config.example.yaml

# FleetOS Manager config for the compose topology in deploy/compose.yaml.
#
# Install as /etc/cryptos/fleet/config.yaml owned by uid 65532, mode 0400. It
# carries the Postgres password in database_url, so treat it as a secret rather
# than as configuration: no environment interpolation is performed on it, and it
# does not belong in git next to the compose file.

# Inside the container. Published as 443 by compose; the low port is not bound
# here because the image runs unprivileged.
listen: "0.0.0.0:8443"

# Plaintext listener that only redirects to HTTPS, so an operator who types the
# hostname without a scheme reaches the login page. Published as 80 by compose.
# Remove this line to disable the listener entirely.
httpRedirectListen: "0.0.0.0:8080"

# Only needed when HTTPS is published on something other than 443: the redirect
# has to name the port clients reach, not the one the container binds.
# httpsPublicPort: "8443"

# Never true in a real deployment. It disables client-certificate auth and
# serves plaintext h2c.
authBypass: false

# The server certificate. Left unset for day zero: the manager serves a
# self-signed certificate, kept in Postgres, and logs its fingerprint. Set both
# (and uncomment the tls mount in compose.yaml) once you have a real one.
# tlsCert: /etc/cryptos/fleet/tls/tls.crt
# tlsKey: /etc/cryptos/fleet/tls/tls.key

# First run: with no operatorCAPath, the manager prints a single-use bootstrap
# token and the token holder registers your external operator CA in the web UI
# (docs/first-run.md). disabled keeps first run shut.
# firstRun: auto

# Or the operator CA from a file (uncomment the operator-ca mount in
# compose.yaml). It is then the only operator CA source and first run doesn't
# apply. It can't be a CryptOS node's CA; the manager refuses to start if it is.
# See docs/operator-ca.md.
# operatorCAPath: /etc/cryptos/fleet/operator-ca/operator-ca.pem

# The password must match POSTGRES_PASSWORD in
# /etc/cryptos/fleet/secrets/postgres.env. The host is the compose service name.
database_url: "postgres://manager:CHANGEME@postgres:5432/manager"

# With operatorCAPath only: where your operator CA publishes its CRL, so
# revocations made at the CA are enforced (docs/operator-ca.md). A path entry
# reads a file from the operator-crl mount. A CA registered through first run
# keeps its CRL source on its own record instead. Revocations made in the Fleet
# Manager go on its denylist in Postgres either way.
# operatorCRL:
#   - url: "http://pki.example.org/fleetos-operator.crl"
#   - path: /etc/cryptos/fleet/operator-crl/operator-ca.crl

# Each node's admin credential drives that node's management API, so this host
# holds CA-admin authority. Treat it as a tier-0 asset.
nodes:
  - name: pki-root
    endpoint: "10.0.0.20:443"
    role: root
    adminCertPath: /etc/cryptos/fleet/pki-root/admin.crt
    adminKeyPath: /etc/cryptos/fleet/pki-root/admin.key
    caCertPath: /etc/cryptos/fleet/pki-root/ca.pem
  - name: pki-inter
    endpoint: "10.0.0.21:443"
    role: intermediate
    adminCertPath: /etc/cryptos/fleet/pki-inter/admin.crt
    adminKeyPath: /etc/cryptos/fleet/pki-inter/admin.key
    caCertPath: /etc/cryptos/fleet/pki-inter/ca.pem