Enrollment

README.md

@@ -32,6 +32,41 @@ Users belong to many organizations via the `memberships` table (a role per org).
 `/cloud` lists the signed-in user's orgs (or redirects when there's exactly one);
 `/cloud/{organization_guid}` renders an org the user is a member of (403 otherwise).
 
+## Install
+
+One-liner for Debian/Ubuntu and Fedora/RHEL-family servers (needs systemd):
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/quartzsystems/quartz-command/main/scripts/install.sh | sudo bash
+```
+
+The script installs PostgreSQL from the distro repos, creates the `quartz`
+role and `quartz_command` database with a random password, installs the latest
+released `.deb`/`.rpm`, writes `/etc/quartz-command/backend.env`, seeds a
+default admin (credentials are printed once at the end), and starts the
+`quartz-command-backend` and `quartz-command-frontend` services. Pin a release
+with `QC_VERSION=x.y.z`; re-running upgrades the package without touching an
+existing database or config.
+
+The console is served at **`https://<host>/`** — the installer puts nginx on
+:443 as a TLS terminator (self-signed certificate, so the browser warns once)
+in front of the loopback-only frontend, and opens 443 in firewalld/ufw when
+active. To use a real certificate, replace
+`/etc/quartz-command/tls/{cert,key}.pem` and `systemctl reload nginx`.
+
+### Update
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/quartzsystems/quartz-command/main/scripts/update.sh | sudo bash
+```
+
+Upgrades the package to the latest release without touching the database or
+your edited config files, restarts the backend first (migrations run on
+startup) and verifies `/api/health` before restarting the frontend. On
+failure it prints a pinned rollback one-liner. `QC_VERSION=x.y.z` targets a
+specific release; add `QC_ALLOW_DOWNGRADE=1` to roll back (schema migrations
+are forward-only — don't roll back across a release that migrated).
+
 ## Development
 
 1. **Database** — run PostgreSQL yourself (local install, managed service, etc.),

backend/.env.example

@@ -23,6 +23,29 @@ QC_SESSION_HOURS=24
 QC_JWT_SECRET_FILE=./data/jwt.secret
 QC_ADMIN_JWT_SECRET_FILE=./data/admin-jwt.secret
 
+# ── Device gateway (gRPC) ────────────────────────────────────────────────────
+# Address the device gateway (enrollment + mTLS device services) binds to.
+#QC_GRPC_LISTEN=127.0.0.1:8443
+
+# Public host:port devices reach the gateway at — embedded in enrollment
+# tokens and returned as assigned_gateway. Defaults to QC_GRPC_LISTEN (dev
+# only); set this to the real DNS name in any deployment.
+#QC_GATEWAY_ADDR=gateway.example.com:8443
+
+# Directory holding the internal device CA (key + cert, generated on first
+# run). Device client certs are issued from this CA.
+#QC_DEVICE_CA_DIR=./data/device-ca
+
+# Gateway TLS server cert/key (PEM). Set both to serve TLS with optional
+# client certs (required for cert renewal); leave unset for a plaintext dev
+# listener (enrollment works, mTLS device services are disabled).
+#QC_GRPC_TLS_CERT_FILE=
+#QC_GRPC_TLS_KEY_FILE=
+
+# Cert (PEM or DER) of the CA that issued the gateway's TLS cert; its SHA-256
+# goes into enrollment tokens. Defaults to the device CA cert.
+#QC_GATEWAY_CA_FILE=
+
 # ── Default admin ────────────────────────────────────────────────────────────
 # Seeded on startup ONLY when the `admins` table is empty. Use it to get into
 # /admin/login on a fresh database, then change the password. Leave unset to