Struct RenderInput 

pub struct RenderInput<'a> {
    pub machine: &'a MachineConfig,
    pub yubaba_url: String,
    pub yubaba_sha256: String,
    pub yubaba_channel: String,
    pub headscale_preauth_key: Option<String>,
    pub mesh_url: Option<String>,
    pub cloudflared_token: Option<String>,
    pub yubaba_cosign_identity_regexp: Option<String>,
}

Inputs needed to render mirror.yml for a single machine.

Fields

machine: &'a MachineConfig

yubaba_url: String

HTTPS URL of the yah-yubaba release tar.gz (e.g. a GitHub release asset published by .github/workflows/release.yml). Cloud-init’s runcmd downloads it, verifies sha256 against Self::yubaba_sha256, extracts, and installs /usr/local/bin/yubaba. Use PLACEHOLDER_YUBABA_URL for dry-run previews.

yubaba_sha256: String

Lowercase hex sha256 of the tar.gz at yubaba_url. Cloud-init verifies this with sha256sum -c - against the downloaded archive and fails the boot if it doesn’t match.

yubaba_channel: String

Release channel passed to yah-yubaba serve --channel. One of "stable" or "beta". Use DEFAULT_YUBABA_CHANNEL for Phase 1.

headscale_preauth_key: Option<String>

Headscale pre-auth key. Some ⟺ this machine is joining an existing mesh: the renderer emits the tailscaled install + tailscale up join block (gated on this being Some, see render). None ⟺ standalone / coordinator-to-be — no mesh to join yet, so no join block is emitted (the node becomes the coordinator later via yah mesh bootstrap).

mesh_url: Option<String>

Stable URL of the Headscale coordinator (https://mesh.<domain>). When set (R040-F18), the rendered cloud-init passes --login-server <url> to tailscale up so the new machine joins the camp’s Headscale instead of Tailscale SaaS. When None, the {{MESH_LOGIN_SERVER_ARG}} placeholder is replaced with an empty string, preserving the existing Tailscale SaaS behaviour.

cloudflared_token: Option<String>

Cloudflare Tunnel token for cloudflared service install --token .... None → no cloudflared install (mesh-only node). When Some, the renderer emits the full cloudflared apt-repo install + service enable block into runcmd in place of {{CLOUDFLARED_BLOCK}}.

yubaba_cosign_identity_regexp: Option<String>

When Some, render the cosign install + cosign verify-blob runcmd block into {{COSIGN_VERIFY_BLOCK}}, gating the yubaba tarball on a keyless OIDC signature whose certificate identity matches this regexp (e.g. ^https://github\.com/yah-ai/yah/). The sha256 check stays in parallel as belt-and-suspenders (R330-F20, W203 §1.4). When None the placeholder substitutes to an empty string and the bootstrap stays on the sha256-only path.

Trait Implementations

impl<'a> Debug for RenderInput<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.