# Felhom ISO build profile — generic (R-21 slice C, the universal SECRET-FREE ISO).
#
# Build with `--pairing`: the produced ISO carries NO customer-id and NO retrieval passphrase. The box
# installs, registers itself at the hub as an UNCLAIMED APPLIANCE, and the operator binds it to a
# customer on the hub; the hub then delivers the credentials ONCE and day-0 completes.
#
# The hub URL below is baked into the box's pairing env (non-secret). Override per-deployment if the
# box must reach a different hub.

FELHOM_FQDN="felhom-appliance.local"
FELHOM_HUB_URL="https://hub.felhom.eu"

# Disk selection is orthogonal to slice C (credential delivery). This default targets the first SATA
# disk (sda) — correct for single-disk SATA mini-PCs and the nested-VM drill. A box whose target is
# NVMe/other needs a profile variant with a `filter.*` udev match (see README "N100 profile") or an
# explicit disk-list. A match-nothing / wrong disk fails-safe (installer aborts, spike S5c).
FELHOM_DISK_SETUP='[disk-setup]
filesystem = "ext4"
disk-list = ["sda"]'

# Cheap AMI (AN3PLUS-class) boards that can't USB-boot the stock GRUB also need the mkimage loader
# (F1) — uncomment, and set Secure Boot OFF on the target (see profiles/n100.profile):
# FELHOM_LOADER="mkimage"

# Optional emergency/validation key baked into the installed root account (blank -> not baked):
# FELHOM_ROOT_SSH_KEY="ssh-ed25519 AAAA... ops@felhom"