admin
36c5cd5fdf
A generic ISO carries NO customer secret. The box registers itself at the hub as an unclaimed appliance; the operator binds it to a customer; the hub delivers the customer-id + retrieval passphrase ONCE; day-0 completes via the slice-A path. Hub (v0.62.0): - store/appliance.go: appliance_registrations keyed by (uuid, mac_set) — MAC set is the tiebreaker (duplicate SMBIOS UUIDs); token stored as sha256 only. Idempotent register (sticky-discard), atomic one-shot delivery, bind/discard. - api/appliance.go: POST /appliance/register (the one unauth endpoint, per-IP rate-limited, 256-bit token); GET /appliance/poll (404 no-oracle / 204 unbound / 200 deliver-once / 410 delivered). Passphrase read live, never logged. - web/appliances.go: Hosts-page "Unclaimed appliances" section + BIND (customer picker, host count display-only) + DISCARD; SSH host-key fingerprints; events. - Red-proofs: one-shot delivery + register idempotency (both proven red); 404-no-oracle, sticky-discard, bind staging, render. Green + confirm gate. Scripts (v1.19.0): - felhom-bootstrap.sh: ONE unit, TWO modes. Direct (env has customer/passphrase) = slice-A path, byte-identical, only branched around. Pairing (generic) = register + poll (RestartSec=30 is the poll timer); on delivery write the env 0600 and fall through to direct. Secrets + token shredded on success. - build-felhom-iso.sh --pairing: generic secret-free ISO, -generic filename, manifest mode=pairing. profiles/generic.profile (new). - test/bootstrap-modes.sh: Scenario D (direct = zero appliance calls) + pairing register/poll + delivery handoff — all green in a debian container.
27 lines
1.4 KiB
Plaintext
27 lines
1.4 KiB
Plaintext
# Felhom ISO build profile — generic (R-21 slice C, the universal SECRET-FREE ISO).
|
|
#
|
|
# Build with `--pairing`: the produced ISO carries NO customer-id and NO retrieval passphrase. The box
|
|
# installs, registers itself at the hub as an UNCLAIMED APPLIANCE, and the operator binds it to a
|
|
# customer on the hub; the hub then delivers the credentials ONCE and day-0 completes.
|
|
#
|
|
# The hub URL below is baked into the box's pairing env (non-secret). Override per-deployment if the
|
|
# box must reach a different hub.
|
|
|
|
FELHOM_FQDN="felhom-appliance.local"
|
|
FELHOM_HUB_URL="https://hub.felhom.eu"
|
|
|
|
# Disk selection is orthogonal to slice C (credential delivery). This default targets the first SATA
|
|
# disk (sda) — correct for single-disk SATA mini-PCs and the nested-VM drill. A box whose target is
|
|
# NVMe/other needs a profile variant with a `filter.*` udev match (see README "N100 profile") or an
|
|
# explicit disk-list. A match-nothing / wrong disk fails-safe (installer aborts, spike S5c).
|
|
FELHOM_DISK_SETUP='[disk-setup]
|
|
filesystem = "ext4"
|
|
disk-list = ["sda"]'
|
|
|
|
# Cheap AMI (AN3PLUS-class) boards that can't USB-boot the stock GRUB also need the mkimage loader
|
|
# (F1) — uncomment, and set Secure Boot OFF on the target (see profiles/n100.profile):
|
|
# FELHOM_LOADER="mkimage"
|
|
|
|
# Optional emergency/validation key baked into the installed root account (blank -> not baked):
|
|
# FELHOM_ROOT_SSH_KEY="ssh-ed25519 AAAA... ops@felhom"
|