00a6a4d0
feat(site,docs): v0.0.1 release notes; quickstart downloads by plain curl
a73x 2026-07-29 12:13
Commit message
docs/quickstart.md
| Old | New | ||
|---|---|---|---|
| @@ -21,6 +21,21 @@ sign-in provider — and its unit. The client bundle | |||
| 21 | (`eitri-cli_<version>_<os>_<arch>.tar.gz`) is the single `eitri` binary for | 21 | (`eitri-cli_<version>_<os>_<arch>.tar.gz`) is the single `eitri` binary for |
| 22 | your laptop, built for linux and macOS. arm64 boxes take the arm64 bundle. | 22 | your laptop, built for linux and macOS. arm64 boxes take the arm64 bundle. |
| 23 | 23 | ||
| 24 | Download and verify — set `V` to the current release (shown at | ||
| 25 | [/dl](https://eitri.sh/dl/)): | ||
| 26 | |||
| 27 | ```sh | ||
| 28 | V=v0.0.1 | ||
| 29 | curl -fsSLO "https://eitri.sh/dl/$V/eitri_${V}_linux_amd64.tar.gz" | ||
| 30 | curl -fsSLO "https://eitri.sh/dl/$V/eitri-oidc_${V}_linux_amd64.tar.gz" | ||
| 31 | curl -fsSLO "https://eitri.sh/dl/$V/eitri-cli_${V}_$(uname -s | tr A-Z a-z)_amd64.tar.gz" | ||
| 32 | curl -fsSLO "https://eitri.sh/dl/$V/SHA256SUMS" | ||
| 33 | sha256sum -c SHA256SUMS --ignore-missing | ||
| 34 | ``` | ||
| 35 | |||
| 36 | Plain files at stable URLs — no install script. `sha256sum -c` must say OK | ||
| 37 | for every tarball before you unpack anything. | ||
| 38 | |||
| 24 | ## The server | 39 | ## The server |
| 25 | 40 | ||
| 26 | ```sh | 41 | ```sh |
docs/releases.md
| Old | New | ||
|---|---|---|---|
| @@ -0,0 +1,53 @@ | |||
| 1 | # Releases | ||
| 2 | |||
| 3 | Tarballs and checksums for every release live at | ||
| 4 | [eitri.sh/dl](https://eitri.sh/dl/), with `/dl/latest/` pointing at the | ||
| 5 | newest. The [quickstart](quickstart.md) takes a release from download to a | ||
| 6 | running VM. | ||
| 7 | |||
| 8 | ## v0.0.1 | ||
| 9 | |||
| 10 | The first release. eitri is a small self-hosted cloud: one control-plane | ||
| 11 | server, an agent on every Linux/KVM box you enroll, cloud-hypervisor microVMs, | ||
| 12 | a web console, and SSH into guests through an identity-checking jump gate. | ||
| 13 | |||
| 14 | **Fleet.** Enroll any Linux/KVM host with a one-shot join command from the | ||
| 15 | console. The agent reconciles each VM in its own worker, admits VMs against | ||
| 16 | the host's real resources, fetches cloud-hypervisor and the guest firmware | ||
| 17 | itself (sha-verified against the release), and upgrades itself from the | ||
| 18 | console — running VMs survive agent restarts and upgrades. | ||
| 19 | |||
| 20 | **VMs.** UEFI guests boot any cloud-init disk image — the guest owns its | ||
| 21 | kernel. Addressing is an embedded DHCP server with per-VM reservations. The | ||
| 22 | console shows live host metrics, per-VM status and a browser serial console; | ||
| 23 | tenant quotas bound what a tenant can create. | ||
| 24 | |||
| 25 | **Sign-in and tenancy.** The console signs in through OIDC — the bundled | ||
| 26 | `eitri-oidc` issuer for a single box, or [bring your own IdP](byo-idp.md) | ||
| 27 | (Google, Okta, Keycloak…). Every identity's first sign-in creates its own | ||
| 28 | tenant; every API request, event stream, console session and audit row is | ||
| 29 | tenant-scoped. CLI and automation authenticate with personal access tokens | ||
| 30 | minted in the console. | ||
| 31 | |||
| 32 | **SSH.** Tenants register their own user CA — eitri never holds a user | ||
| 33 | private key. `eitri ssh` self-signs a short-lived certificate, pins eitri's | ||
| 34 | host CA, and jumps the gate to `<tenant>.<vm>`; certificates are revocable | ||
| 35 | per serial. See [ssh-access.md](ssh-access.md). | ||
| 36 | |||
| 37 | **Running it.** `eitri-server` and `eitri-oidc` ship with hardened systemd | ||
| 38 | units and run as dedicated non-root users; the agent's unit documents exactly | ||
| 39 | why it runs as root. Server and issuer state live under `/var/lib`, config | ||
| 40 | under `/etc/eitri`. The server speaks plain HTTP — front it with TLS if it | ||
| 41 | leaves your LAN. | ||
| 42 | |||
| 43 | **Platforms.** Hosts: Linux amd64 and arm64 with KVM. Client CLI: Linux and | ||
| 44 | macOS, amd64 and arm64. | ||
| 45 | |||
| 46 | **Known limits.** | ||
| 47 | |||
| 48 | - One user per tenant; shared/multi-user tenants are the headline for v0.0.2. | ||
| 49 | - No TLS termination in the server — put a proxy in front for anything | ||
| 50 | routable. | ||
| 51 | - Switching `oidc.issuer` after tenants exist strands their identity | ||
| 52 | bindings; pick your issuer before inviting sign-ins. | ||
| 53 | - macOS hosts are not supported yet (planned). | ||
internal/site/site.go
| Old | New | ||
|---|---|---|---|
| @@ -20,6 +20,7 @@ var pages = []string{ | |||
| 20 | "cert-rotation", | 20 | "cert-rotation", |
| 21 | "credential-revocation", | 21 | "credential-revocation", |
| 22 | "faq", | 22 | "faq", |
| 23 | "releases", | ||
| 23 | } | 24 | } |
| 24 | 25 | ||
| 25 | // Config locates the generator's inputs and output. | 26 | // Config locates the generator's inputs and output. |
site/docs.md
| Old | New | ||
|---|---|---|---|
| @@ -24,6 +24,10 @@ | |||
| 24 | 24 | ||
| 25 | - [faq](faq.md) — networking, and other sharp edges | 25 | - [faq](faq.md) — networking, and other sharp edges |
| 26 | 26 | ||
| 27 | **Releases** | ||
| 28 | |||
| 29 | - [release notes](releases.md) — what shipped in each version | ||
| 30 | |||
| 27 | **Where it's going** | 31 | **Where it's going** |
| 28 | 32 | ||
| 29 | - [roadmap](../ROADMAP.md) | 33 | - [roadmap](../ROADMAP.md) |