Skip to content

docs(console): match the quoted node console output to the restyled screens #101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Bugs5382 merged 3 commits into from
Oct 7, 2026
Merged

docs(console): match the quoted node console output to the restyled screens #101

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cfe6bfd
docs(console): match the quoted node console output to the restyled s…
Bugs5382 Oct 2, 2026
2c2bde5
docs(console): trim the boot frame to the three steps the golden shows
Bugs5382 Oct 7, 2026
a8d9b31
docs(console): restore all five boot stages in the QEMU frame
Bugs5382 Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions docs/install-deploy/boot-maintenance.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,15 +38,16 @@ Maintenance mode accepts connections **without any authentication**. Whoever rea

```text
Awaiting configuration

Run: cryptosctl config apply

Address 192.0.2.50

Mgmt SHA-256 2D71 1642 B726 B044 0162 7CA9 FBAC 32F5
C853 0FB1 903C C4DB 0225 8717 921A 4881
check 1/2: compare with the web console
```

The two lines appear once DHCP has answered and the management API is up. A node with more than one address lists each one on its own line.
The address and the fingerprint appear once DHCP has answered and the management API is up. A node with more than one address lists each one on its own line. **check 1/2** marks the first of the two fingerprint checks in a Fleet Manager adoption; the second is on the installed node's console after it reboots.

There is no TPM, no encrypted disk, no database and no CA key yet. The only useful things the node can do in this state are report its status and accept a config.

Expand Down
7 changes: 5 additions & 2 deletions docs/install-deploy/reboot-ceremony.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,13 +37,16 @@ Once the node is up, its console (the physical screen or the hypervisor console)

```text
Awaiting ceremony

Fetch trust, then start the ceremony

Mgmt SHA-256 2D71 1642 B726 B044 0162 7CA9 FBAC 32F5
C853 0FB1 903C C4DB 0225 8717 921A 4881
check 2/2: compare with the web console
Mgmt cert self-signed, compare the fingerprint
```

**check 2/2** is the second fingerprint check of a Fleet Manager adoption. Without a Fleet Manager, compare the fingerprint with `trust fetch --expect-sha256` as below.

The fingerprint is shown in the same form after the ceremony, on the serving dashboard. It changes on every boot, like the certificate.

The title and hint follow the node's state until it has its CA:
Expand Down Expand Up @@ -175,7 +178,7 @@ That certificate:
The self-signed pin in `node-trust.pem` no longer matches once the ceremony commits. Any call with it fails with `x509: certificate signed by unknown authority`. Follow the steps below instead of fetching the old certificate again.
:::

The serving dashboard shows the change under the fingerprint:
The serving dashboard shows the change under the fingerprint: the **Mgmt cert** line changes from `self-signed, compare the fingerprint` to:

```text
Mgmt SHA-256 ....
Expand Down
24 changes: 18 additions & 6 deletions docs/try-it-locally/boot-qemu.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ This terminal is now the node's serial console. The flags are the ones the integ

## 7. Watch the first boot

The console shows the CryptOS banner, then each boot stage as it finishes. The debug image also prints the detailed kernel and init log in between.
The console shows the CryptOS mark and the version, then each boot stage as it finishes. The debug image also prints the detailed kernel and init log in between.

1. **state volume.** The `cryptos-state` partition is empty, so the node formats it as an encrypted LUKS2 volume, seals the key to the TPM, and creates a filesystem inside it.
2. **configuration.** The node reads `EFI/cryptos/machine.yaml`, saves it inside the encrypted volume, and deletes the staged copy.
Expand All @@ -199,11 +199,23 @@ The console shows the CryptOS banner, then each boot stage as it finishes. The d
Each stage is marked `[ok]` as it finishes, mixed in with the detailed log lines. When **management API** is marked, the node is up and waiting for its ceremony, and the console moves on to the node's dashboard.

```text
[ok] state volume
[ok] configuration
[ok] network
[ok] embedded etcd
[ok] management API
.-----. | .-----.
| | |
| | |
| .--+--. |
| |#####| |
| |#####| |
| '-----' |
| |
'---------------'

CryptOS PKI v0.1.0

[ok] state volume
[ok] configuration
[ok] network
[ok] embedded etcd
[ok] management API
```

A stage marked `[!!]` failed. The boot stops there and the node restarts; there is no shell to fall back to.
Expand Down
Loading