remove profile dependency

rig/ctrl/.env.example

@@ -1,9 +1,10 @@
 # Machine-local config. Copy to ctrl/.env (gitignored) and edit.
-# Cluster SHAPE lives in ctrl/env.d/<profile>.env — not here.
+# Cluster SHAPE: an optional profile in ctrl/env.d/ — see the *.env.example there.
 # The architecture MODEL lives in arch/<name>.json — not here either.
 
-# Which profile in ctrl/env.d/ to build. minimal | client | offline
-PROFILE=minimal
+# A profile in ctrl/env.d/ to build. Empty means rig's built-in defaults, which
+# need no profile at all. Copy an env.d/*.env.example to <name>.env to add one.
+PROFILE=
 
 # Cluster name; the kubectl context becomes kind-<CLUSTER>.
 # LEAVE THIS UNSET unless you need a name that differs from the directory —

rig/ctrl/Dockerfile.deps

@@ -28,7 +28,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # reads. A kit is one file with its pins frozen in and is proven to run with
 # nothing else from rig present — which is exactly what an image needs, and
 # `make standalone` keeps it current. Pins are the same in every profile's kit.
-ARG PROFILE=minimal
+ARG PROFILE=default
 WORKDIR /work
 COPY standalone/${PROFILE}/rigdeps.sh /work/rigdeps.sh
 RUN chmod +x /work/rigdeps.sh

rig/ctrl/addons/postgres.sh

@@ -8,7 +8,7 @@
 # twice.
 #
 # Plain manifests rather than a helm chart, matching the other addons: a chart
-# repo is a network dependency, and the offline profile exists precisely so
+# repo is a network dependency, and the offline example profile exists precisely so
 # there is a path with none. The image is pinned in ctrl/versions.env and can be
 # preloaded into a local registry like every other image here.
 #

rig/ctrl/env.d/client.env.example

@@ -1,3 +1,8 @@
+# EXAMPLE PROFILE. rig needs none of these: with no profile it runs on its
+# built-in defaults (lib/config.sh). To use this one, copy it to client.env in this
+# directory and name it — PROFILE=client in ctrl/.env, or on the command line. It
+# then overlays the defaults; anything it does not set, they still supply.
+#
 # client — the regulated-estate shape. Multi-node so taints, affinity and
 # topology are real; apiserver audit on; images through a pull-through cache of
 # the corporate registry.

rig/ctrl/env.d/data.env.example

@@ -1,10 +1,10 @@
-# data — a cluster with the cabinets an environment asks for.
+# EXAMPLE PROFILE. rig needs none of these: with no profile it runs on its
+# built-in defaults (lib/config.sh). To use this one, copy it to data.env in this
+# directory and name it — PROFILE=data in ctrl/.env, or on the command line. It
+# then overlays the defaults; anything it does not set, they still supply.
 #
-# A cabinet is a public service dropped in as-is — the upstream image,
-# unmodified, reachable at a known address. It is declared once and installs on
-# either target: a `service.yml` composes it for a laptop, and the addons below
-# install the same one here. The names match deliberately — each cabinet.json
-# carries a `rig_addon` field pointing at ctrl/addons/<name>.sh.
+# data — databases and a scheduler for an environment that needs them: postgres,
+# redis and airflow, each an upstream image run unmodified.
 #
 # Everything lands in the `data` namespace (DATA_NAMESPACE to move it), so
 # `make cluster reset` on the app namespace leaves the databases alone.
@@ -18,7 +18,7 @@ KIND_CONFIG=kind-config.yaml.tpl
 # Order matters: addons.sh installs in the order listed, and airflow refuses to
 # start without a metadata database, so postgres comes first.
 ADDONS="metallb postgres redis airflow"
-# local, not none — see minimal.env: `none` has no outward-push guard.
+# local, not none — see the defaults in lib/config.sh: `none` has no outward-push guard.
 REGISTRY_MODE=local
 INGRESS_MODE=hostport
 DNS_MODE=hosts

rig/ctrl/env.d/minimal.env

@@ -1,21 +0,0 @@
-# minimal — the default. One node, no addons, no registry.
-# Assumes nothing and boots fast. Start here; move to client.env when you need
-# the regulated behaviours.
-#
-
-PROFILE_NAME=minimal
-K8S_VERSION=v1_36
-KIND_CONFIG=kind-config.yaml.tpl
-ADDONS=""
-# local, not none: `none` leaves the cluster with no registry to push to, and an
-# unqualified image name then means docker.io/library/<name>. In a regulated
-# estate that is a disclosure risk, not a convenience trade — so the default
-# carries the guard even though it costs one container.
-REGISTRY_MODE=local
-INGRESS_MODE=hostport
-DNS_MODE=hosts
-
-# Ports are deliberately NOT set here. They derive from the directory name so
-# several environments coexist — see ctrl/ports.sh, and `make ports` to see the
-# block this one gets. A fixed default here would collide with whatever else the
-# machine happens to be running; 8080 in particular is rarely free.

rig/ctrl/env.d/offline.env.example

@@ -1,3 +1,8 @@
+# EXAMPLE PROFILE. rig needs none of these: with no profile it runs on its
+# built-in defaults (lib/config.sh). To use this one, copy it to offline.env in this
+# directory and name it — PROFILE=offline in ctrl/.env, or on the command line. It
+# then overlays the defaults; anything it does not set, they still supply.
+#
 # offline — air-gapped. Everything comes from a local registry that was loaded
 # ahead of time; nothing reaches the internet. Pair with the deps-full image
 # (DEPS_SOURCE=baked) so the toolchain install is offline too.

rig/ctrl/k8s/README.md

@@ -28,12 +28,12 @@ not restate what the YAML already says.
 
 | file | nodes | audit | profiles |
 | --- | --- | --- | --- |
-| `kind-config.yaml.tpl` | 1 | off | `minimal`, `data` |
-| `kind-config.audit.yaml.tpl` | 1 | on | `offline` |
-| `kind-config.client.yaml.tpl` | 3 | on | `client` |
+| `kind-config.yaml.tpl` | 1 | off | the default; the `data` example |
+| `kind-config.audit.yaml.tpl` | 1 | on | the `offline` example |
+| `kind-config.client.yaml.tpl` | 3 | on | the `client` example |
 
-A profile picks one with `KIND_CONFIG` in `ctrl/env.d/<profile>.env`. Adding a
-shape is adding a file — there is no dispatcher to edit.
+With no profile the default shape is used; a profile picks another with
+`KIND_CONFIG`. Adding a shape is adding a file — there is no dispatcher to edit.
 
 Audit is an apiserver flag and therefore fixed at creation: changing it is
 `make cluster reset`, not a re-apply.

rig/ctrl/lib/config.sh

@@ -5,10 +5,11 @@
 # definition of how the config layers compose, which every script has to agree
 # on exactly. Precedence, weakest first:
 #
+#   built-in defaults      below; fill only what nothing else set
 #   ctrl/versions.env      pinned toolchain + image digests   (committed)
-#   ctrl/env.d/<profile>   cluster shape                      (committed)
+#   ctrl/env.d/<profile>   cluster shape — OPTIONAL, examples ship as *.env.example
 #   ctrl/.env              machine-local values and secrets   (gitignored)
-#   the caller's env       `make cluster up PROFILE=client`   (always wins)
+#   the caller's env       `make cluster up PROFILE=<name>`   (always wins)
 #
 # That last rule is why this is more than a few `source` lines: .env sets
 # PROFILE, so without snapshotting it would silently override the PROFILE the