scripts/deploy.env.example

Ref: Size: 6.2 KiB History
# eitri deploy config — sourced by scripts/deploy.sh (`make deploy`).
#
# Copy this to the location scripts/deploy.sh reads (default
# ~/eitri-deploy/deploy.env, override with $EITRI_DEPLOY_ENV) and fill in your
# fleet's values. This file is site-specific and may reference secrets — keep it
# OUT of the repo (deploy.env is gitignored).

# ── Control plane (local eitri-server) ────────────────────────────────────────
SERVER_BIN="$HOME/eitri-deploy/bin/eitri-server"   # where the running binary lives
SERVER_CONFIG="$HOME/eitri-deploy/server.json"     # --config passed to it
SERVER_LOG="$HOME/eitri-deploy/logs/server.log"    # relaunch appends here
SERVER_URL="http://127.0.0.1:8080"                 # http_listen, for health checks + console callback base

# ── Console sign-in / boot-gate credentials ───────────────────────────────────
# The admin token is gone: the server authenticates the console via OIDC, and
# the boot-gate signs in as the deploy machine identity in the bundled eitri-oidc
# issuer (installed + configured by deploy.sh on this box) to mint a short-lived
# PAT that proves the sign-in chain. The `default` tenant is human-owned (the
# operator claimed it on first sign-in), so the VM-lifecycle half of the gate
# runs on an operator-minted PAT read from CI_PAT_FILE instead. Defaults shown;
# the password file is generated on first deploy, and CI_PAT_FILE is an optional
# override for where you saved the console "deploy" PAT.
# CI_USER="deploy@eitri.local"
# CI_PASSWORD_FILE="$HOME/eitri-deploy/oidc/deploy-password"
# CI_PAT_FILE="$HOME/eitri-deploy/oidc/deploy-pat"

# ── Hosts (remote eitri-agent) ────────────────────────────────────────────────
# Space-separated list of ssh targets, each "user@host[:port]" (port defaults 22).
# The branch gate's fleet is nested VMs on this workstation: run
# `scripts/devhost.sh create` and paste the AGENT_HOSTS line it prints. Real
# hardware gates pre-release tags on stg instead (deploy/server/README.md), so a
# hosted outage can never fail the fastest, most-run check in the project.
AGENT_HOSTS="ubuntu@192.168.122.50"
AGENT_BIN="/usr/local/bin/eitri-agent"             # install destination on each host
AGENT_STATE_DIR="/var/lib/eitri-agent"
# Agent logs live in journald once the systemd unit is adopted:
#   journalctl -u eitri-agent

# Agent launch flags shared by all hosts.
CH_BIN="/usr/local/bin/cloud-hypervisor"
# FIRMWARE is the guest firmware path ON each host. UEFI (CLOUDHV.fd) boots the
# guest's own GRUB -> guest kernel+initrd from disk (modern images boot).
FIRMWARE="/usr/share/eitri/CLOUDHV.fd"
# FIRMWARE_SRC (optional): a LOCAL firmware file to scp+install to $FIRMWARE on
# every host during deploy. Set it to roll a firmware change with the deploy;
# leave unset to keep whatever firmware already exists on each host.
# FIRMWARE_SRC="$HOME/.cache/eitri/CLOUDHV.fd"

# ── SSH-CA gate boot-check (optional) ─────────────────────────────────────────
# After proving the guest boots (serial console), the boot-gate also proves
# guest ACCESS by reaching the VM through eitri's SSH-CA jump gate and running a
# command as the guest user — a hard gate. It self-signs a short-lived cert with
# a smoke user CA (load-or-created below) that it registers with the tenant.
# SMOKE_GATE defaults to the server's ssh_listen; set it if that host:port isn't
# dialable from the deploy host (its host must match the gate's host-cert
# principal). Leave the rest unset to use the defaults shown.
# SMOKE_GATE="127.0.0.1:2223"
# SMOKE_VM_USER="ubuntu"
# SMOKE_USER_CA_FILE="$HOME/eitri-deploy/smoke_user_ca"

# ── Integration coverage (optional) ───────────────────────────────────────────
# The fleet is always deployed coverage-instrumented; the boot-gate flushes and
# merges server+agent coverage into ./coverage/integration. These override where
# each binary writes its raw GOCOVERDIR data. SERVER_GOCOVERDIR is local; the
# AGENT one is a path ON each host. Defaults shown — leave unset to use them.
# SERVER_GOCOVERDIR="$PWD/coverage/server"
# AGENT_GOCOVERDIR="$AGENT_STATE_DIR/coverage"

# Optional overrides (leave unset to use the agent's built-in defaults).
# TOMBSTONE_GRACE — how long a deleted VM lingers (stopped) before destroy.
#   Agent default is 5m; lower it for a snappier dashboard teardown.
# TOMBSTONE_GRACE="30s"
# VANISH_GRACE — grace for a VM that vanished WITHOUT a tombstone (agent default 1h).
# VANISH_GRACE="1h"
# AGENT_EXTRA_FLAGS — any additional eitri-agent flags, appended verbatim.
# Host resource caps live here (0/unset = offer the whole machine): reserve
# headroom by capping the CPU/mem/disk the agent advertises AND enforces.
# AGENT_EXTRA_FLAGS="--max-vcpus 8 --max-mem-mb 16384 --max-disk-gb 200"

# ── eitri.sh site image (make site-image) ─────────────────────────────────────
# Registry/repo for the static-site image; tagged with the release version.
# Required for `make site-image` (everything else in this file ignores it).
# SITE_IMAGE="registry.example.com/eitri-site"
# Image platform for the site image; set to your cluster's node arch.
# SITE_PLATFORM="linux/arm64"
# Guest firmware ships inside dist/<version> (manifested, sha-pinned) rather
# than staged by the site image. `make release` reads FIRMWARE_SRC — a local
# CLOUDHV.fd to mirror in — defaulting to $HOME/.cache/eitri/CLOUDHV.fd if
# present; see scripts/release.sh.

# ── eitri-server production image (make server-image) ─────────────────────────
# Registry/repo for the hosted control-plane image; tagged with the release
# version. Required for `make server-image` (everything else here ignores it).
# The image is arm64 only — the pod is pinned to the cluster's arm64 node.
# SERVER_IMAGE="registry.example.com/eitri-server"