# fleet-agent config — EnvironmentFile for fleet-agent.service.
#
# FLEET-GENERIC ONLY (invariant #1): every value here is identical for every host
# of a release. Host identity is the TPM (signing key at the persistent handle +
# cert in NV) resolved at runtime — nothing per-host is baked. Override per
# environment by replacing this file (it is part of the immutable image, so a
# change means a rebuild + re-sign, like any other baked config).

# The fleet-manager agent plane (gRPC/mTLS). A DNS name, NOT a per-host value.
# Reached from the authenticated host VLAN via the OPNsense L3 hop to the mgmt
# plane (not the boot nginx). Set to your manager's real name:port.
FLEET_AGENT_MANAGER=diskless-server.bitasylum.org:9600

# Fleet CA that verifies the manager's server cert. This is the SAME step-ca root
# that signs the host TPM certs + the RADIUS server cert, so we reuse the in-place
# copy rather than duplicating it. Replace per environment with your real root
# (the shipped files/etc/dot1x/radius-ca.pem is a placeholder — auth/telemetry
# cannot succeed until it is the real fleet root).
FLEET_AGENT_CA=/etc/dot1x/radius-ca.pem

# TPM identity (overridable, mirrors rd.dot1x.handle / rd.dot1x.nvindex). These
# MUST match what enrolment used: signing key at a non-reserved owner handle, cert
# in an owner NV index.
FLEET_AGENT_HANDLE=0x81000100
FLEET_AGENT_NVINDEX=0x01800100

# Health snapshot cadence and the loopback hostapi facts source.
FLEET_AGENT_INTERVAL=30s
FLEET_AGENT_HOSTAPI=http://127.0.0.1:9099/v1/host