# bootapi configuration (environment variables).
#
# bootapi is configured entirely from the environment (12-factor, like encapi).
# In Kubernetes these come from the Deployment env + a Vault-sourced Secret and
# a templates ConfigMap/git repo (see docs/deployment.md). Locally:
#   env $(grep -v '^#' config.example.env | xargs) ./bin/bootapi

# --- HTTP (boot path is ALWAYS plain HTTP: PXE installers have no CA trust) ---
BOOTAPI_LISTEN_ADDR=:8000
# Optional parallel HTTPS listener for clients that DO trust the internal CA.
# The boot path still works over plain HTTP; do not 301 HTTP->HTTPS (see docs).
# BOOTAPI_TLS_LISTEN_ADDR=:8443
# BOOTAPI_TLS_CERT_FILE=/etc/bootapi/tls/tls.crt
# BOOTAPI_TLS_KEY_FILE=/etc/bootapi/tls/tls.key

# --- NetBox (source of truth for host -> boot data) ---
BOOTAPI_NETBOX_URL=https://netbox.k8s.syd1.au.unkin.net
# Provide the token inline OR (preferred in k8s) via a Vault-mounted file.
# NOTE: the token needs WRITE scope on the device pxe_enabled custom field for
# the /provisioned callback (see docs/security.md).
BOOTAPI_NETBOX_TOKEN=
# BOOTAPI_NETBOX_TOKEN_FILE=/var/run/secrets/netbox/api_token
BOOTAPI_NETBOX_TIMEOUT=5s
BOOTAPI_NETBOX_INSECURE=false

# --- caching (short: a re-provisioned host must pick up changes next boot) ---
BOOTAPI_CACHE_TTL=30s

# --- templates: git-sync (preferred) OR a local override dir OR embedded ---
# Pull a templates repo every interval (default 3m, like argocd); a parse
# failure keeps the last-good set. Embedded defaults are the startup fallback.
BOOTAPI_TEMPLATE_GIT_URL=https://git.unkin.net/unkin/bootapi-templates.git
BOOTAPI_TEMPLATE_GIT_BRANCH=main
BOOTAPI_TEMPLATE_GIT_INTERVAL=3m
# BOOTAPI_TEMPLATE_GIT_TOKEN=            # only for a private templates repo
# BOOTAPI_TEMPLATE_DIR=/etc/bootapi/templates   # used only when GIT_URL is unset
BOOTAPI_DEFAULT_TEMPLATE=almalinux9

# --- URLs baked into rendered output ---
# bootapi's own PLAIN-HTTP base (goes into iPXE inst.ks= and /ks URLs). Must be
# reachable without CA trust.
BOOTAPI_BASE_URL=http://bootapi.k8s.syd1.au.unkin.net
# Base the end-of-kickstart callback posts to; defaults to BOOTAPI_BASE_URL
# (plain HTTP, works before the internal CA is installed).
# BOOTAPI_CALLBACK_BASE_URL=http://bootapi.k8s.syd1.au.unkin.net
# artifactapi remote base the distro catalog builds kernel/initrd URLs from.
BOOTAPI_ARTIFACT_BASE_URL=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote
# Legacy fallback OS-tree base, used only if no catalog entry matches. Normally
# empty (the distro catalog drives boot images).
# BOOTAPI_BOOT_BASE_URL=

# --- end-of-kickstart callback token (guards POST /provisioned) ---
# Empty disables the callback (pxe_enabled will not auto-clear). Embedded in the
# rendered kickstart, so treat as a provisioning secret (docs/security.md).
BOOTAPI_PROVISION_TOKEN=
# BOOTAPI_PROVISION_TOKEN_FILE=/var/run/secrets/bootapi/provision_token

# --- puppet bootstrap targets (k8s puppetserver; baked into kickstart %post) ---
BOOTAPI_PUPPET_SERVER=puppet.k8s.syd1.au.unkin.net
BOOTAPI_PUPPET_CA_SERVER=puppetca.k8s.syd1.au.unkin.net
# Written to /etc/sysconfig/puppet-initial as PUPPETCA_URL (read by the
# puppet-initial RPM's systemd bootstrap unit).
BOOTAPI_PUPPET_CA_URL=puppetca.k8s.syd1.au.unkin.net

# --- network defaults (used when NetBox records none per-device) ---
BOOTAPI_DOMAIN=main.unkin.net
# k8s bind-resolvers LoadBalancer (replaces the legacy VM resolvers).
BOOTAPI_NAMESERVERS=198.18.200.7

# --- render-time secrets (NEVER stored in NetBox; from Vault in k8s) ---
# crypt(3) hash for the root account. Empty => root account locked.
BOOTAPI_ROOT_PASSWORD_HASH=
# BOOTAPI_ROOT_PASSWORD_HASH_FILE=/var/run/secrets/bootapi/root_password_hash
# Newline-separated SSH public keys installed for root.
BOOTAPI_SSH_AUTHORIZED_KEYS=

# --- unknown-MAC fallback: "local" (safe: boot local disk) or "shell" (debug) ---
BOOTAPI_UNKNOWN_MAC_FALLBACK=local