sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fleet-manager: finish self-TLS cleanup (compose, env, docs, delete acme/)

Browse Source 
Follow the code removal through the rest of the tree now that Traefik owns UI TLS:
- compose: drop FLEET_MGR_ADMIN_BEHIND_PROXY + ADMIN_CERT/_KEY from the manager
  env; correct the ./pki mount comment (agent + broker certs only).
- .env.example: drop the BEHIND_PROXY + cert vars + self-TLS note.
- DEPLOY.md / README: remove the self-TLS "alternative" and the BEHIND_PROXY /
  ADMIN_CERT config rows.
- server-pki.sh: point the admin UI cert at Traefik, not ./pki/admin.
- delete serving/fleet-manager/acme/ (the retired ACME side-car).
This commit is contained in:
Audiobuzz
2026-07-05 01:46:52 +00:00
parent 76c3a6aaa7
commit e6b1f0308e
6 changed files with 16 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/fleet-manager/.env.example
+2 -5
View File
@@ -9,14 +9,11 @@ FLEET_MGR_RP_NAME=Fleet Command
# --- admin plane (behind the Traefik ingress) ----------------------------------
# Traefik terminates the LE cert on :443 and forwards plaintext here; the manager
# keeps passkey auth ON but serves plaintext on loopback (only Traefik reaches it).
# serves passkey auth over plaintext on loopback (only Traefik reaches it). The
# manager never terminates TLS itself.
FLEET_MGR_ADMIN_ADDR=127.0.0.1:9500
FLEET_MGR_ADMIN_BEHIND_PROXY=true
# Dev-only escape hatch: plaintext, NO passkey auth. NEVER set true in prod.
FLEET_MGR_ADMIN_INSECURE=false
# Only for self-TLS mode (BEHIND_PROXY=false + a cert, no Traefik — see DEPLOY.md):
FLEET_MGR_ADMIN_CERT=/pki/admin/fullchain.pem
FLEET_MGR_ADMIN_KEY=/pki/admin/privkey.pem
# --- Traefik ACME (Let's Encrypt DNS-01 via Route 53) --------------------------
# Traefik issues + auto-renews the :443 cert. Set the UI hostname in