sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

agent: dial the manager by a fleet DNS name (manager.fleet.lab)

Browse Source 
The agent's baked default pointed at the PUBLIC admin-UI name
(diskless-server.bitasylum.org), which resolves to the serving host's outbound IP
— unreachable from the fleet LAN. There's no split-horizon to "automate": the
manager agent plane is just another *.fleet.lab, served by the fleet dnsmasq like
boot/nvme/audit.

- serving/.env.example: MGMT_HOST=manager.fleet.lab.
- serving/docker-compose.yml: dnsmasq --address=/${MGMT_HOST}/${SERVER_IP}.
- files/agent/agent.env + main.go default: FLEET_AGENT_MANAGER=manager.fleet.lab:9600.
- server-pki.sh: AGENT_SANS default -> manager.fleet.lab (cert SAN matches the
  baked name, so no FLEET_AGENT_SERVER_NAME override).
- docs/TODO #14 gotcha #4 updated: fleet name, not the IP+server-name workaround.

The public diskless-server.bitasylum.org stays the ADMIN-UI name (Traefik/:443).
This commit is contained in:
Audiobuzz
2026-07-10 06:13:46 +00:00
parent 0068a15917
commit 1b8cf2f344
6 changed files with 31 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/.env.example
+7
View File
@@ -72,6 +72,13 @@ NVME_HOST=nvme.fleet.lab
# Remote audit collector name. Host-generic — bake into the image's rsyslog
# forward rule so every host offloads auditd here; resolved to this serving host.
AUDIT_HOST=audit.fleet.lab
# Fleet-manager AGENT plane name. Baked into the image (files/agent/agent.env
# FLEET_AGENT_MANAGER) so every enrolled host dials the control plane here;
# resolved per-environment to the manager's fleet-LAN address (this serving host
# now; a routable mgmt address once the manager moves to k8s). Just another
# *.fleet.lab like the boot/nvme/audit names. Must match the agent server cert SAN
# (server-pki.sh AGENT_SANS).
MGMT_HOST=manager.fleet.lab
# --- NVMe/TCP target -------------------------------------------------------
# Per-version subsystem NQN base. The long-lived target serves each rootfs
serving/docker-compose.yml
+3
View File
@@ -104,6 +104,9 @@ services:
# Host-generic remote audit collector name (baked into the image config so
# every host offloads auditd here; resolved per-environment to this host).
- --address=/${AUDIT_HOST}/${SERVER_IP}
# Fleet-manager AGENT plane (:9600) — baked into the image so enrolled hosts
# dial the control plane by name; resolved here like the other fleet names.
- --address=/${MGMT_HOST}/${SERVER_IP}
# Kiosk is LOCAL-ONLY (loads boot.fleet.lab), so sinkhole Chromium's
# call-home to 0.0.0.0 — telemetry can't leave the lab even if the browser
# tries. Defense-in-depth behind the in-image Chromium policy/flags; in
serving/fleet-manager/server-pki.sh
+2 -2
View File
@@ -17,7 +17,7 @@
# Usage: server-pki.sh
# env overrides:
# OUT=./pki/agent output dir
# AGENT_SANS=diskless-server.bitasylum.org,10.0.0.1 SANs hosts dial (DNS/IP, comma-sep)
# AGENT_SANS=manager.fleet.lab,10.0.0.1 SANs hosts dial (DNS/IP, comma-sep)
# FLEET_CA_URL=https://ca.fleet.lab:8443
# FLEET_CA_ROOT=../dot1x-bench/pki/root_ca.crt
# STEP_PROVISIONER=enrol
@@ -26,7 +26,7 @@
set -euo pipefail
OUT=${OUT:-./pki/agent}
AGENT_SANS=${AGENT_SANS:-diskless-server.bitasylum.org}
AGENT_SANS=${AGENT_SANS:-manager.fleet.lab}
FLEET_CA_URL=${FLEET_CA_URL:-https://ca.fleet.lab:8443}
FLEET_CA_ROOT=${FLEET_CA_ROOT:-../dot1x-bench/pki/root_ca.crt}
FLEET_CA_INTERMEDIATE=${FLEET_CA_INTERMEDIATE:-../dot1x-bench/pki/intermediate_ca.crt}