# FlowerCore Apple MDM Infra

This app hosts the private NanoHUB bootstrap service for FlowerCore iPad
management at `https://mdm.iamworkin.lan`.

## Runtime Shape

- Namespace: `fc-apple-mdm`
- Host: `mdm.iamworkin.lan`
- Image: `localhost/fc-apple-mdm-nanohub:v0.2.0-20260617`
- Upstream baseline: NanoHUB `v0.2.0`, published 2025-12-25
- Persistent data: `fc-apple-mdm-data` mounted at `/var/lib/nanohub`
- NanoHUB file backend root: `/var/lib/nanohub/db`
- Runtime secret: `OnePasswordItem/fc-apple-mdm-runtime`
- Required secret field: `NANOHUB_API_KEY`
- Optional secret field: `NANOHUB_WEBHOOK_URL`

NanoHUB listens on HTTP `:9004` inside the pod; Traefik owns TLS using
`Certificate/fc-apple-mdm-tls`. The public route intentionally exposes only
`/mdm`, `/checkin`, and `/version`. The NanoHUB APIs under `/api/v1/*` stay
cluster-internal for MDM-N1 and are intended for the FlowerCore
DeviceManagement bridge.

## NanoHUB Endpoints

- Device command/report and default check-in endpoint: `/mdm`
- Separate check-in endpoint enabled by `NANOHUB_CHECKIN=true`: `/checkin`
- Health/version endpoint: `/version`
- Internal NanoMDM API: `/api/v1/nanomdm/`
- Internal NanoCMD API: `/api/v1/nanocmd/`
- Internal KMFDDM API: `/api/v1/ddm/`

NanoHUB API authentication is HTTP Basic with username `nanohub` and password
from `NANOHUB_API_KEY`.

## Operator Gates

1. Create `FlowerCore Apple MDM Runtime` in the `IAmWorkin` 1Password vault with
   field `NANOHUB_API_KEY`. Add `NANOHUB_WEBHOOK_URL` only after the
   DeviceManagement Nano bridge endpoint is live.
2. Add or confirm `mdm.iamworkin.lan -> 10.0.56.200` in FlowerCore.DNS/pfSense
   before cert-manager syncs the certificate.
3. Mirror or build the pinned NanoHUB image, then import it on every schedulable
   RKE2 node:

   ```bash
   podman pull --arch arm64 ghcr.io/micromdm/nanohub:latest@sha256:e36a50db2dc3d2bf736645e58712f622c04b05b28487390981905ef4d0be5fbd
   podman tag ghcr.io/micromdm/nanohub@sha256:e36a50db2dc3d2bf736645e58712f622c04b05b28487390981905ef4d0be5fbd localhost/fc-apple-mdm-nanohub:v0.2.0-20260617
   podman save localhost/fc-apple-mdm-nanohub:v0.2.0-20260617 -o fc-apple-mdm-nanohub-v0.2.0-20260617.tar
   # copy to each RKE2 node, then:
   sudo ctr -n k8s.io images import fc-apple-mdm-nanohub-v0.2.0-20260617.tar
   ```

   If GHCR changes or becomes unavailable, rebuild/import from
   `nanohub-linux-arm64-v0.2.0.zip` with SHA-256
   `b05968322a9bc34e79169ebee28d16554046f981eaee48a12cf80899f51a9dbd`.

4. Sync the ArgoCD app and prove `https://mdm.iamworkin.lan/version`.

## Support Boundary

This MDM-N1 lane deploys the protocol substrate only. It does not create an APNs
MDM push certificate, enrollment profile, SCEP/device identity service, managed
Wi-Fi payload, managed app install, or supervised iPad enrollment. Those stay in
MDM-N2 through MDM-N8.