fleet-manager: layer config as defaults.env (committed) + .env (overrides)

Rename .env.example -> defaults.env and make it the committed defaults layer. Compose reads defaults.env then .env (later wins) via COMPOSE_ENV_FILES, feeding BOTH container env and ${...} interpolation — so a changed default here reaches every run without re-copying, and .env shrinks to just overrides + secrets. No compose service restructure: the existing interpolated environment: blocks already build the container env; the layering just supplies their values from two files. (env_file: directive alone wouldn't work — it doesn't feed the image-tag / cross-service Influx / ACME_EMAIL interpolation this compose relies on.) Docs (DEPLOY §1, compose header, README) updated: export COMPOSE_ENV_FILES=defaults.env,.env, keep only secrets/overrides in .env.
2026-07-05 02:08:25 +00:00
parent 688ff1aa88
commit 45d7101472
4 changed files with 43 additions and 15 deletions
@@ -0,0 +1,70 @@
+# defaults.env — the COMMITTED default configuration for the fleet-manager stack.
+#
+# Compose LAYERS this file, then .env (overrides), for both container env AND
+# ${...} interpolation. Enable the layering once per shell (later file wins):
+#
+#   export COMPOSE_ENV_FILES=defaults.env,.env
+#   # or per command:  docker compose --env-file defaults.env --env-file .env <cmd>
+#
+# Then put ONLY overrides + real secrets in .env (gitignored). Changing a default
+# here reaches every run without anyone re-copying it. The secret values below are
+# PLACEHOLDERS — override them in .env. (.env must exist when COMPOSE_ENV_FILES
+# lists it; create it with at least your secrets.)
+
+# --- WebAuthn RP (admin passkeys are ORIGIN-BOUND — must be the UI's real URL) --
+# The UI is fronted by Traefik on :443, so the origin is PORT-LESS.
+FLEET_MGR_RP_ID=diskless-server.bitasylum.org
+FLEET_MGR_RP_ORIGIN=https://diskless-server.bitasylum.org
+FLEET_MGR_RP_NAME=Fleet Command
+
+# --- admin plane (behind the Traefik ingress) ----------------------------------
+# Traefik terminates the LE cert on :443 and forwards plaintext here; the manager
+# serves passkey auth over plaintext on loopback (only Traefik reaches it). The
+# manager never terminates TLS itself.
+FLEET_MGR_ADMIN_ADDR=127.0.0.1:9500
+# Dev-only escape hatch: plaintext, NO passkey auth. NEVER set true in prod.
+FLEET_MGR_ADMIN_INSECURE=false
+
+# --- Traefik ACME (Let's Encrypt DNS-01 via Route 53) --------------------------
+# Traefik issues + auto-renews the :443 cert. Set the UI hostname in
+# traefik/dynamic/fleet-manager.yml (== FLEET_MGR_RP_ID). Give it AWS creds scoped
+# to the bitasylum.org hosted zone (IAM policy in DEPLOY.md §2c), or attach an
+# instance role and leave them blank.
+ACME_EMAIL=you@bitasylum.org
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_REGION=us-east-1
+# Optional but recommended: pin the Route 53 zone (skip ListHostedZonesByName;
+# disambiguate public/private zones). Traefik reads it from the env.
+AWS_HOSTED_ZONE_ID=
+# First dry-run vs LE staging: add the caserver flag to the traefik command (see
+# docker-compose.yml) rather than an env var.
+
+# --- agent plane (gRPC + mTLS, fleet CA) ---------------------------------------
+# Routable mgmt address enrolled hosts dial (":9600" = all interfaces). The
+# server cert is issued by the fleet CA (server-pki.sh); the client CA is the
+# fleet root so host TPM certs verify. Paths are fixed in docker-compose.yml.
+FLEET_MGR_AGENT_ADDR=:9600
+
+# --- authorise pillar (enrol-broker admin plane over mTLS) ---------------------
+# The broker runs network_mode:host on 127.0.0.1:9443. The manager's client cert
+# is minted by ../enrol-broker/admin-pki.sh (admin CA), into ./pki/broker/ .
+FLEET_MGR_BROKER_URL=https://127.0.0.1:9443
+
+# --- InfluxDB (private; the manager is the ONLY reader/writer) -----------------
+# The token is handed to BOTH influxdb (init admin token) and the manager, so a
+# single value wires the two with no copy step. Treat as a secret.
+FLEET_MGR_INFLUX_TOKEN=changeme-generate-a-long-random-token
+FLEET_MGR_INFLUX_ORG=fleet
+FLEET_MGR_INFLUX_BUCKET=fleet_health
+INFLUX_ADMIN_USER=fleet-admin
+INFLUX_ADMIN_PASSWORD=changeme-influx-admin-password
+INFLUX_RETENTION=90d
+
+# --- misc ----------------------------------------------------------------------
+# CI image tag to run (from .gitea/workflows/fleet-manager-image.yaml): a release
+# semver, main-<sha7>, or a <branch>-<sha7> dev build. Defaults to :latest.
+FLEET_MANAGER_VERSION=latest
+FLEET_MGR_SESSION_TTL_MIN=720
+# Must match the enrol-broker's HOSTNQN_BASE.
+HOSTNQN_BASE=nqn.2026-06.org.example.fleet:host-