sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fleet-manager: finish self-TLS cleanup (compose, env, docs, delete acme/)

Browse Source 
Follow the code removal through the rest of the tree now that Traefik owns UI TLS:
- compose: drop FLEET_MGR_ADMIN_BEHIND_PROXY + ADMIN_CERT/_KEY from the manager
  env; correct the ./pki mount comment (agent + broker certs only).
- .env.example: drop the BEHIND_PROXY + cert vars + self-TLS note.
- DEPLOY.md / README: remove the self-TLS "alternative" and the BEHIND_PROXY /
  ADMIN_CERT config rows.
- server-pki.sh: point the admin UI cert at Traefik, not ./pki/admin.
- delete serving/fleet-manager/acme/ (the retired ACME side-car).
This commit is contained in:
Audiobuzz
2026-07-05 01:46:52 +00:00
parent 76c3a6aaa7
commit e6b1f0308e
6 changed files with 16 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/fleet-manager/README.md
+4 -8
View File
@@ -41,11 +41,9 @@ that's service-to-service — see [Authorise](#authorise-pillar).)
a publicly-trusted **Let's Encrypt** cert (**Route 53 DNS-01** — the UI is on the
mgmt network, not internet-reachable, so HTTP-01/TLS-ALPN-01 can't validate) on
:443 and forwards plaintext to the manager, which runs
`FLEET_MGR_ADMIN_BEHIND_PROXY=true` (passkey auth ON, plaintext on loopback —
WebAuthn only needs the origin to match, not the app's own transport). Traefik
is the k8s ingress-controller + cert-manager role in miniature. *(Self-TLS mode
without Traefik is still available: `BEHIND_PROXY=false` + a cert at
`FLEET_MGR_ADMIN_CERT/_KEY`, e.g. from `acme/renew-loop.sh`.)*
passkey auth ON, plaintext on loopback (WebAuthn only needs the origin to match,
not the app's own transport). The manager never terminates TLS itself. Traefik
is the k8s ingress-controller + cert-manager role in miniature.
## Monitoring path (no host ever touches InfluxDB)
@@ -116,9 +114,7 @@ inventory for offline delivery. Metrics writing is behind a `MetricsSink`
| Var | Default | Notes |
|---|---|---|
| `FLEET_MGR_ADMIN_ADDR` | `127.0.0.1:9500` | admin listener (loopback — Traefik forwards here) |
| `FLEET_MGR_ADMIN_BEHIND_PROXY` | `false` | passkey ON, plaintext listener (Traefik/ingress terminates TLS). Compose defaults it `true` |
| `FLEET_MGR_ADMIN_CERT` / `_KEY` | — | UI server cert/key — **self-TLS mode only** (`BEHIND_PROXY=false`, no Traefik) |
| `FLEET_MGR_ADMIN_ADDR` | `127.0.0.1:9500` | admin listener (loopback — Traefik forwards here; always plaintext) |
| `FLEET_MGR_RP_ID` | — | WebAuthn RP ID = UI hostname (`diskless-server.bitasylum.org`) |
| `FLEET_MGR_RP_ORIGIN` | — | WebAuthn origin (`https://diskless-server.bitasylum.org`) |
| `FLEET_MGR_RP_NAME` | `Fleet Command` | RP display name |