# fleet-agent config — EnvironmentFile for fleet-agent.service.
#
# FLEET-GENERIC ONLY (invariant #1): every value here is identical for every host
# of a release. Host identity is the TPM (signing key at the persistent handle +
# cert in NV) resolved at runtime — nothing per-host is baked. Override per
# environment by replacing this file (it is part of the immutable image, so a
# change means a rebuild + re-sign, like any other baked config).

# The fleet-manager agent plane (gRPC/mTLS). A fleet DNS name (NOT per-host),
# resolved by the serving dnsmasq like boot/nvme/audit — MGMT_HOST in serving/.env
# points it at the manager's fleet-LAN address (this serving host now; a routable
# mgmt address once the manager moves behind OPNsense L3 / k8s). Must match the
# agent server cert SAN (server-pki.sh AGENT_SANS). This is the AGENT plane, NOT
# the public admin-UI name (that's Traefik/Let's Encrypt on :443).
FLEET_AGENT_MANAGER=manager.fleet.lab:9600

# Fleet CA that verifies the manager's server cert. This is the SAME step-ca root
# that signs the host TPM certs + the RADIUS server cert, so we reuse the in-place
# copy rather than duplicating it. Replace per environment with your real root
# (the shipped files/etc/dot1x/radius-ca.pem is a placeholder — auth/telemetry
# cannot succeed until it is the real fleet root).
FLEET_AGENT_CA=/etc/dot1x/radius-ca.pem

# TPM identity (overridable, mirrors rd.dot1x.handle / rd.dot1x.nvindex). These
# MUST match what enrolment used: signing key at a non-reserved owner handle, cert
# in an owner NV index.
FLEET_AGENT_HANDLE=0x81000100
FLEET_AGENT_NVINDEX=0x01800100

# Health snapshot cadence and the loopback hostapi facts source.
FLEET_AGENT_INTERVAL=30s
FLEET_AGENT_HOSTAPI=http://127.0.0.1:9099/v1/host