66 lines
2.8 KiB
Markdown
66 lines
2.8 KiB
Markdown
# FlowerCore Apple MDM Infra
|
|
|
|
This app hosts the private NanoHUB bootstrap service for FlowerCore iPad
|
|
management at `https://mdm.iamworkin.lan`.
|
|
|
|
## Runtime Shape
|
|
|
|
- Namespace: `fc-apple-mdm`
|
|
- Host: `mdm.iamworkin.lan`
|
|
- Image: `localhost/fc-apple-mdm-nanohub:v0.2.0-20260617`
|
|
- Upstream baseline: NanoHUB `v0.2.0`, published 2025-12-25
|
|
- Persistent data: `fc-apple-mdm-data` mounted at `/var/lib/nanohub`
|
|
- NanoHUB file backend root: `/var/lib/nanohub/db`
|
|
- Runtime secret: `OnePasswordItem/fc-apple-mdm-runtime`
|
|
- Required secret field: `NANOHUB_API_KEY`
|
|
- Optional secret field: `NANOHUB_WEBHOOK_URL`
|
|
|
|
NanoHUB listens on HTTP `:9004` inside the pod; Traefik owns TLS using
|
|
`Certificate/fc-apple-mdm-tls`. The public route intentionally exposes only
|
|
`/mdm`, `/checkin`, and `/version`. The NanoHUB APIs under `/api/v1/*` stay
|
|
cluster-internal for MDM-N1 and are intended for the FlowerCore
|
|
DeviceManagement bridge.
|
|
|
|
## NanoHUB Endpoints
|
|
|
|
- Device command/report and default check-in endpoint: `/mdm`
|
|
- Separate check-in endpoint enabled by `NANOHUB_CHECKIN=true`: `/checkin`
|
|
- Health/version endpoint: `/version`
|
|
- Internal NanoMDM API: `/api/v1/nanomdm/`
|
|
- Internal NanoCMD API: `/api/v1/nanocmd/`
|
|
- Internal KMFDDM API: `/api/v1/ddm/`
|
|
|
|
NanoHUB API authentication is HTTP Basic with username `nanohub` and password
|
|
from `NANOHUB_API_KEY`.
|
|
|
|
## Operator Gates
|
|
|
|
1. Create `FlowerCore Apple MDM Runtime` in the `IAmWorkin` 1Password vault with
|
|
field `NANOHUB_API_KEY`. Add `NANOHUB_WEBHOOK_URL` only after the
|
|
DeviceManagement Nano bridge endpoint is live.
|
|
2. Add or confirm `mdm.iamworkin.lan -> 10.0.56.200` in FlowerCore.DNS/pfSense
|
|
before cert-manager syncs the certificate.
|
|
3. Mirror or build the pinned NanoHUB image, then import it on every schedulable
|
|
RKE2 node:
|
|
|
|
```bash
|
|
podman pull --arch arm64 ghcr.io/micromdm/nanohub:latest@sha256:e36a50db2dc3d2bf736645e58712f622c04b05b28487390981905ef4d0be5fbd
|
|
podman tag ghcr.io/micromdm/nanohub@sha256:e36a50db2dc3d2bf736645e58712f622c04b05b28487390981905ef4d0be5fbd localhost/fc-apple-mdm-nanohub:v0.2.0-20260617
|
|
podman save localhost/fc-apple-mdm-nanohub:v0.2.0-20260617 -o fc-apple-mdm-nanohub-v0.2.0-20260617.tar
|
|
# copy to each RKE2 node, then:
|
|
sudo ctr -n k8s.io images import fc-apple-mdm-nanohub-v0.2.0-20260617.tar
|
|
```
|
|
|
|
If GHCR changes or becomes unavailable, rebuild/import from
|
|
`nanohub-linux-arm64-v0.2.0.zip` with SHA-256
|
|
`b05968322a9bc34e79169ebee28d16554046f981eaee48a12cf80899f51a9dbd`.
|
|
|
|
4. Sync the ArgoCD app and prove `https://mdm.iamworkin.lan/version`.
|
|
|
|
## Support Boundary
|
|
|
|
This MDM-N1 lane deploys the protocol substrate only. It does not create an APNs
|
|
MDM push certificate, enrollment profile, SCEP/device identity service, managed
|
|
Wi-Fi payload, managed app install, or supervised iPad enrollment. Those stay in
|
|
MDM-N2 through MDM-N8.
|