22 lines
939 B
YAML
22 lines
939 B
YAML
|
---
|
||
|
|
# Default paths on the *control node* where certs are read from.
|
||
|
|
# Override these in your inventory / group_vars as needed.
|
||
|
|
|
||
|
|
# Fleet CA certificate (public; safe to push to all nodes)
|
||
|
|
fleet_mtls_ca_cert_src: "{{ lookup('env', 'HOME') }}/.hermes/pki/ca/fleet-ca.crt"
|
||
|
|
|
||
|
|
# Per-agent cert/key source dir on the control node.
|
||
|
|
# Expected layout: <fleet_mtls_agent_certs_dir>/<agent_name>/<agent_name>.{crt,key}
|
||
|
|
fleet_mtls_agent_certs_dir: "{{ lookup('env', 'HOME') }}/.hermes/pki/agents"
|
||
|
|
|
||
|
|
# Remote destination paths on the fleet node
|
||
|
|
fleet_mtls_remote_pki_dir: "/etc/hermes/pki"
|
||
|
|
fleet_mtls_remote_ca_dir: "{{ fleet_mtls_remote_pki_dir }}/ca"
|
||
|
|
fleet_mtls_remote_agent_dir: "{{ fleet_mtls_remote_pki_dir }}/agent"
|
||
|
|
|
||
|
|
# The agent name to deploy (set per-host in inventory, e.g. timmy / allegro / ezra)
|
||
|
|
fleet_mtls_agent_name: "{{ inventory_hostname_short }}"
|
||
|
|
|
||
|
|
# Hermes service name (for reload notification)
|
||
|
|
fleet_mtls_hermes_service: "hermes-a2a"
|