# Felhom ISO build profile — n100 / cheap-board (R-21 slice B).
#
# The canonical profile for cheap mini-PCs whose early AMI (AN3PLUS-class) UEFI firmware CANNOT boot
# the ISO's stock signed GRUB from USB (VALIDATION-n100-baremetal F1, `relocation 0x0`). It flips the
# loader to `mkimage` — a monolithic grub-mkimage UEFI loader built from the ISO's own GRUB, proven
# live on the N100 board.
#
# ⚠ SECURE BOOT MUST BE OFF on the target board. The mkimage loader is UNSIGNED; with Secure Boot
#   enforcing the firmware refuses it ("Access Denied", no boot — proven, RUNBOOK-B leg 3). Compliant
#   firmware should use the default `shim` loader (drop FELHOM_LOADER) to keep Secure Boot working.
#
# This template ships a MATCH-NOTHING disk filter as a safety default — REPLACE the serial with the
# target SSD's real ID_SERIAL_SHORT (harvested pre-wipe; see README "N100 profile") before a real
# install, or the installer fails-safe (aborts, touches no disk — spike S5c).

FELHOM_FQDN="felhom-host.local"

# mkimage loader (F1 firmware fix). Remove this line on Secure-Boot-capable/compliant firmware.
FELHOM_LOADER="mkimage"

FELHOM_DISK_SETUP='[disk-setup]
filesystem = "ext4"
filter-match = "all"
filter.ID_SERIAL_SHORT = "REPLACE-WITH-TARGET-SSD-SERIAL"'

# Optional emergency/validation key baked into root's authorized_keys (blank -> not baked):
# FELHOM_ROOT_SSH_KEY="ssh-ed25519 AAAA... ops@felhom"