YOUreka/tools-legacy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(fpagent): document the one-line installer and its key

Browse Source
This commit is contained in:
adebisi-fa
2026-10-02 09:53:35 +01:00
parent b3b75ffac0
commit 6d3909c334
2 changed files with 38 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+29 -8
View File
@@ -42,6 +42,8 @@ tools/
├── cropper.js # /cropper router (queue, review, save) — injectable clients
├── public/
│ ├── index.html # landing page shell (tiles injected per session)
│ ├── fpagent/
│ │ └── install.sh # public /fpagent/install.sh (proxies private releases)
│ └── assets/
│ ├── style.css # shared Carbon-styled layout + g100 theme
│ ├── help.html # /help docs page
@@ -119,9 +121,10 @@ record, crop the photo, optionally **Clean background**, then accept or reject
with reasons. Reads may use the cached `crop_image` verdict; saving re-verifies
live and uploads through the queue.
Its service credentials are the **only** environment variables this app uses.
They live in dotenvx-encrypted files at the repository root — `.env` for
development, `.env.production` for deployment:
Its service credentials live in dotenvx-encrypted files at the repository root
— `.env` for development, `.env.production` for deployment. The fpagent
installer key is read from the same files (see
[Installing the agent](#installing-the-agent)):
```sh
MINIO_ACCESS_KEY=… MINIO_SECRET_KEY=…
@@ -149,13 +152,31 @@ The `/fingerprint` wizard walks the operator through:
travel with every `fprint-enroll` to fpagent.
3. **Save** — both templates are posted to a2loft with a fresh OTP.
### Installing the agent
`/fpagent/install.sh` is a public installer (also served for `curl | bash`). It
fetches the newest bundle from the private
[`fingerprint-agent`](https://sources.yrka.app/YOUreka/fingerprint-agent/releases)
forge, verifies its sha256, then runs the bundle's own installer, which handles
libfprint, the udev rule, `plugdev` and the systemd service. On a field laptop:
```sh
curl -fsSL https://tools.yrka.app/fpagent/install.sh | bash -s -- --enable-service
curl -fsSL https://tools.yrka.app/fpagent/install.sh | bash -s -- --check # report only
```
The forge is private, so the operator's laptop needs no credentials: the app
reads the release with `GITEA_RELEASE_INSTALL_KEY` and proxies it through
`/fpagent/releases/*`. Without that key the installer answers `503`.
## Configuration
Everything except the cropper credentials is hardcoded in `tools/server.js` by
design — port `4173`, portal `https://portal.yrka.app`, PocketBase
`https://pb.itcass.net`, a2loft `https://apis.a2loft.net`, agent
`http://127.0.0.1:9000`, and the domain catalog. Change them there; there are no
other environment variables or config files.
Everything except the credentials is hardcoded in `tools/server.js` by design —
port `4173`, portal `https://portal.yrka.app`, PocketBase `https://pb.itcass.net`,
a2loft `https://apis.a2loft.net`, agent `http://127.0.0.1:9000`, forge
`https://sources.yrka.app` and the domain catalog. Change them there. The only
environment variables are the cropper credentials and the fpagent installer key
`GITEA_RELEASE_INSTALL_KEY` above.
## Deployment