Add app

serving/.env.example

@@ -28,12 +28,21 @@ DHCP_RANGE_START=192.168.50.100
 DHCP_RANGE_END=192.168.50.200
 DHCP_LEASE=12h
 
+# --- Kiosk SPA -------------------------------------------------------------
+# Loopback port the kiosk-app container publishes; the host-network main nginx
+# reverse-proxies /kiosk/ to http://127.0.0.1:${KIOSK_APP_PORT}. Change only if
+# 8088 clashes on the serving host (also update http/default.conf proxy_pass).
+KIOSK_APP_PORT=8088
+
 # --- DNS names -------------------------------------------------------------
 BOOT_DOMAIN=fleet.lab
 BOOT_HOST=boot.fleet.lab   # HTTP boot server name (UKI)
 # NVMe/TCP discovery name. Put THIS value in the UKI cmdline as NVMET_TRADDR
 # (extract-artifacts.sh) so rd.nvmf.discover resolves here per environment.
 NVME_HOST=nvme.fleet.lab
+# Remote audit collector name. Host-generic — bake into the image's rsyslog
+# forward rule so every host offloads auditd here; resolved to this serving host.
+AUDIT_HOST=audit.fleet.lab
 
 # --- NVMe/TCP target -------------------------------------------------------
 SUBNQN=nqn.2026-06.org.example.fleet:rootfs