87 lines
4.2 KiB
Bash
87 lines
4.2 KiB
Bash
# Copy to .env and edit for your test LAN/bridge, then: docker compose up -d
|
|
|
|
# Release being served. Must match the Packer build (fleet-<version>.efi).
|
|
IMAGE_VERSION=0.0.0-2eefd97
|
|
|
|
# OCI release-artifact image (built by scripts/build-oci.sh). Mounted directly
|
|
# as a Docker image volume — the default artifact source. Pin by digest in
|
|
# production, e.g. OCI_IMAGE=git.bitasylum.org/audiobuzz/fleet-boot@sha256:…
|
|
OCI_IMAGE=git.bitasylum.org/audiobuzz/fleet-boot
|
|
|
|
# Fallback only (Docker < 28 / offline): local Packer output dir, used by the
|
|
# commented bind-mounts in docker-compose.yml. Ignored when image volumes work.
|
|
ARTIFACT_SRC=../artifacts/0.0.0-2eefd97
|
|
|
|
# SPDK NVMe/TCP target image — prebuilt + pushed by CI
|
|
# (.gitea/workflows/spdk-image.yaml); the serving host just pulls it.
|
|
SPDK_IMAGE=git.bitasylum.org/audiobuzz/spdk-nvmf
|
|
SPDK_VERSION=v24.09
|
|
|
|
# dnsmasq image — prebuilt + pushed by CI (.gitea/workflows/dnsmasq-image.yaml);
|
|
# GENERIC (no Secure Boot keys / no iPXE binary). Pulled, not built at deploy.
|
|
DNSMASQ_IMAGE=git.bitasylum.org/audiobuzz/fleet-dnsmasq
|
|
DNSMASQ_VERSION=latest
|
|
|
|
# fleet-ipxe image — the SIGNED iPXE bootloader (snponly.efi) for PXE-only hosts,
|
|
# built + signed (fleet db key) + pushed by CI (.gitea/workflows/ipxe-image.yaml).
|
|
# Mounted into dnsmasq at /ipxe. Per-environment (signature is db-key-specific);
|
|
# pin by digest in production, e.g. fleet-ipxe@sha256:…
|
|
IPXE_IMAGE=git.bitasylum.org/audiobuzz/fleet-ipxe
|
|
IPXE_VERSION=latest
|
|
|
|
# kiosk SPA image — the spaceship-terminal web app, now an INDEPENDENT project
|
|
# (the kiosk-app git submodule) with its own CI that builds + pushes this image.
|
|
# The 'kiosk' compose service pulls it; the main nginx reverse-proxies /kiosk/ to
|
|
# it. For local dev, uncomment `build: ./kiosk-app` on that service instead.
|
|
KIOSK_IMAGE=git.bitasylum.org/audiobuzz/fleet-kiosk
|
|
KIOSK_VERSION=latest
|
|
|
|
# --- This serving host on the boot LAN -------------------------------------
|
|
BOOT_IFACE=ens19 # interface facing the booting client / test bridge
|
|
SERVER_IP=192.168.50.10 # this host's address on BOOT_IFACE (DHCP/DNS/HTTP/NVMe)
|
|
GATEWAY_IP=192.168.50.1
|
|
UPSTREAM_DNS=10.42.42.254
|
|
|
|
# --- DHCP scope ------------------------------------------------------------
|
|
DHCP_RANGE_START=192.168.50.100
|
|
DHCP_RANGE_END=192.168.50.200
|
|
DHCP_LEASE=12h
|
|
|
|
# --- Kiosk SPA -------------------------------------------------------------
|
|
# Loopback port the kiosk-app container publishes; the host-network main nginx
|
|
# reverse-proxies /kiosk/ to http://127.0.0.1:${KIOSK_APP_PORT}. Change only if
|
|
# 8088 clashes on the serving host (also update http/default.conf proxy_pass).
|
|
KIOSK_APP_PORT=8088
|
|
|
|
# Local testing secrets for the kiosk BFF. This file is GITIGNORED — safe to
|
|
# paste a real token here. Template/docs: .env.example.
|
|
|
|
HASS_URL=http://cortana.bitasylum.org:8123
|
|
|
|
# 👇 paste your Home Assistant long-lived access token here, then restart the BFF
|
|
# (npm run bff). Test it with: curl -s localhost:8787/api/health | jq
|
|
HASS_TOKEN=<insert-token>
|
|
|
|
|
|
# --- DNS names -------------------------------------------------------------
|
|
BOOT_DOMAIN=fleet.lab
|
|
BOOT_HOST=boot.fleet.lab # HTTP boot server name (UKI)
|
|
# NVMe/TCP discovery name. Put THIS value in the UKI cmdline as NVMET_TRADDR
|
|
# (extract-artifacts.sh) so rd.nvmf.discover resolves here per environment.
|
|
NVME_HOST=nvme.fleet.lab
|
|
# Remote audit collector name. Host-generic — bake into the image's rsyslog
|
|
# forward rule so every host offloads auditd here; resolved to this serving host.
|
|
AUDIT_HOST=audit.fleet.lab
|
|
|
|
# --- NVMe/TCP target -------------------------------------------------------
|
|
# Per-version subsystem NQN base. The long-lived target serves each rootfs
|
|
# version as its OWN subsystem "<base>-<version>" (so a new build is added live
|
|
# without disturbing connected hosts). Per release the exact NQN is read from
|
|
# that version's verity.json (.subnqn, written by extract-artifacts.sh); this is
|
|
# only the fallback/default base and MUST match SUBNQN_BASE in that script.
|
|
SUBNQN_BASE=nqn.2026-06.org.example.fleet:rootfs
|
|
# Legacy single-version NQN (only the deprecated serving/spdk-setup.sh path).
|
|
SUBNQN=nqn.2026-06.org.example.fleet:rootfs
|
|
TARGET_PORT=4420
|
|
SPDK_CPUMASK=0x1 # one polling core is plenty for a read-only boot fs
|