Fleet¶

Device management. Currently marked "scope to be confirmed" — see the classification plan.


Runtime	Container (Docker Swarm), 3 containers: fleet, db, redis
Tier	Experimental
Node	swarm-media
Image	`fleetdm/fleet:v4.89.1`; `mysql:8.4`; `redis:7-alpine`
URL	`https://fleet.lab.riversfamily.uk`
Auth	Native SAML (manual post-deploy step, see below)
Source	`ansible/stacks/experimental/fleet/`

Custom entrypoint: sh -c "fleet prepare db --no-prompt && fleet serve".

Configuration¶

SAML is not read from env or a mounted file at boot — Fleet stores it as database AppConfig. The Authentik side is the declarative fleet-saml blueprint; the Fleet side is applied post-deploy against the running server using the rendered org settings template (ansible/stacks/experimental/fleet/fleet-sso.yml.j2):

fleetctl gitops -f /opt/stacks/fleet/fleet-sso.yml

Volumes¶

Volume	Path	Backing	Contents
`database`	`/var/lib/mysql`	Local	MySQL data — never NFS

redis has no persistent volume.

Networking¶

fleet joins both the shared traefik network (for its Traefik route) and this stack's private internal network. db and redis join internal only — they are unreachable from every other stack.

Secrets¶

Vault variable	Delivered as	Purpose
`vault_fleet_mysql_password`	Swarm secret (`MYSQL_PASSWORD_FILE` on `db`; `FLEET_MYSQL_PASSWORD` inline on `fleet`)	MySQL password
`vault_fleet_server_private_key`	Plain env var (`FLEET_SERVER_PRIVATE_KEY`), must be exactly 32 bytes	Fleet server private key

db also sets MYSQL_RANDOM_ROOT_PASSWORD: "yes".

Gotchas¶

Deferred tier. This stack's vault_* variables live in the [DEFERRED] block of vault.yml.example, not yet part of the live deploy — populate them before swarm-media is brought online.
SAML org settings need the manual fleetctl gitops step above after every deploy where the Fleet database is fresh.