sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fleet-manager: layer config as defaults.env (committed) + .env (overrides)

Browse Source 
Rename .env.example -> defaults.env and make it the committed defaults layer.
Compose reads defaults.env then .env (later wins) via COMPOSE_ENV_FILES, feeding
BOTH container env and ${...} interpolation — so a changed default here reaches
every run without re-copying, and .env shrinks to just overrides + secrets.

No compose service restructure: the existing interpolated environment: blocks
already build the container env; the layering just supplies their values from two
files. (env_file: directive alone wouldn't work — it doesn't feed the image-tag /
cross-service Influx / ACME_EMAIL interpolation this compose relies on.)

Docs (DEPLOY §1, compose header, README) updated: export
COMPOSE_ENV_FILES=defaults.env,.env, keep only secrets/overrides in .env.
This commit is contained in:
Audiobuzz
2026-07-05 02:08:25 +00:00
parent 688ff1aa88
commit 45d7101472
4 changed files with 43 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/fleet-manager/DEPLOY.md
+19 -7
View File
@@ -25,17 +25,29 @@ the architecture.
## 1. Configure
Config is **layered**: `defaults.env` (committed defaults) + `.env` (your
overrides + secrets, gitignored). Compose reads both — later wins — via
`COMPOSE_ENV_FILES`, so a changed default in `defaults.env` reaches you without
re-copying anything; `.env` stays small.
```bash
cd serving/fleet-manager
cp .env.example .env
# Edit .env:
# FLEET_MGR_RP_ID / _ORIGIN -> your UI hostname (diskless-server.bitasylum.org)
# FLEET_MGR_INFLUX_TOKEN -> a long random secret (openssl rand -hex 32)
# INFLUX_ADMIN_PASSWORD -> a strong password
export COMPOSE_ENV_FILES=defaults.env,.env # once per shell (or a Makefile/.envrc)
# .env holds ONLY overrides + secrets — at minimum:
cat > .env <<EOF
FLEET_MGR_INFLUX_TOKEN=$(openssl rand -hex 32)
INFLUX_ADMIN_PASSWORD=$(openssl rand -hex 24)
ACME_EMAIL=you@bitasylum.org
AWS_ACCESS_KEY_ID=...
AWS_SECRET_ACCESS_KEY=...
# override any other default from defaults.env here, e.g. FLEET_MGR_RP_ID=...
EOF
```
The Influx token is handed to **both** InfluxDB (its init admin token) and the
manager, so one value wires them with no copy step. `.env` is gitignored.
`COMPOSE_ENV_FILES` requires every listed file to exist, so create `.env` before
running compose. Per-command alternative: `docker compose --env-file defaults.env
--env-file .env …`. The Influx token is handed to **both** InfluxDB (its init
admin token) and the manager, so one value wires them.
## 2. PKI