sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

adding ssh host signing

Browse Source
This commit is contained in:
Audiobuzz
2026-07-11 16:20:21 +09:30
parent b5d6c790c4
commit 2e318fba00
24 changed files with 1626 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/dot1x-bench/docker-compose.yml
+10
View File
@@ -82,5 +82,15 @@ services:
BROKER_ADMIN_CERT: "/pki/broker/server.crt"
BROKER_ADMIN_KEY: "/pki/broker/server.key"
BROKER_ADMIN_CLIENT_CA: "/pki/broker/admin-ca.crt"
# HOST plane (SSH host-cert issuance, F-02/P-17). mTLS on the boot LAN:
# FLEET-signed server cert + the fleet CA (root+intermediate) as the client
# CA that verifies each host's TPM identity. Certs issued by
# step-ca/ssh-ca-bootstrap.sh (run it once after bootstrap.sh). 0.0.0.0 so
# booted hosts can reach it — firewall to the boot LAN.
BROKER_HOST_ADDR: "0.0.0.0:9444"
BROKER_HOST_CERT: "/pki/broker/host-server.crt"
BROKER_HOST_KEY: "/pki/broker/host-server.key"
BROKER_HOST_CLIENT_CA: "/pki/broker/fleet-client-ca.crt"
STEP_SSH_CERT_NOT_AFTER: "720h"
volumes:
- ./pki:/pki:ro