scripts/ship.env.example

Ref: Size: 3.9 KiB History

# eitri pipeline config — sourced by scripts/ship.sh, one file per plane.
#
# Copy this to ~/eitri-deploy/<target>/ship.env (override the whole path with
# $EITRI_SHIP_ENV) and fill it in. This file is site-specific and points at
# secrets — keep it OUT of the repo. What the PLANE is (hostnames, host ports,
# namespace, which plane gets backups) is committed instead, in
# deploy/server/plane.<target>.env.
#
# The same layout as scripts/deploy.env.example on purpose: one convention.

# ── Registries ────────────────────────────────────────────────────────────────
# ship.sh points the image builds at THIS file, so these are the only place a
# plane's registry is named.
SERVER_IMAGE="registry.example.com/eitri-server"
SITE_IMAGE="registry.example.com/eitri-site"
# The nightly backup job's image (scripts/backup-image.sh). Required only on a
# plane with BACKUPS=1. It includes its OWN tag — it is not built per release.
BACKUP_IMAGE="registry.example.com/eitri-backup:1"
# Image platform for the site image; match the node arch in the plane file.
SITE_PLATFORM="linux/arm64"

# ── Credentials ───────────────────────────────────────────────────────────────
# Name ONE of the two arrangements. ship.sh forwards whatever it finds here and
# clears the rest, so the plane decides and the pipeline stays the same script.
# The same credential converges the fleet's agents one stage earlier, so the
# identity named here must be the one whose tenant owns the fleet's hosts — a
# credential from another tenant sees no hosts, and stage 8 says so. ship.sh
# checks that whichever of these files you name is readable before it deploys
# anything, because both the stages that use it run after the plane is rolled.
#
# Naming neither is a real arrangement, not a broken one: with --skip-smoke the
# run rolls the plane and skips stage 8 with a warning, leaving the fleet on the
# previous release for whoever holds the credential to converge. Without
# --skip-smoke it is refused before stage 1.
#
# (a) A plane running the bundled eitri-oidc — stg. The smoke signs in through
# the real code flow, which proves the whole credential chain, and mints its
# own short-lived PAT for the run: no token to paste, none to rotate. The
# identity must exist in the issuer (README, "One-time bring-up").
# CI_USER="ship@eitri.local"
# CI_PASSWORD_FILE="$HOME/eitri-deploy/stg/ship-password"
#
# (b) A plane fronted by a real identity provider — prod. There is no password
# to post at Google, so the credential-chain proof is skipped and an
# operator-minted, non-expiring PAT carries the run. The smoke derives its
# tenant from the token rather than being told.
CI_PAT_FILE="$HOME/eitri-deploy/prod/deploy-pat"

# The smoke's own user CA, load-or-created here and registered with the tenant.
SMOKE_USER_CA_FILE="$HOME/eitri-deploy/prod/smoke_user_ca"

# ── Optional ──────────────────────────────────────────────────────────────────
# The MCP origins the smoke exercises, space-separated. The FIRST gets the full
# cycle — including the minutes-long vm_create that a proxy's silent-origin
# timeout would cut — and the rest get an unauthenticated-401 and a toolset
# check. Defaults to "https://<console host> https://<api host>".
# SMOKE_MCP_URL="https://stg.eitri.sh https://api.stg.eitri.sh"
# SMOKE_VM_USER="ubuntu"
# A local CLOUDHV.fd to mirror into the release (scripts/release.sh); without
# one the release ships no firmware and agents cannot bootstrap it.
# FIRMWARE_SRC="$HOME/.cache/eitri/CLOUDHV.fd"