Config and profiles

config.json is public PermawebOS operator config. LapEE reads it from the boot USB EFI System Partition, copies it to /tmp/config.json, and includes it in the measured node message.

Do not put secrets in config.json. WiFi credentials belong in wifi.conf.

Runtime Order

LapEE starts PermawebOS with:

HB_CONFIG=/tmp/config.json,/etc/lapee/lapee.json[,/run/lapee/on-start-merged.json]

Config	Source	Purpose
/tmp/config.json	ESP EFI/boot/config.json	Public operator config or role profile.
/etc/lapee/lapee.json	Base image	Base defaults and measurement startup hook.
/run/lapee/on-start-merged.json	Init-generated when needed	Preserves base startup hooks and appends profile startup hooks.

The base config remains present. Operator keys that the base does not set remain visible through ~meta@1.0/info and are committed into the boot measurement.

Profiles

A profile is just role-specific config.json. For LapEE, stage the profile beside the Makefile as:

config.json

An example configuration to enable paid bundling is here.

It enables remote device loading, pins the trusted device signer, maps published Forge device IDs, and installs the paid-bundler startup hook.

Merge Existing Config

If you have release-provided operator config to preserve, merge release config first and the role profile second before applying it to the image:

jq -S -s '.[0] * .[1]' \
  /path/to/release-config.json \
  /path/to/profile-config.json \
  > config.json

The profile wins if both files define the same role key.

Apply To Image

Run these commands from the LapEE source repo root. For a prebuilt release image, stage the verified image at the Makefile's default path:

mkdir -p build/images
cp /path/to/lapee-usb.img build/images/lapee-usb.img

Then apply staged operator inputs:

make operator-config-apply IMAGE=build/images/lapee-usb.img

Docker must be running. The helper copies config.json into the image as EFI/boot/config.json. If wifi.conf is present, it also copies it as EFI/boot/wifi.conf.

After applying inputs, write the image:

make write-image DEV=/dev/diskN IMAGE=build/images/lapee-usb.img

WiFi

wifi.conf is separate plaintext secret material:

SSID
WPA2-PSK

Place it beside the Makefile before running make operator-config-apply. At boot it is read from:

EFI/boot/wifi.conf

Prefer Ethernet when available.

Useful Checks

After boot:

export NODE_URL=http://HOST:8734

curl -fsS -H 'accept: text/plain' \
  "$NODE_URL/~meta@1.0/info/lapee-profile"
curl -fsS -H 'accept: text/plain' \
  "$NODE_URL/~meta@1.0/info/load-remote-devices"
curl -fsS \
  -H 'accept: application/json' \
  -H 'accept-bundle: true' \
  "$NODE_URL/~meta@1.0/info/trusted-device-signers" \
  | jq '[to_entries[] | select(.key | test("^[0-9]+$")) | .value]'

For the paid-bundler launch profile, lapee-profile should be:

aopayment-bundler

trusted-device-signers is an AO json@1.0 list. Over HTTP it is encoded with numeric object keys, not as a plain JSON array. The command above extracts the signer values.

Attestation Impact

Public config can change the node message. A changed node message changes the measurement subject and the PCR 15 node-binding path. A verifier should check the profile and device-signer keys it relies on before accepting the node.