49 lines
2.3 KiB
YAML
49 lines
2.3 KiB
YAML
---
|
|
# hephaestus hub — the canonical heph replica (server mode) on indri.
|
|
# Other devices (e.g. gilbert) are spokes that sync against this hub.
|
|
# See [[set-up-sync-hub]] and [[host-heph-pwa]] in the hephaestus repo.
|
|
|
|
# Pinned release used for the initial `cargo install` and the PWA shell.
|
|
# After bootstrap, hephd's own --self-update keeps the binary current; this
|
|
# pin only governs the first install and the bundled PWA shell version.
|
|
heph_version: v1.2.1
|
|
|
|
# Anonymous public HTTPS clone — matches hephd's INSTALL_GIT_URL so the initial
|
|
# install and unattended self-update build from the same source (no ssh-agent).
|
|
heph_repo_url: https://forge.eblu.me/eblume/hephaestus.git
|
|
|
|
heph_bin_dir: /Users/erichblume/.cargo/bin
|
|
heph_binary: "{{ heph_bin_dir }}/hephd"
|
|
|
|
# rustc/cargo here are rustup shims. The bare (non-mise) environment that the
|
|
# launchagent and ansible run in falls back to rustup's *default* toolchain,
|
|
# which can lag behind heph's rust-version floor (Cargo.toml: 1.89). Pin the
|
|
# channel explicitly so both the bootstrap build and unattended self-update
|
|
# always use a current toolchain regardless of the host's rustup default.
|
|
heph_rust_toolchain: stable
|
|
|
|
heph_data_dir: /Users/erichblume/.local/share/heph
|
|
heph_db: "{{ heph_data_dir }}/heph.db"
|
|
heph_socket: "{{ heph_data_dir }}/hephd.sock"
|
|
heph_log_dir: /Users/erichblume/Library/Logs
|
|
|
|
# Version-pinned source checkout; the PWA static shell is served directly from
|
|
# its heph-pwa/ subdir (no copy), keeping shell and hub in lockstep at heph_version.
|
|
heph_pwa_src_dir: /Users/erichblume/.cache/heph-pwa-src
|
|
heph_web_root: "{{ heph_pwa_src_dir }}/heph-pwa"
|
|
|
|
# Hub listens on all interfaces so tailnet spokes can reach it directly
|
|
# (http://indri.tail8d86e.ts.net:8787) and Caddy can proxy heph.ops.eblu.me.
|
|
# Access is gated by Authentik OIDC regardless — tailnet reachability is not
|
|
# enough (this is the owner's most sensitive data).
|
|
heph_http_addr: 0.0.0.0:8787
|
|
heph_port: 8787
|
|
heph_external_url: https://heph.ops.eblu.me
|
|
|
|
# Authentik OIDC — issuer + audience together turn hub auth on. The audience is
|
|
# the device-code client id (see argocd/manifests/authentik heph blueprint).
|
|
heph_oidc_issuer: https://authentik.ops.eblu.me/application/o/heph/
|
|
heph_oidc_audience: heph
|
|
|
|
# Self-update poll interval (seconds). 10 minutes.
|
|
heph_self_update_interval_secs: 600
|