# boot_custom_encrypted_os configuration: copy to .env and edit.
# Builds Ubuntu 26.04 (resolute); this tool is Debian/Ubuntu-specific.

# SSH target (the CC VM)
REMOTE="root@<instance-ip>"

# SSH public key injected into the image + used for initramfs login.
SSH_KEY="${SSH_KEY:-$(cat ~/.ssh/id_ed25519.pub 2>/dev/null)}"

# LUKS passphrase for the encrypted root (build + unlock). Keep this file private.
LUKS_PASS="change-me"

SSH_OPTS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR"

# --- attestation ---
ATTEST_PORT=9000
# encrypted_03_attest_and_unlock.sh auto-derives the vCPU count/signature and the kernel
# cmdline (APPEND) from the running guest over SSH (like measured_boot/measure_boot.sh).
# Export any of these to override the derivation:
#   VCPUS  VCPU_FAMILY  VCPU_MODEL  VCPU_STEPPING  APPEND  OVMF  KERNEL  INITRD
# Gotcha: the vCPU signature is the GUEST-visible value: QEMU's virtual EPYC-Turin
# presents family 26 / model 0 / stepping 0 (rdx=0x00B00F00), NOT the host silicon's
# model 2 / stepping 1. Deriving from the guest's /proc/cpuinfo gets this right.

# CMDLINE is baked into /boot by encrypted_00_build_image.sh; encrypted_03 reads the live cmdline instead.
# Verda re-syncs root=UUID to the partition holding sbin/init|lib/systemd (our /boot marker)
CMDLINE="console=ttyS0 root=UUID=3a07f580-a938-4f98-a438-e7449a36ed7a ro net.ifnames=0 biosdevname=0 fsck.mode=auto fsck.repair=yes pci=realloc,nocrs"

# --- image layout UUIDs (cc-template fixed values) ---
BOOT_FS_UUID="3a07f580-a938-4f98-a438-e7449a36ed7a"   # /boot partition -> becomes cmdline root=UUID
ROOT_FS_UUID="05b81e80-54a9-42c9-a3e5-871ea3ec627d"   # decrypted root fs (cosmetic; fstab uses the mapper)
ESP_VOLID="3DAB345B"                                  # -> UUID=3DAB-345B