{{define "fleet_byo"}}{{template "top" .}}
{{if .Flash}}<p class="banner">{{.Flash}}</p>{{end}}
{{if .FlashErr}}<p class="banner error">{{.FlashErr}}</p>{{end}}
<div class="pagehead">
  <p class="eyebrow">Fleet · {{.Account.Name}}</p>
  <h1>Bring your own fleet</h1>
  <p class="lede">Run your apps on hardware you own. Your boxes dial out to the platform over an
  outbound tunnel; nothing ever connects in.</p>
</div>

<h2>What you need</h2>
<ul>
  <li>A Linux box, arm64 or amd64, that can reach the internet outbound.</li>
  <li>An object-storage bucket you own for the fleet's data.</li>
  <li>Nothing listens inbound, ever — no port to open, no firewall rule to punch a hole in.</li>
</ul>

<h2>Create the fleet</h2>
<p>From a terminal signed in to this console:</p>
<pre><code>carlos fleets create -bucket &lt;your-bucket&gt; &lt;name&gt;
carlos fleets add-box &lt;name&gt; &lt;label&gt;</code></pre>
<p class="small">(shown once — the console does not store or re-show the plaintext)</p>
<p class="small">ROTATION IS NOT REVOCATION: this refuses the box's NEXT dial-in with the OLD
token, but does NOT evict a channel it already holds — a COMPROMISED box needs Detach, not
another Rotate.</p>

<h2>Configure the box</h2>
<p>On the box, in a root-owned env file the agent's unit loads (see Hardening below):</p>
<pre><code>AWS_SHARED_CREDENTIALS_FILE=/etc/carlos/credentials
CARLOS_HIBERNATE_BUCKET=&lt;your-bucket&gt;
CARLOS_FLEET=&lt;name&gt;
CARLOS_FLEET_BOX=&lt;label&gt;
CARLOS_REGION=fleet/&lt;name&gt;
CARLOS_RELEASE_PUBKEY=&lt;this deployment's release public key&gt;
CARLOS_TUNNEL_URL=&lt;this deployment's tunnel address&gt;
CARLOS_TUNNEL_TOKEN=&lt;from carlos fleets add-box &lt;name&gt; &lt;label&gt; — shown once&gt;
CARLOS_TUNNEL_NAME=&lt;name&gt;/&lt;label&gt;</code></pre>
<p class="small">Release pointers are Ed25519-signed; without <code>CARLOS_RELEASE_PUBKEY</code> the
box has no key to verify against and refuses to adopt anything.</p>
<p class="small"><code>CARLOS_FLEET_BOX</code> is optional and defaults from
<code>CARLOS_TUNNEL_NAME</code>'s label half. <code>AWS_SHARED_CREDENTIALS_FILE</code> points at
an access key for the bucket above — <strong>your own bucket only</strong> — written root-owned
mode 600 alongside the env file.</p>
<p class="small">No <code>CARLOS_DEPLOYMENT_BUCKET</code>, and no AWS credentials for the
platform's own bucket, belong in this file at all: the box reads its app releases and writes its
heartbeats through the console's edge, over HTTPS, using the same tunnel token it already dials
in with — not a bucket-level AWS grant.</p>
<p class="small">Optional override: <code>CARLOS_STATUS_PREFIX=fleets/&lt;name&gt;/</code> — the box
defaults to this on its own; set it explicitly only if you're pointing status/heartbeats
somewhere non-standard.</p>

<h3>Legacy direct-S3 (grandfathered)</h3>
<p class="small">A box still running a pre-fleet-API agent build needs
<code>CARLOS_DEPLOYMENT_BUCKET</code> set to the platform's own deployment bucket, plus an AWS
credential granting it RW there, in addition to the hibernate-bucket vars above. New boxes should
not be configured this way — it is kept working for boxes that haven't upgraded yet, not as a
choice.</p>

<h2>Hardening</h2>
<ul>
  <li>Run the agent as a dedicated non-root user, not root.</li>
  <li>Make the env file root-owned, mode 600 — it holds the tunnel token.</li>
  <li>Default-deny inbound on the box's firewall; it only ever dials out.</li>
  <li>Turn on unattended security upgrades.</li>
  <li>Keep the clock sane — chrony or systemd-timesyncd; leases compare timestamps.</li>
  <li>Run the agent under a systemd unit with <code>ProtectSystem=strict</code> and
  <code>NoNewPrivileges=yes</code> — see <code>internal/host/units/</code> in the platform repo
  for the reference shapes.</li>
  <li>Rotate the token if it may have leaked. If the box itself may be compromised,
  <strong>Detach</strong> it instead — rotating only refuses its next dial-in, it does not evict
  a channel the box already holds.</li>
</ul>

<h2>Then</h2>
<p>The box appears on your fleet page within minutes — it self-reports on a heartbeat cadence, not
instantly. From there, place an app on it with <code>carlos apps place</code> or from the app's
Instances tab.</p>
{{template "bottom" .}}{{end}}