Audiobuzz
1b8cf2f344
The agent's baked default pointed at the PUBLIC admin-UI name
(diskless-server.bitasylum.org), which resolves to the serving host's outbound IP
— unreachable from the fleet LAN. There's no split-horizon to "automate": the
manager agent plane is just another *.fleet.lab, served by the fleet dnsmasq like
boot/nvme/audit.
- serving/.env.example: MGMT_HOST=manager.fleet.lab.
- serving/docker-compose.yml: dnsmasq --address=/${MGMT_HOST}/${SERVER_IP}.
- files/agent/agent.env + main.go default: FLEET_AGENT_MANAGER=manager.fleet.lab:9600.
- server-pki.sh: AGENT_SANS default -> manager.fleet.lab (cert SAN matches the
baked name, so no FLEET_AGENT_SERVER_NAME override).
- docs/TODO #14 gotcha #4 updated: fleet name, not the IP+server-name workaround.
The public diskless-server.bitasylum.org stays the ADMIN-UI name (Traefik/:443).
33 lines
1.7 KiB
Bash
33 lines
1.7 KiB
Bash
# fleet-agent config — EnvironmentFile for fleet-agent.service.
|
|
#
|
|
# FLEET-GENERIC ONLY (invariant #1): every value here is identical for every host
|
|
# of a release. Host identity is the TPM (signing key at the persistent handle +
|
|
# cert in NV) resolved at runtime — nothing per-host is baked. Override per
|
|
# environment by replacing this file (it is part of the immutable image, so a
|
|
# change means a rebuild + re-sign, like any other baked config).
|
|
|
|
# The fleet-manager agent plane (gRPC/mTLS). A fleet DNS name (NOT per-host),
|
|
# resolved by the serving dnsmasq like boot/nvme/audit — MGMT_HOST in serving/.env
|
|
# points it at the manager's fleet-LAN address (this serving host now; a routable
|
|
# mgmt address once the manager moves behind OPNsense L3 / k8s). Must match the
|
|
# agent server cert SAN (server-pki.sh AGENT_SANS). This is the AGENT plane, NOT
|
|
# the public admin-UI name (that's Traefik/Let's Encrypt on :443).
|
|
FLEET_AGENT_MANAGER=manager.fleet.lab:9600
|
|
|
|
# Fleet CA that verifies the manager's server cert. This is the SAME step-ca root
|
|
# that signs the host TPM certs + the RADIUS server cert, so we reuse the in-place
|
|
# copy rather than duplicating it. Replace per environment with your real root
|
|
# (the shipped files/etc/dot1x/radius-ca.pem is a placeholder — auth/telemetry
|
|
# cannot succeed until it is the real fleet root).
|
|
FLEET_AGENT_CA=/etc/dot1x/radius-ca.pem
|
|
|
|
# TPM identity (overridable, mirrors rd.dot1x.handle / rd.dot1x.nvindex). These
|
|
# MUST match what enrolment used: signing key at a non-reserved owner handle, cert
|
|
# in an owner NV index.
|
|
FLEET_AGENT_HANDLE=0x81000100
|
|
FLEET_AGENT_NVINDEX=0x01800100
|
|
|
|
# Health snapshot cadence and the loopback hostapi facts source.
|
|
FLEET_AGENT_INTERVAL=30s
|
|
FLEET_AGENT_HOSTAPI=http://127.0.0.1:9099/v1/host
|