init rig

rig/ctrl/.env.example

@@ -0,0 +1,50 @@
+# Machine-local config. Copy to ctrl/.env (gitignored) and edit.
+# Cluster SHAPE lives in ctrl/env.d/<profile>.env — not here.
+# The architecture MODEL lives in arch/<name>.json — not here either.
+
+# Which profile in ctrl/env.d/ to build. minimal | client | offline
+PROFILE=minimal
+
+# Cluster name; the kubectl context becomes kind-<CLUSTER>.
+# LEAVE THIS UNSET unless you need a name that differs from the directory —
+# it defaults to this folder's name, which is what makes the folder copyable:
+# copy it, rename it, and you get a separate environment with no edits.
+# CLUSTER=
+
+# Host ports. LEAVE UNSET — they derive from the directory name so several
+# environments coexist without negotiating (see ctrl/ports.sh). `make ports`
+# shows this environment's block; `make ports persist` writes it here so it stops
+# being derived and becomes fixed. Set a value only to override.
+# HTTP_PORT=
+# HTTPS_PORT=
+# TILT_PORT=
+# REGISTRY_PORT=
+
+# Where the application manifests live. The real ones are expected to be
+# versioned separately from this installer — they change on a different cadence,
+# by different people. Repoint this at their repo and rig stops owning them:
+#   MANIFESTS_DIR=../platform-manifests/overlays/dev
+MANIFESTS_DIR=ctrl/k8s/overlays/dev
+
+# Where the wizard fetches the pinned binaries from.
+#   upstream    GitHub releases / dl.k8s.io  (needs internet)
+#   artifactory a generic repo — what a locked-down client usually allows
+#   baked       already inside the wizard image; no network at all
+DEPS_SOURCE=upstream
+DEPS_ARTIFACTORY_URL=
+
+# --- Registry -------------------------------------------------------------
+# Mode comes from the profile (REGISTRY_MODE). These are the secrets it needs.
+# Required for mirror/remote:
+REGISTRY_REMOTE_URL=
+REGISTRY_USER=
+REGISTRY_PASSWORD=
+
+# Corporate root CA, if Artifactory is fronted by an internal CA (it usually is).
+# Trust has to reach THREE places and nothing does it for you: the host docker
+# daemon, every kind node's containerd, and any in-cluster client. registry.sh
+# handles the first two; station.sh reports when it's configured but not trusted.
+# Symptom when missing: x509: certificate signed by unknown authority
+REGISTRY_CA_FILE=
+
+# (The local registry's host port is part of the derived block above.)