a73x

00a6a4d0

feat(site,docs): v0.0.1 release notes; quickstart downloads by plain curl

a73x   2026-07-29 12:13

Commit message
feat(site,docs): v0.0.1 release notes; quickstart downloads by plain curl

docs/releases.md is a published page: per-release notes describing the
product — fleet, VMs, tenancy/OIDC sign-in, BYO-CA SSH, service users,
platforms, known limits — linked from the docs index.

The quickstart opens with explicit download commands: version-pinned curl
to the stable /dl/<version>/ URLs plus sha256sum -c against SHA256SUMS.
Plain files a reader can inspect — no install script.

docs/quickstart.md
Old New
@@ -21,6 +21,21 @@ sign-in provider — and its unit. The client bundle
21 (`eitri-cli_<version>_<os>_<arch>.tar.gz`) is the single `eitri` binary for 21 (`eitri-cli_<version>_<os>_<arch>.tar.gz`) is the single `eitri` binary for
22 your laptop, built for linux and macOS. arm64 boxes take the arm64 bundle. 22 your laptop, built for linux and macOS. arm64 boxes take the arm64 bundle.
23 23
24 Download and verify — set `V` to the current release (shown at
25 [/dl](https://eitri.sh/dl/)):
26
27 ```sh
28 V=v0.0.1
29 curl -fsSLO "https://eitri.sh/dl/$V/eitri_${V}_linux_amd64.tar.gz"
30 curl -fsSLO "https://eitri.sh/dl/$V/eitri-oidc_${V}_linux_amd64.tar.gz"
31 curl -fsSLO "https://eitri.sh/dl/$V/eitri-cli_${V}_$(uname -s | tr A-Z a-z)_amd64.tar.gz"
32 curl -fsSLO "https://eitri.sh/dl/$V/SHA256SUMS"
33 sha256sum -c SHA256SUMS --ignore-missing
34 ```
35
36 Plain files at stable URLs — no install script. `sha256sum -c` must say OK
37 for every tarball before you unpack anything.
38
24 ## The server 39 ## The server
25 40
26 ```sh 41 ```sh
docs/releases.md
Old New
@@ -0,0 +1,53 @@
1 # Releases
2
3 Tarballs and checksums for every release live at
4 [eitri.sh/dl](https://eitri.sh/dl/), with `/dl/latest/` pointing at the
5 newest. The [quickstart](quickstart.md) takes a release from download to a
6 running VM.
7
8 ## v0.0.1
9
10 The first release. eitri is a small self-hosted cloud: one control-plane
11 server, an agent on every Linux/KVM box you enroll, cloud-hypervisor microVMs,
12 a web console, and SSH into guests through an identity-checking jump gate.
13
14 **Fleet.** Enroll any Linux/KVM host with a one-shot join command from the
15 console. The agent reconciles each VM in its own worker, admits VMs against
16 the host's real resources, fetches cloud-hypervisor and the guest firmware
17 itself (sha-verified against the release), and upgrades itself from the
18 console — running VMs survive agent restarts and upgrades.
19
20 **VMs.** UEFI guests boot any cloud-init disk image — the guest owns its
21 kernel. Addressing is an embedded DHCP server with per-VM reservations. The
22 console shows live host metrics, per-VM status and a browser serial console;
23 tenant quotas bound what a tenant can create.
24
25 **Sign-in and tenancy.** The console signs in through OIDC — the bundled
26 `eitri-oidc` issuer for a single box, or [bring your own IdP](byo-idp.md)
27 (Google, Okta, Keycloak…). Every identity's first sign-in creates its own
28 tenant; every API request, event stream, console session and audit row is
29 tenant-scoped. CLI and automation authenticate with personal access tokens
30 minted in the console.
31
32 **SSH.** Tenants register their own user CA — eitri never holds a user
33 private key. `eitri ssh` self-signs a short-lived certificate, pins eitri's
34 host CA, and jumps the gate to `<tenant>.<vm>`; certificates are revocable
35 per serial. See [ssh-access.md](ssh-access.md).
36
37 **Running it.** `eitri-server` and `eitri-oidc` ship with hardened systemd
38 units and run as dedicated non-root users; the agent's unit documents exactly
39 why it runs as root. Server and issuer state live under `/var/lib`, config
40 under `/etc/eitri`. The server speaks plain HTTP — front it with TLS if it
41 leaves your LAN.
42
43 **Platforms.** Hosts: Linux amd64 and arm64 with KVM. Client CLI: Linux and
44 macOS, amd64 and arm64.
45
46 **Known limits.**
47
48 - One user per tenant; shared/multi-user tenants are the headline for v0.0.2.
49 - No TLS termination in the server — put a proxy in front for anything
50 routable.
51 - Switching `oidc.issuer` after tenants exist strands their identity
52 bindings; pick your issuer before inviting sign-ins.
53 - macOS hosts are not supported yet (planned).
internal/site/site.go
Old New
@@ -20,6 +20,7 @@ var pages = []string{
20 "cert-rotation", 20 "cert-rotation",
21 "credential-revocation", 21 "credential-revocation",
22 "faq", 22 "faq",
23 "releases",
23 } 24 }
24 25
25 // Config locates the generator's inputs and output. 26 // Config locates the generator's inputs and output.
site/docs.md
Old New
@@ -24,6 +24,10 @@
24 24
25 - [faq](faq.md) — networking, and other sharp edges 25 - [faq](faq.md) — networking, and other sharp edges
26 26
27 **Releases**
28
29 - [release notes](releases.md) — what shipped in each version
30
27 **Where it's going** 31 **Where it's going**
28 32
29 - [roadmap](../ROADMAP.md) 33 - [roadmap](../ROADMAP.md)