config.yml

# ct --platform custom < ./config.yml | jq > ignition.json
systemd:
  units:
    - name: update-engine.service
      enable: true
    - name: etcd-member.service
      enable: true
    - name: locksmithd.service
      enable: true
      dropins:
        - name: custom.conf
          contents: |
            [Service]
            Environment=LOCKSMITHD_ENDPOINT=http://127.0.0.1:3333
            Environment=LOCKSMITHD_GROUP=default
            Environment=LOCKSMITHD_ID=12345
            ExecStart=
            ExecStart=/home/core/locksmithd
    - name: coreos-metadata.service
      enable: true
      contents: |
        [Install]
        WantedBy=multi-user.target

        [Unit]
        After=nss-lookup.target
        After=network-online.target
        Wants=network-online.target

        [Service]
        Type=oneshot
        Environment=OUTPUT=/run/metadata/flatcar
        ExecStart=/usr/bin/mkdir --parent /run/metadata
        ExecStart=/usr/bin/bash -c 'echo "COREOS_CUSTOM_PRIVATE_IPV4=10.0.2.15\nCOREOS_CUSTOM_PUBLIC_IPV4=10.0.2.15\n" > ${OUTPUT}'
        ExecStartPost=/usr/bin/ln -fs /run/metadata/flatcar /run/metadata/coreos
    - name: airlock.service
      enable: true
      contents: |
        [Install]
        WantedBy=multi-user.target

        [Unit]
        After=etcd-member.service
        Requires=etcd-member.service

        [Service]
        Type=fork
        ExecStartPre=-/usr/bin/docker stop airlock
        ExecStartPre=-/usr/bin/docker pull quay.io/coreos/airlock:main
        ExecStart=/usr/bin/docker \
          run \
          --rm \
          --network host \
          --name  airlock \
          -v "/opt/config.toml:/etc/airlock/config.toml:ro" \
          quay.io/coreos/airlock:main \
          airlock serve -vv
locksmith:
  reboot_strategy: etcd-lock
storage:
  files:
    - path: /opt/config.toml
      filesystem: root
      contents:
        inline: |
          # Status service configuration
          [status]
          enabled = true
          address = "127.0.0.1"
          port = 2222
          tls = false

          # Main service configuration
          [service]
          address = "127.0.0.1"
          port = 3333
          tls = false

          # Etcd-v3 client configuration
          [etcd3]
          endpoints = [ "http://127.0.0.1:2379" ]

          # Lock configuration, base reboot group
          [lock]
          default_group_name = "default"
          default_slots = 2

          # Lock configuration, additional reboot groups
          [[lock.groups]]
          name = "workers"

          [[lock.groups]]
          name = "controllers"
          slots = 1
      mode: 0644