mirror of
https://github.com/imjasonh/esp32
synced 2026-07-06 23:52:24 +00:00
Jason Hall
01c8c2da75
Two related additions for fleet observability + tunability:
1. `[ota]` block in provisioning.toml. Optional, individually-optional
fields: `repo`, `tag`, `poll_secs`. Writes to the existing `ota` NVS
namespace (key names match src/ota.rs's NVS_REPO / NVS_TAG /
NVS_POLL_SECS). Missing keys leave the firmware on its compile-time
defaults (ghcr.io/imjasonh/esp32:latest, 60 s poll).
2. `fw_version` (the GIT_SHA baked in at build time) on every log
entry and every metric series, so behaviour can be correlated with
a release across the fleet.
- cloud_log: jsonPayload.fw_version on every entry.
- metrics: metric.labels.fw_version on every TimeSeries (resource
labels can't carry it — `generic_node` has a fixed schema; metric
labels let queries split heap, rssi, etc. by fw).
Both threaded from main.rs's existing FW_VERSION constant; no new
config plumbing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
51 lines
2.2 KiB
Text
51 lines
2.2 KiB
Text
# Provisioning config for `make provision`. Copy to `provisioning.toml`
|
|
# (gitignored) and fill in your values, then `make provision` to write
|
|
# everything to the device's NVS partition over USB.
|
|
|
|
[wifi]
|
|
ssid = "your-wifi-ssid"
|
|
pass = "your-wifi-password"
|
|
|
|
[trust]
|
|
# Bundled Sigstore Fulcio root + intermediate CA PEMs. These come from
|
|
# https://github.com/sigstore/root-signing/tree/main/targets and need to
|
|
# be re-fetched + re-provisioned if Sigstore rotates them (rare).
|
|
fulcio_root_pem = "trust/fulcio_root.pem"
|
|
fulcio_intermediate_pem = "trust/fulcio_intermediate.pem"
|
|
|
|
# Allowlist of (identity, issuer) pairs the OTA verifier accepts as
|
|
# signers of incoming firmware. Identity is the SAN value in the Fulcio
|
|
# leaf cert — an rfc822Name (email) for OIDC issuers like Google, or a
|
|
# URI for workflow-based issuers like GitHub Actions.
|
|
|
|
# Manual `make publish` from a developer machine.
|
|
[[trust.identities]]
|
|
identity = "imjasonh@gmail.com"
|
|
issuer = "https://accounts.google.com"
|
|
|
|
# Automated publishes from the GHA workflow on push to main.
|
|
[[trust.identities]]
|
|
identity = "https://github.com/imjasonh/esp32/.github/workflows/publish.yml@refs/heads/main"
|
|
issuer = "https://token.actions.githubusercontent.com"
|
|
|
|
# Optional. If absent, the device boots with serial-only logging and
|
|
# never tries to talk to GCP. Uncomment + fill in to enable shipping
|
|
# tracing events (app + OTA) to Google Cloud Logging and chip-health
|
|
# metrics (heap, stack, wifi, cpu, uptime, …) to Cloud Monitoring.
|
|
#
|
|
# [gcp]
|
|
# project_id = "my-logs-project"
|
|
# sa_email = "esp32-logger@my-logs-project.iam.gserviceaccount.com"
|
|
# sa_key_id = "abc123..." # the `private_key_id` field from the SA JSON key
|
|
# sa_key_pem = "gcp-sa-key.pem" # path to the PKCS#8 RSA private key PEM
|
|
# min_severity = "info" # trace / debug / info / warn / error
|
|
# metrics_interval_secs = 300 # 0 = metrics off (logs still ship); default 300
|
|
|
|
# Optional. If absent, OTA loop uses compile-time defaults
|
|
# (ghcr.io/imjasonh/esp32:latest, 60 s poll). Each field is
|
|
# individually optional too — only present ones override.
|
|
#
|
|
# [ota]
|
|
# repo = "ghcr.io/imjasonh/esp32" # default
|
|
# tag = "latest" # default
|
|
# poll_secs = 600 # default 60; bump for steady-state fleets
|