mirror of
https://github.com/turnstonelabs/turnstone.git
synced 2026-08-26 13:54:48 -06:00
Patrick Buckley
34 lines
1.8 KiB
Plaintext
34 lines
1.8 KiB
Plaintext
# Per-host node identity + cluster wiring for a bare-metal turnstone-server.
|
|
# Copy to /etc/systemd/system/turnstone-server.service.d/node.conf and edit the
|
|
# addresses, then `systemctl daemon-reload`. Identity + URLs are NOT secrets, so
|
|
# they live here; the JWT secret + DB URL live in /etc/turnstone/config.toml.
|
|
#
|
|
# Addresses below use RFC 5737 documentation IPs — replace them:
|
|
# <this-host> = the bare-metal host's own reachable DNS name or IP address
|
|
# (its mTLS identity and the address peers dial)
|
|
# <compose-host> = the host running the cluster / docker-compose stack, started
|
|
# with TURNSTONE_HOST_IP=<compose-host> and
|
|
# TURNSTONE_ACME_EXTERNAL_URL=http://<compose-host>:8090/acme
|
|
# so enrollment links and published ports are reachable
|
|
# (see docs/docker.md).
|
|
[Service]
|
|
# Unique node id (defaults to the hostname if unset).
|
|
Environment=TURNSTONE_NODE_ID=host-1
|
|
|
|
# The address peers + the console collector dial back. Auto-upgrades to https://
|
|
# once the node enrolls its mTLS cert. IPv6 literals require URL brackets, for
|
|
# example http://[2001:db8::10]:8080.
|
|
Environment=TURNSTONE_ADVERTISE_URL=http://192.0.2.10:8080
|
|
|
|
# The cluster console's reachable plain-HTTP ACME/API endpoint. A bare-metal node
|
|
# can't resolve the in-cluster name (console:8090), so point it at the published
|
|
# port; turnstone-server honors this for cert enrollment.
|
|
Environment=TURNSTONE_CONSOLE_URL=http://192.0.2.1:8090
|
|
|
|
# Trusted canonical responder base. This pins where the node may send its
|
|
# enrollment JWT; it must match the console-side value (a literal IP is fine).
|
|
Environment=TURNSTONE_ACME_EXTERNAL_URL=http://192.0.2.1:8090/acme
|
|
|
|
# The cluster's published SearxNG, for the web_search tool.
|
|
Environment=TURNSTONE_SEARXNG_URL=http://192.0.2.1:8081
|