Audiobuzz
9479b70b04
Auto-issue + auto-renew the admin-UI TLS cert with a long-running compose side-car instead of a host cron. The `acme` service (goacme/lego image, running acme/renew-loop.sh) obtains the cert over DNS-01 via the AWS Route 53 API, writes fullchain/privkey into ./pki/admin/ — the SAME dir the manager reads (./pki:/pki:ro) — and chowns them to the nonroot runtime uid so the read-only container can load the key. The manager's certReloader hot-swaps on the mtime bump, no restart. Loop renews within 30 days of expiry; ACME_STAGING=1 gives a dry-run vs LE staging. - docker-compose.yml: `acme` service + `acme-state` volume (lego account/cert store). ACME_DOMAIN reuses FLEET_MGR_RP_ID so cert host == passkey origin. - .env.example: ACME_EMAIL + AWS creds (or instance role) + ACME_STAGING. - DEPLOY.md §2c: rewritten to the side-car flow — scoped Route 53 IAM policy, bring-acme-up-first ordering, flip off insecure, and an origin-match note. (The docker-compose.yml commit also carries the local harbor.bitasylum.org influxdb image mirror edit.)
58 lines
2.9 KiB
Bash
58 lines
2.9 KiB
Bash
# Copy to .env and edit. See DEPLOY.md for the full bring-up.
|
|
# .env is gitignored — it holds the Influx token and DB password.
|
|
|
|
# --- WebAuthn RP (admin passkeys are ORIGIN-BOUND — must be the UI's real URL) --
|
|
# For this deployment the UI is https://diskless-server.bitasylum.org .
|
|
FLEET_MGR_RP_ID=diskless-server.bitasylum.org
|
|
FLEET_MGR_RP_ORIGIN=https://diskless-server.bitasylum.org
|
|
FLEET_MGR_RP_NAME=Fleet Command
|
|
|
|
# --- admin plane HTTPS ---------------------------------------------------------
|
|
# The UI cert is a publicly-trusted Let's Encrypt cert via DNS-01 (the UI is on
|
|
# the mgmt net, not internet-reachable, so HTTP-01/TLS-ALPN-01 can't validate;
|
|
# DNS-01 proves control of bitasylum.org via a TXT record). An external ACME
|
|
# client (lego/certbot + your DNS provider) writes fullchain/privkey into
|
|
# ./pki/admin/ ; the manager hot-reloads on renewal. See DEPLOY.md.
|
|
FLEET_MGR_ADMIN_ADDR=127.0.0.1:9500
|
|
FLEET_MGR_ADMIN_CERT=/pki/admin/fullchain.pem
|
|
FLEET_MGR_ADMIN_KEY=/pki/admin/privkey.pem
|
|
# Dev-only escape hatch: plaintext, NO passkey auth. NEVER set true in prod.
|
|
FLEET_MGR_ADMIN_INSECURE=false
|
|
|
|
# --- admin UI cert: Let's Encrypt DNS-01 via Route 53 (the `acme` side-car) -----
|
|
# The side-car issues + auto-renews the UI cert into ./pki/admin/ ; the manager
|
|
# hot-reloads it. ACME_DOMAIN is taken from FLEET_MGR_RP_ID above. Give it AWS
|
|
# creds scoped to the bitasylum.org hosted zone (IAM policy in DEPLOY.md §2c), or
|
|
# omit them and attach an instance role.
|
|
ACME_EMAIL=you@bitasylum.org
|
|
AWS_ACCESS_KEY_ID=
|
|
AWS_SECRET_ACCESS_KEY=
|
|
AWS_REGION=us-east-1
|
|
# ACME_STAGING=1 # uncomment for a dry-run vs LE staging (UNTRUSTED certs, no rate limit)
|
|
|
|
# --- agent plane (gRPC + mTLS, fleet CA) ---------------------------------------
|
|
# Routable mgmt address enrolled hosts dial (":9600" = all interfaces). The
|
|
# server cert is issued by the fleet CA (server-pki.sh); the client CA is the
|
|
# fleet root so host TPM certs verify. Paths are fixed in docker-compose.yml.
|
|
FLEET_MGR_AGENT_ADDR=:9600
|
|
|
|
# --- authorise pillar (enrol-broker admin plane over mTLS) ---------------------
|
|
# The broker runs network_mode:host on 127.0.0.1:9443. The manager's client cert
|
|
# is minted by ../enrol-broker/admin-pki.sh (admin CA), into ./pki/broker/ .
|
|
FLEET_MGR_BROKER_URL=https://127.0.0.1:9443
|
|
|
|
# --- InfluxDB (private; the manager is the ONLY reader/writer) -----------------
|
|
# The token is handed to BOTH influxdb (init admin token) and the manager, so a
|
|
# single value wires the two with no copy step. Treat as a secret.
|
|
FLEET_MGR_INFLUX_TOKEN=changeme-generate-a-long-random-token
|
|
FLEET_MGR_INFLUX_ORG=fleet
|
|
FLEET_MGR_INFLUX_BUCKET=fleet_health
|
|
INFLUX_ADMIN_USER=fleet-admin
|
|
INFLUX_ADMIN_PASSWORD=changeme-influx-admin-password
|
|
INFLUX_RETENTION=90d
|
|
|
|
# --- misc ----------------------------------------------------------------------
|
|
FLEET_MGR_SESSION_TTL_MIN=720
|
|
# Must match the enrol-broker's HOSTNQN_BASE.
|
|
HOSTNQN_BASE=nqn.2026-06.org.example.fleet:host-
|