` 宏 → `MOND_VERSION_*`、用户可见字符串 `Monero→Mond`。**改动版本宏或显示字符串相关逻辑时，改 init.sh 而非源码**（源码每次构建都重新克隆）。
+
+> **与同目录 `gitea-xxxig` / `gitea-xxxig-proxy` 的关键差异**：那两个项目源码来自 `wangdefaa`（双 a）换名仓库；mond 直接克隆 Monero 官方仓库，靠 init.sh 现场改名。三者共享同一套 CI / build-deb / debian 打包骨架，但 mond 的构建方式（官方 depends 系统）和版本号格式（四段 `0.18.5.0`）不同。
+
+## 整体架构：单二进制
+
+编译产出单个可执行文件 `mond`：Monero 全节点守护进程，负责 P2P 同步区块链、提供 RPC。配置来自 [conf/params.example.conf](conf/params.example.conf)。
+
+## 构建与发布流程（CI）
+
+[.gitea/workflows/ci.yaml](.gitea/workflows/ci.yaml) 是 Gitea Actions 流水线：
+
+1. **build-and-test**（矩阵 `arch=[amd64,arm64]`，跑在对应架构原生 runner）：用 `docker buildx` 按 [docker/Dockerfile.ubuntu](docker/Dockerfile.ubuntu) 原生编译 → 打成 tar.gz → 解包冒烟测试（`mond --version` + `ldd` 纯静态校验）→ 调 `debian/build-deb.sh` 打 .deb → 上传 artifact。
+2. **release**（仅 tag 触发）：下载 artifact，上传 tar.gz 到 Generic Package Registry、上传 .deb 到 Debian Registry（stable/main），并用 `jq` 生成描述创建 Gitea Release。
+
+关键点：
+- **只构建 ubuntu，不做 alpine**（与参考项目不同，刻意取舍）：mond 用 Monero **官方 depends 系统**（`make depends target=…`）交叉编译，产物为纯静态二进制（`ldd` 显示 "not a dynamic executable"），任意发行版可跑，Alpine 无需单独构建；且单次构建耗时 30–60 分钟，加 distro 维度会让 CI 翻倍而无收益。
+- **版本号约定**：包版本硬编码在 ci.yaml 的 `PACKAGE_VERSION: "0.18.5.0"`（**纯数字、无 v**，符合 Debian 版本规范）。**关键分界**：上游 Monero git tag 带 `v`，故 build job 用 `MONERO_VERSION=v${PACKAGE_VERSION}` 补回 v 传给 Dockerfile `git checkout`；tar.gz / deb / registry 路径 / Release 标题等包版本一律直接用 `${PACKAGE_VERSION}`；release job 用 `VERSION="${TAG#v}"` 归一。发版改 `PACKAGE_VERSION` 并打对应 `v*` tag。
+- **依赖精简**：depends 系统已将 boost/openssl/zmq/unbound/sodium/unwind 静态链入，故 [debian/control.template](debian/control.template) 仅 `Depends: libc6`，无需列动态库。
+- 架构名映射：Dockerfile 内 `arm64→aarch64-linux-gnu`、`amd64→x86_64-linux-gnu` 作为 depends target。
+- tar.gz 下载 URL 形如 `https://gitea.bcde.io/api/packages/wangdefa/generic/mond/{version}/mond-{arch}-ubuntu-{version}.tar.gz`（version 为纯数字）。
+
+## 本地常用命令
+
+```bash
+# 本地编译某架构的二进制（输出到 ./output/linux_<arch>/mond）
+docker buildx build --platform linux/amd64 \
+  --build-arg MONERO_VERSION=v0.18.5.0 \
+  --output type=local,dest=./output \
+  -f docker/Dockerfile.ubuntu .
+
+# 用已有 tar.gz 打 .deb 包（注意第三个参数是 tar.gz，不是目录）
+./debian/build-deb.sh amd64 0.18.5.0 mond-amd64-ubuntu-0.18.5.0.tar.gz
+
+# 改 shell 脚本后做静态检查（需自行安装 shellcheck）
+shellcheck debian/*.sh
+```
+
+无单元测试；CI 中唯一的冒烟测试是解包后跑 `mond --version` 并 `ldd` 校验纯静态。
+
+## Debian 包布局与服务
+
+- 二进制装到 `/opt/mond/mond`，systemd 服务文件 [debian/mond.service](debian/mond.service)，维护脚本 `debian/{postinst,prerm,postrm}`。
+- **配置流转（单一数据源）**：`conf/params.example.conf` 是唯一配置源 → build-deb.sh 复制进包内 `/opt/mond/params.conf` → postinst 首次安装时 `cp` 到 `/etc/mond/params.conf`（**升级不覆盖**用户已有配置；旧版本位于 `/var/lib/mond/params.conf` 时 postinst 会自动迁移到 `/etc/mond/`）。service 的 `ExecStart` 用 `--config-file=/etc/mond/params.conf`。**改默认配置改 conf/params.example.conf 一处即可**（不要再在 postinst 内联）。
+- 数据目录 `/var/lib/mond/data`、日志目录 `/var/log/mond`，均归 `mond` 系统用户。
+- postinst 创建 `mond` 系统用户/组。**服务不自动启用/启动**（首次同步需用户确认配置），升级时若服务原为 enabled 则重启以加载新二进制。.deb 安装后手动 `systemctl enable --now mond`。

README.md

@@ -33,11 +33,11 @@ sudo apt-get install mond
 ### 方式二：通用二进制包
 
 ```bash
-# 1. 下载对应架构的包
-wget https://gitea.bcde.io/releases/download/v0.18.4.6/mond-amd64-ubuntu-v0.18.4.6.tar.gz
+# 1. 下载对应架构的包（registry 路径与下载名版本号均不带 v 前缀）
+wget https://gitea.bcde.io/api/packages/wangdefa/generic/mond/0.18.5.0/mond-amd64-ubuntu-0.18.5.0.tar.gz
 
 # 2. 解压
-tar -xzf mond-amd64-ubuntu-v0.18.4.6.tar.gz
+tar -xzf mond-amd64-ubuntu-0.18.5.0.tar.gz
 
 # 3. 运行
 ./mond --help
@@ -92,7 +92,7 @@ sudo systemctl disable mond.service
 
 ```
 /opt/mond/mond                  # 二进制文件
-/var/lib/mond/params.conf       # 配置文件
+/etc/mond/params.conf           # 配置文件
 /var/lib/mond/data/             # 区块链数据目录
 /var/log/mond/                  # 日志目录
 ```
@@ -103,7 +103,7 @@ Debian/Ubuntu 系统包使用配置文件方式运行，修改配置非常简单
 
 ```bash
 # 1. 编辑配置文件
-sudo nano /var/lib/mond/params.conf
+sudo nano /etc/mond/params.conf
 
 # 2. 重启服务使配置生效
 sudo systemctl restart mond.service

debian/build-deb.sh

@@ -3,16 +3,18 @@ set -e
 
 # 参数检查
 if [ $# -ne 3 ]; then
-    echo "Usage: $0 <ARCH> <VERSION> <BINARY_DIR>"
-    echo "Example: $0 amd64 0.18.4.6 build/Linux/release/bin"
+    echo "Usage: $0 <ARCH> <VERSION> <TARGZ_FILE>"
+    echo "Example: $0 amd64 0.18.5.0 mond-amd64-ubuntu-0.18.5.0.tar.gz"
     exit 1
 fi
 
 ARCH=$1
 VERSION=$2
-BINARY_DIR=$3
+TARGZ_FILE=$3
 PKG_NAME="mond"
-DEB_FILE="${PKG_NAME}_${VERSION}_${ARCH}.deb"
+DEB_VERSION="${VERSION#v}"   # Debian 版本号必须以数字开头，去掉可能的 v 前缀
+
+[ -f "$TARGZ_FILE" ] || { echo "❌ 找不到产物包: $TARGZ_FILE"; exit 1; }
 
 # 转换架构名称（Docker 使用的架构名到 Debian 架构名）
 case "$ARCH" in
@@ -28,34 +30,34 @@ case "$ARCH" in
         ;;
 esac
 
+DEB_FILE="${PKG_NAME}_${DEB_VERSION}_${DEB_ARCH}.deb"
+
 echo "📦 Building Debian package: ${DEB_FILE}"
 echo "  Architecture: ${DEB_ARCH}"
-echo "  Version: ${VERSION}"
-echo "  Binary directory: ${BINARY_DIR}"
-
-# 检查二进制文件是否存在
-if [ ! -f "${BINARY_DIR}/mond" ]; then
-    echo "❌ Error: mond binary not found in ${BINARY_DIR}"
-    exit 1
-fi
+echo "  Version: ${DEB_VERSION}"
+echo "  Source: ${TARGZ_FILE}"
 
 # 创建临时目录
 BUILD_DIR=$(mktemp -d)
 trap "rm -rf $BUILD_DIR" EXIT
 
 # 创建包目录结构
-PKG_DIR="${BUILD_DIR}/${PKG_NAME}_${VERSION}_${DEB_ARCH}"
+PKG_DIR="${BUILD_DIR}/${PKG_NAME}_${DEB_VERSION}_${DEB_ARCH}"
 mkdir -p "${PKG_DIR}/DEBIAN"
 mkdir -p "${PKG_DIR}/opt/mond"
 mkdir -p "${PKG_DIR}/lib/systemd/system"
 
-# 复制二进制文件
-echo "📂 Copying binary..."
-cp "${BINARY_DIR}/mond" "${PKG_DIR}/opt/mond/mond"
+# 解压二进制文件
+echo "📂 Extracting binary..."
+tar -xzf "${TARGZ_FILE}" -C "${PKG_DIR}/opt/mond"
+
+# 打入默认配置（conf/params.example.conf 为唯一配置源，postinst 据此生成 /etc/mond/params.conf）
+echo "📄 Bundling default config..."
+cp conf/params.example.conf "${PKG_DIR}/opt/mond/params.conf"
 
 # 生成 control 文件
 echo "📝 Generating control file..."
-sed -e "s/{{VERSION}}/${VERSION}/" \
+sed -e "s/{{VERSION}}/${DEB_VERSION}/" \
     -e "s/{{ARCH}}/${DEB_ARCH}/" \
     debian/control.template > "${PKG_DIR}/DEBIAN/control"
 
@@ -74,6 +76,7 @@ cp debian/mond.service "${PKG_DIR}/lib/systemd/system/"
 
 # 设置权限
 chmod 755 "${PKG_DIR}/opt/mond/mond"
+chmod 644 "${PKG_DIR}/opt/mond/params.conf"
 chmod 644 "${PKG_DIR}/lib/systemd/system/mond.service"
 
 # 构建 deb 包

debian/control.template

@@ -3,7 +3,7 @@ Version: {{VERSION}}
 Section: net
 Priority: optional
 Architecture: {{ARCH}}
-Depends: libc6, libboost-system1.74.0 | libboost-system1.81.0 | libboost-system1.83.0, libboost-filesystem1.74.0 | libboost-filesystem1.81.0 | libboost-filesystem1.83.0, libboost-thread1.74.0 | libboost-thread1.81.0 | libboost-thread1.83.0, libboost-program-options1.74.0 | libboost-program-options1.81.0 | libboost-program-options1.83.0, libssl3 | libssl1.1, libzmq5, libunwind8
+Depends: libc6 (>= 2.31)
 Maintainer: Mond Team <noreply@example.com>
 Homepage: https://github.com/monero-project/monero
 Description: Mond cryptocurrency daemon

debian/mond.service

@@ -9,7 +9,7 @@ Type=simple
 WorkingDirectory=/opt/mond
 
 # 执行命令 - 使用配置文件
-ExecStart=/opt/mond/mond --config-file=/var/lib/mond/params.conf --non-interactive
+ExecStart=/opt/mond/mond --config-file=/etc/mond/params.conf --non-interactive
 
 # 重启策略
 Restart=always

debian/postinst

@@ -17,128 +17,43 @@ mkdir -p /var/log/mond
 chown mond:mond /var/log/mond
 chmod 750 /var/log/mond
 
-# Create data directory
+# Create data directory（非递归设权限，避免升级时遍历庞大的区块链数据目录）
 mkdir -p /var/lib/mond/data
-chown -R mond:mond /var/lib/mond
-chmod -R 750 /var/lib/mond
+chown mond:mond /var/lib/mond /var/lib/mond/data
+chmod 750 /var/lib/mond /var/lib/mond/data
 
-# Create configuration file if it doesn't exist
-if [ ! -f /var/lib/mond/params.conf ]; then
-    cat > /var/lib/mond/params.conf << 'CONF'
-# Mond Configuration File
-# This file is automatically created during installation
-# Edit this file to customize your Mond daemon settings
-# After modifying, restart the service: sudo systemctl restart mond.service
+# Create config directory
+mkdir -p /etc/mond
 
-# DATA STORAGE
-# ============================================================================
-# data-dir: 区块链数据存储目录
-data-dir=/var/lib/mond/data
-
-# BLOCKCHAIN PRUNING
-# ============================================================================
-# prune-blockchain: 启用区块链修剪模式
-prune-blockchain=1
-
-# sync-pruned-blocks: 同步已修剪的区块（默认启用）
-sync-pruned-blocks=1
-
-# NETWORK PEER SETTINGS
-# ============================================================================
-# out-peers: 主动连接的对等节点数量（出站连接）
-out-peers=32
-
-# in-peers: 接受连接的对等节点数量（入站连接）
-in-peers=64
-
-# limit-rate-up: 上传速率限制（kB/s）
-limit-rate-up=1048576
-
-# limit-rate-down: 下载速率限制（kB/s）
-limit-rate-down=1048576
-
-# PRIORITY NODES
-# ============================================================================
-# add-priority-node: 优先连接的可信节点
-add-priority-node=p2pmd.xmrvsbeast.com:18080
-add-priority-node=nodes.hashvault.pro:18080
-
-# SECURITY AND NETWORK INTEGRITY
-# ============================================================================
-# enforce-dns-checkpointing: 强制执行 DNS 检查点验证
-enforce-dns-checkpointing=1
-
-# enable-dns-blocklist: 启用 DNS 黑名单
-enable-dns-blocklist=1
-
-# ZMQ NOTIFICATION SYSTEM
-# ============================================================================
-# zmq-pub: ZeroMQ 发布接口，用于实时广播区块链事件
-zmq-pub=tcp://127.0.0.1:18083
-
-# P2P AND RPC NETWORK BINDING
-# ============================================================================
-# p2p-bind-ip: P2P 网络监听地址（默认启用，绑定所有网络接口）
-p2p-bind-ip=0.0.0.0
-
-# p2p-bind-port: P2P 网络监听端口
-p2p-bind-port=18080
-
-# rpc-bind-ip: RPC 接口监听地址
-#rpc-bind-ip=0.0.0.0
-
-# rpc-bind-port: RPC 接口监听端口
-#rpc-bind-port=18081
-
-# confirm-external-bind: 确认外部网络绑定
-#confirm-external-bind=1
-
-# RPC AUTHENTICATION
-# ============================================================================
-# rpc-login: RPC 访问认证凭据
-#rpc-login=user:password
-
-# RPC SSL/TLS ENCRYPTION
-# ============================================================================
-# rpc-ssl: 启用 RPC 连接的 SSL/TLS 加密（语义更清晰的启用方式）
-#rpc-ssl=enabled
-
-# rpc-ssl-certificate: SSL 证书文件路径
-#rpc-ssl-certificate=/path/to/your/certificate.pem
-
-# rpc-ssl-private-key: SSL 私钥文件路径
-#rpc-ssl-private-key=/path/to/your/private_key.pem
-
-# LOGGING SETTINGS
-# ============================================================================
-# log-level: 日志详细程度（调整为详细日志级别）
-log-level=1
-
-# log-file: 日志文件保存路径
-log-file=/var/log/mond/mond.log
-CONF
-    chown mond:mond /var/lib/mond/params.conf
-    chmod 640 /var/lib/mond/params.conf
+# 兼容旧版本：配置文件曾位于 /var/lib/mond/params.conf，迁移到 /etc/mond/params.conf
+if [ ! -f /etc/mond/params.conf ] && [ -f /var/lib/mond/params.conf ]; then
+    echo "Migrating existing config from /var/lib/mond to /etc/mond..."
+    cp /var/lib/mond/params.conf /etc/mond/params.conf
 fi
 
-# Set permissions on binary
-chown root:root /opt/mond/mond
+# 首次安装：从包内默认配置生成（源：conf/params.example.conf）。升级不覆盖已有配置
+if [ ! -f /etc/mond/params.conf ]; then
+    cp /opt/mond/params.conf /etc/mond/params.conf
+fi
+
+chown mond:mond /etc/mond/params.conf
+chmod 640 /etc/mond/params.conf
+
+# Set permissions：/opt 目录与二进制 755，数据文件 644（对齐 xxxig / xxxig-proxy）
+chown -R root:root /opt/mond
+find /opt/mond -type d -exec chmod 755 {} +
+find /opt/mond -type f -exec chmod 644 {} +
 chmod 755 /opt/mond/mond
 
-# Reload systemd and handle service restart on upgrade
+# Reload systemd
 if [ -d /run/systemd/system ]; then
     systemctl daemon-reload
 
-    # On upgrade: restart service if it was enabled
-    if [ "$1" = "configure" ] && [ -n "$2" ]; then
-        # $2 is the previously installed version (only set on upgrade)
-        if systemctl is-enabled --quiet mond.service 2>/dev/null; then
-            echo "Restarting mond service after upgrade..."
-            systemctl start mond.service || true
-        fi
-    fi
+    # 升级时重启正在运行的服务以加载新二进制；try-restart 不会启动未运行的服务，
+    # 故首次安装仍保持"不自动启动"语义
+    systemctl try-restart mond.service 2>/dev/null || true
+
     # Note: On fresh install, service is NOT auto-enabled or auto-started
-    # Users should manually enable the service:
     #   systemctl enable mond.service
     #   systemctl start mond.service
 fi
@@ -146,31 +61,14 @@ fi
 echo ""
 echo "✅ Mond installed successfully!"
 echo ""
-echo "📋 Configuration and startup:"
-echo ""
-echo "1. Review and configure settings (optional):"
-echo "   sudo nano /var/lib/mond/params.conf"
-echo ""
-echo "   Adjust network settings, peer connections, and other options as needed."
-echo ""
-echo "2. Start Mond:"
-echo "   sudo systemctl enable mond.service"
-echo "   sudo systemctl start mond.service"
-echo ""
-echo "3. Check status:"
-echo "   sudo systemctl status mond.service"
-echo "   sudo journalctl -u mond -f"
-echo ""
 echo "📁 Important paths:"
-echo "   Config file:    /var/lib/mond/params.conf"
+echo "   Config file:      /etc/mond/params.conf"
 echo "   Data directory:   /var/lib/mond/data"
 echo "   Log directory:    /var/log/mond"
-echo "   Binary:         /opt/mond/mond"
+echo "   Binaries:         /opt/mond/mond"
+echo "   Systemd services: mond.service"
 echo ""
-echo "💡 Tip: Your params.conf will NOT be overwritten during package upgrades."
-echo ""
-echo "For help:"
-echo "   /opt/mond/mond --help"
+echo "💡 Tip: Your config files will NOT be overwritten during package upgrades."
 echo ""
 
 exit 0

debian/postrm

@@ -12,9 +12,10 @@ case "$1" in
             delgroup --quiet mond || true
         fi
 
-        # Remove data directories (only on purge)
+        # Remove data/config directories (only on purge)
         rm -rf /var/log/mond
         rm -rf /var/lib/mond
+        rm -rf /etc/mond
         ;;
 
     remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)

debian/prerm

@@ -1,36 +1,18 @@
 #!/bin/sh
 set -e
 
-case "$1" in
-    upgrade)
-        # 升级时只停止服务，保留 enabled 状态
-        if [ -d /run/systemd/system ]; then
-            if systemctl is-active --quiet mond.service; then
-                echo "Stopping mond service for upgrade..."
-                systemctl stop mond.service
-            fi
-        fi
-        ;;
-    remove|deconfigure)
-        # 删除时停止并禁用服务
-        if [ -d /run/systemd/system ]; then
+# 仅在卸载(remove)时停用服务；升级(upgrade)时保持运行，
+# 由 postinst 的 try-restart 重启以加载新二进制
+if [ "$1" = "remove" ] && [ -d /run/systemd/system ]; then
     if systemctl is-active --quiet mond.service; then
         echo "Stopping mond service..."
         systemctl stop mond.service
     fi
+
     if systemctl is-enabled --quiet mond.service 2>/dev/null; then
         echo "Disabling mond service..."
         systemctl disable mond.service
     fi
 fi
-        ;;
-    failed-upgrade)
-        # 升级失败时不做操作
-        ;;
-    *)
-        echo "prerm called with unknown argument \`$1'" >&2
-        exit 1
-        ;;
-esac
 
 exit 0

docker/Dockerfile.ubuntu

@@ -5,43 +5,30 @@ ARG BUILDPLATFORM
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-# 安装构建依赖（包括 depends 系统所需工具）
+# 仅安装 Monero depends 系统所需的最小工具链：
+# depends 会自行交叉编译 boost/openssl/zmq/unbound/sodium 等全部第三方库到 contrib/depends/<target>/，
+# 故无需任何系统 -dev 库（装了反而可能被动态链接、破坏纯静态）。
 RUN apt-get update && apt-get install -y \
     git \
     wget \
     curl \
+    ca-certificates \
     build-essential \
     cmake \
     pkg-config \
     autoconf \
     automake \
     libtool \
+    gperf \
+    python3 \
     bzip2 \
     xz-utils \
-    python3 \
-    gperf \
-    libboost-all-dev \
-    libssl-dev \
-    libzmq3-dev \
-    libunbound-dev \
-    libsodium-dev \
-    libunwind8-dev \
-    liblzma-dev \
-    libreadline-dev \
-    libexpat1-dev \
-    libpgm-dev \
-    qttools5-dev-tools \
-    libhidapi-dev \
-    libusb-1.0-0-dev \
-    libprotobuf-dev \
-    protobuf-compiler \
-    libudev-dev \
-    libgtest-dev \
+    patch \
     && rm -rf /var/lib/apt/lists/*
 
 FROM base AS build
 
-ARG MONERO_VERSION=v0.18.4.6
+ARG MONERO_VERSION
 ARG TARGETARCH
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM