tpm-enrol: inline empty-NV first-boot enrolment (host side, TODO #11)

Builds the host side of TPM identity enrolment — the "inline single-UKI"
vehicle from docs/tpm-enrolment-design.md. A production (secure) UKI now
auto-enrols a fresh host with no client cert, then reboots into the normal
secure path.

New dracut hook files/dracut/95dot1x-macsec/tpm-enrol.sh (initqueue/settled
prio 25, BEFORE dot1x-macsec-up at 30):
  - no-op when a cert is already present in NV 0x01800001 (normal boot) or
    under rd.dot1x=0 (test path has no trustworthy identity to enrol);
  - on EMPTY NV: generate the signing key in the TPM @0x81010001 (openssl tpm2
    provider builds the CSR; key never leaves the TPM), pre-auth DHCP on the
    PHYSICAL NIC (nmcli re-manages en*, overriding the secure-mode unmanaged
    drop-in), POST CSR+context to rd.fleet.enrol_url, show the broker
    fingerprint on Plymouth, poll /status, write the issued leaf cert (DER) to
    NV, and reboot to converge.
  - Empty-NV and the secure path are mutually exclusive, so this never reorders
    the load-bearing boot sequence (invariant #2).

Wiring:
  - module-setup.sh: require+install the tpm2 key-gen/NV tools, curl, awk, and
    the openssl tpm2 PROVIDER (ossl-modules/tpm2.so, asserted present — tpm2-tss
    alone can't sign with a handle: key); install the hook.
  - diskless.pkr.hcl: install tpm2-openssl + curl; assert hook/tools/provider in
    the initramfs (invariant #9). New enrol_url var threaded to extract-artifacts.
  - extract-artifacts.sh: bake rd.fleet.enrol_url into the cmdline.
  - fleet.script: enrol-active/enrol-wait/enrol-done banner; fingerprint on the
    message line (public — states only, invariant #1).

Shell JSON build/parse/cert-extract pipeline (no jq in the initramfs) verified
end-to-end against a live broker. BENCH-VERIFY list in docs/TODO.md #11 (tpm2
provider key-ref on real/swtpm, empty-NV detect, pre-auth DHCP override, Plymouth
render, NV write + reboot convergence, prod HTTPS).

diskless.pkr.hcl

@@ -100,6 +100,12 @@ variable "nvmet_traddr" {
   default     = "nvme.fleet.lab"
 }
 
+variable "enrol_url" {
+  type        = string
+  description = "Enrolment broker base URL baked into the UKI cmdline (rd.fleet.enrol_url) for the inline empty-NV first-boot enrolment (docs/tpm-enrolment-design.md). A fresh host reaches this pre-auth to get its TPM identity signed; hosts that already hold a cert never use it. Per-environment DNS name resolved at boot (the serving nginx reverse-proxies /enrol/ to the broker). Immutable once the UKI is signed."
+  default     = "http://boot.fleet.lab/enrol"
+}
+
 variable "ssh_authorized_key" {
   type        = string
   description = "Single SSH public key authorized for the sudo-enabled admin user. Fleet-generic (same on every host — not per-host state). Baked into the immutable rootfs, so rotating it needs a rebuild. EMPTY = no admin user is created and root is left UNLOCKED (lab convenience, avoids a no-way-in image)."
@@ -271,7 +277,11 @@ build {
       # zstd: dracut compresses the initramfs with compress="zstd"
       # (90-diskless.conf); the minimal ISO lacks the zstd binary, so without it
       # dracut warns and silently falls back to gzip (a larger initramfs).
-      "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network NetworkManager zstd openssl",
+      # tpm2-openssl: the openssl PROVIDER that lets `openssl req -provider tpm2
+      # -key handle:0x…` sign a CSR with a TPM-resident key (tpm2-tss alone can't).
+      # Required by the inline empty-NV enrolment hook (tpm-enrol.sh); curl is its
+      # broker HTTP client. Both get bundled into the initramfs by the dracut module.
+      "dnf -y install wpa_supplicant tpm2-tools tpm2-tss tpm2-openssl nvme-cli cryptsetup dracut-network NetworkManager zstd openssl curl",
 
       # EFI / Secure Boot management tools (efivar, mokutil, efibootmgr — all base
       # repos). Used over SSH on a workstation: `mokutil --sb-state/--pk/--kek/--db`
@@ -387,6 +397,14 @@ build {
       # a dracut hook).
       "grep -q 'nm-unmanaged.sh' /tmp/lsinitrd.txt || { echo 'ERROR: nm-unmanaged.sh hook missing from initramfs' >&2; exit 1; }",
       "grep -q 'nvmf-connect.service' /tmp/lsinitrd.txt || { echo 'ERROR: nvmf-connect.service missing from initramfs' >&2; exit 1; }",
+      # Assert the inline empty-NV enrolment path is fully present: the hook, the
+      # TPM key-gen tool, curl, and the openssl tpm2 PROVIDER (the piece tpm2-tss
+      # doesn't provide — without it the enrolment CSR can't be signed by the TPM
+      # key). A fresh host silently unable to enrol is a bricked host.
+      "grep -q 'tpm-enrol.sh' /tmp/lsinitrd.txt || { echo 'ERROR: tpm-enrol.sh hook missing from initramfs' >&2; exit 1; }",
+      "grep -q 'tpm2_create' /tmp/lsinitrd.txt || { echo 'ERROR: tpm2 key-gen tools missing from initramfs' >&2; exit 1; }",
+      "grep -Eq '/curl$|/curl ' /tmp/lsinitrd.txt || { echo 'ERROR: curl missing from initramfs (enrolment broker client)' >&2; exit 1; }",
+      "grep -q 'ossl-modules/tpm2.so' /tmp/lsinitrd.txt || { echo 'ERROR: openssl tpm2 provider (tpm2.so) missing from initramfs — install tpm2-openssl' >&2; exit 1; }",
       # Plymouth must be in the initramfs to splash during the early boot phase.
       "grep -q 'plymouthd' /tmp/lsinitrd.txt || { echo 'ERROR: plymouth missing from initramfs (plymouth dracut module not installed)' >&2; exit 1; }",
 
@@ -855,7 +873,7 @@ build {
       # home dirs) — we dropped mkfs.erofs --all-root, which used to mask this by
       # flattening everything to root:root. sudo is a no-op if already root, and
       # the runner has passwordless sudo (cf. the `sudo apt-get` install step).
-      "sudo bash -c \"IMAGE_VERSION='${var.image_version}' NVMET_TRADDR='${var.nvmet_traddr}' BOOT_SPLASH='${var.boot_splash}' STIG='${var.enable_stig}' bash scripts/extract-artifacts.sh output-qemu/diskless-build.qcow2 ${var.artifact_dir}/${var.image_version} ${var.disable_dot1x}\"",
+      "sudo bash -c \"IMAGE_VERSION='${var.image_version}' NVMET_TRADDR='${var.nvmet_traddr}' ENROL_URL='${var.enrol_url}' BOOT_SPLASH='${var.boot_splash}' STIG='${var.enable_stig}' bash scripts/extract-artifacts.sh output-qemu/diskless-build.qcow2 ${var.artifact_dir}/${var.image_version} ${var.disable_dot1x}\"",
       # Hand the OUTPUT FILES back to the build user (their in-erofs ownership is
       # already baked correctly) so build-oci.sh can write the UKI and push with
       # the build user's `buildah login`.

docs/TODO.md

@@ -999,9 +999,34 @@ store, per-IP rate limit; signs via `step` (dev `mock` signer). Ships in
 `serving/dot1x-bench/docker-compose.yml`; end-to-end smoke-tested (CSR → mTLS
 approve → cert). **BENCH-VERIFY:** run against real step-ca (`bootstrap.sh` root +
 `enrol` provisioner password readable by the broker) and confirm an issued cert
-authenticates EAP-TLS. **REMAINING:** the host-side inline empty-NV dracut branch
+authenticates EAP-TLS.
-(generate key/CSR → POST → Plymouth fingerprint → poll → NV write → reboot) +
+
-`tpm2-openssl` in the image.
+**HOST SIDE BUILT 2026-07-02 (inline empty-NV branch) — awaiting bench.** New
+dracut hook `files/dracut/95dot1x-macsec/tpm-enrol.sh` (initqueue/settled prio 25,
+BEFORE dot1x-macsec-up at 30): on a secure build with an EMPTY NV `0x01800001` it
+generates the TPM key at `0x81010001`, builds a CSR via the openssl tpm2 provider,
+does a **pre-auth DHCP on the physical NIC** (re-manages `en*` via nmcli, overriding
+the secure-mode unmanaged drop-in), POSTs CSR+context to `rd.fleet.enrol_url`
+(default `http://boot.fleet.lab/enrol`), shows the broker fingerprint on Plymouth
+(`enrol-*` tokens + message line), polls `/status`, writes the issued leaf cert
+(DER) to NV, and **reboots into the secure path**. No-op when a cert is already
+present (normal boot) or under `rd.dot1x=0`. Wiring: `module-setup.sh`
+require+install the tpm2 key-gen tools + curl + the **openssl tpm2 provider**
+(`ossl-modules/tpm2.so`, asserted present); `diskless.pkr.hcl` installs
+`tpm2-openssl`+`curl` and asserts hook/tools/provider in the initramfs; new
+`enrol_url` Packer var → `rd.fleet.enrol_url` cmdline (extract-artifacts.sh). The
+shell JSON build/parse/cert-extract pipeline (no jq in initramfs) was verified
+against a live broker end-to-end.
+
+**BENCH-VERIFY (host side, before trusting):** (a) openssl tpm2 provider `handle:`
+key ref actually signs the CSR on the target (swtpm + real TPM) — the CLAUDE.md
+provider-vs-pkcs11 caveat; (b) empty-NV detection + the create/persist path on a
+truly-fresh TPM (owner auth empty); (c) pre-auth DHCP on `en*` in secure mode (the
+`nmcli device set managed yes` runtime override of nm-unmanaged.sh actually
+manages+leases the NIC); (d) the fingerprint renders on the `fleet` Plymouth theme
++ the admin can match it; (e) NV write succeeds (TPM owner auth) and the **reboot
+converges** — 2nd boot finds the cert and runs the secure path; (f) prod: the
+broker endpoint over **HTTPS** (curl `--cacert radius-ca.pem`), currently lab-HTTP.
 
 **TEMPORARY (2026-06-28): broker also added to the MAIN serving stack**
 (`serving/docker-compose.yml`, `enrol-broker` service + `ENROL_*` in

docs/tpm-enrolment-design.md

@@ -322,9 +322,14 @@ exists. Enrolment is where it comes into being.
    **dedicated** CA (`admin-pki.sh`), separate from the fleet CA, so host certs
    can't authenticate to the admin plane. End-to-end smoke-tested (CSR → mTLS
    approve → cert; pubkey match). Ships in `serving/dot1x-bench/docker-compose.yml`.
-3. **Host side (next build):** the **inline empty-NV trigger** — dracut early-boot
+3. **Host side — BUILT 2026-07-02 (awaiting bench):** the **inline empty-NV
-   branch that generates key/CSR, POSTs to the broker, shows the fingerprint on
+   trigger** — dracut hook `95dot1x-macsec/tpm-enrol.sh` (initqueue/settled prio
-   Plymouth, polls, writes NV, reboots; plus `tpm2-openssl` in the image.
+   25) generates key/CSR (openssl tpm2 provider), pre-auth-DHCPs the physical NIC,
+   POSTs to the broker, shows the fingerprint on Plymouth, polls, writes the leaf
+   cert to NV `0x01800001`, and reboots into the secure path. No-op when a cert is
+   already present or under `rd.dot1x=0`. Ships `tpm2-openssl`+`curl` in the image
+   (asserted in the initramfs); `enrol_url` Packer var → `rd.fleet.enrol_url`.
+   BENCH-VERIFY list in `docs/TODO.md` #11.
 4. **Folds into fleet-manager:** the admin routes become the mgmt service's
    authenticated plane; approval writes the shared inventory record.
 5. **Provisioning-UKI variant** (`enrol_mode`) — move enrolment out of the production

files/dracut/95dot1x-macsec/module-setup.sh

@@ -7,6 +7,12 @@
 
 check() {
     require_binaries wpa_supplicant wpa_cli tpm2_nvread openssl || return 1
+    # Inline empty-NV enrolment (tpm-enrol.sh) needs the TPM key-gen + NV-write
+    # tools, curl (broker HTTP), and awk (JSON build). require them so a build
+    # that lacks tpm2-openssl / curl fails LOUDLY here rather than shipping a UKI
+    # that silently cannot enrol a fresh host.
+    require_binaries tpm2_createprimary tpm2_create tpm2_load tpm2_evictcontrol \
+        tpm2_nvdefine tpm2_nvwrite tpm2_readpublic curl awk || return 1
     return 0
 }
 
@@ -37,8 +43,23 @@ install() {
     inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid nmcli \
         grep sed cut tr sha256sum sleep mkdir nvme
 
-    # TSS libraries that tpm2_nvread dlopens
+    # Inline empty-NV enrolment (tpm-enrol.sh): TPM key-gen + NV-write tools, the
+    # EK read (device context), curl (broker HTTP), awk (JSON), wc, and reboot.
+    inst_multiple tpm2_createprimary tpm2_create tpm2_load tpm2_evictcontrol \
+        tpm2_nvdefine tpm2_nvundefine tpm2_nvwrite tpm2_readpublic \
+        tpm2_createek tpm2_flushcontext curl awk wc reboot systemctl
+
+    # TSS libraries that the tpm2 tools + the openssl tpm2 provider dlopen.
     inst_libdir_file "libtss2-*"
+    # openssl tpm2 PROVIDER (tpm2-openssl): openssl req signs the CSR with the
+    # TPM key via `-provider tpm2 -key handle:0x…`. tpm2-tss alone is NOT enough
+    # — the provider .so is what exposes the handle: key ref. require_binaries
+    # can't see a provider, so assert the .so landed (else enrolment CSR fails).
+    inst_libdir_file "ossl-modules/tpm2.so"
+    if [ -z "$(find "${initdir}" -name 'tpm2.so' -path '*ossl-modules*' 2>/dev/null)" ]; then
+        derror "95dot1x-macsec: openssl tpm2 provider (ossl-modules/tpm2.so) missing — install tpm2-openssl"
+        return 1
+    fi
 
     # Fleet-generic supplicant config + RADIUS CA
     inst_simple /etc/dot1x/wpa_supplicant-dot1x.conf /etc/dot1x/wpa_supplicant-dot1x.conf
@@ -51,6 +72,11 @@ install() {
     # 99-dot1x-unmanaged.conf, which couldn't be mode-aware.
     inst_hook cmdline 10 "$moddir/nm-unmanaged.sh"
 
+    # Inline empty-NV enrolment: runs BEFORE dot1x-macsec-up.sh (priority 25 < 30).
+    # No-op when a cert is already present (normal boot) or under rd.dot1x=0; on a
+    # fresh host it enrols an identity into NV then reboots into the secure path.
+    inst_hook initqueue/settled 25 "$moddir/tpm-enrol.sh"
+
     # Hook: runs from the initqueue once the NIC exists, before netroot
     inst_hook initqueue/settled 30 "$moddir/dot1x-macsec-up.sh"
 

files/dracut/95dot1x-macsec/tpm-enrol.sh

@@ -0,0 +1,230 @@
+#!/bin/bash
+# tpm-enrol.sh — initqueue/settled hook, runs BEFORE dot1x-macsec-up.sh.
+#
+# INLINE empty-NV enrolment (docs/tpm-enrolment-design.md, "inline single-UKI").
+# The production UKI auto-detects a host with NO client cert in TPM NV and, in
+# that case ONLY, branches into first-time identity enrolment:
+#   1. generate a signing key IN the TPM, persist at 0x81010001 (if absent)
+#   2. build a CSR with that key via the openssl tpm2 provider (key never leaves)
+#   3. pre-auth DHCP on the PHYSICAL NIC (plaintext L2 — same pre-auth permit the
+#      firmware used to fetch the UKI; there is no macsec/identity yet)
+#   4. POST CSR + device context to the enrolment broker; show the returned
+#      fingerprint on the Plymouth splash for an admin to cross-check + approve
+#   5. poll until APPROVED, write the issued cert (DER) to NV 0x01800001
+#   6. REBOOT — the next boot finds the cert present and runs the normal secure
+#      path (this hook exits 0 immediately when a cert is already present).
+#
+# Empty-NV and the normal secure path are MUTUALLY EXCLUSIVE (a host with no cert
+# cannot do 802.1X→MACsec→NVMe at all), so this never interleaves with — or
+# reorders — the load-bearing secure boot sequence (invariant #2). Enrolment is
+# gated to the secure build (skipped under rd.dot1x=0) because the open/test path
+# has no trustworthy device identity to enrol (design open-question).
+
+type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
+
+# One enrol attempt per boot. The stamp is set only once we COMMIT to enrolling
+# (NV confirmed empty) — not on entry — so the "cert present"/skip paths stay
+# re-runnable across repeated settled invocations, matching dot1x-macsec-up.sh
+# (which likewise stamps only on a terminal decision).
+STAMP=/run/dot1x/.enrol-done
+[ -e "$STAMP" ] && exit 0
+mkdir -p /run/dot1x
+
+export TPM2TOOLS_TCTI="device:/dev/tpmrm0"
+
+ply()    { plymouth update --status="$1" 2>/dev/null || true; }
+plymsg() { plymouth message --text="$1"  2>/dev/null || true; }
+
+# --- skip conditions --------------------------------------------------------
+# Test path: no real identity to enrol; leave the open-port boot untouched.
+if [ "$(getarg rd.dot1x=)" = "0" ]; then
+    exit 0
+fi
+# Explicit opt-out (e.g. a provisioning-UKI variant handling enrol elsewhere).
+if [ "$(getarg rd.fleet.enrol=)" = "0" ]; then
+    info "tpm-enrol: disabled by rd.fleet.enrol=0"
+    exit 0
+fi
+
+# --- knobs (override on the kernel cmdline) ---------------------------------
+NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
+HANDLE=$(getarg rd.fleet.enrol.handle=); [ -n "$HANDLE" ] || HANDLE=0x81010001
+CN=$(getarg rd.fleet.enrol.cn=); [ -n "$CN" ] || CN=fleet-host
+ENROL_URL=$(getarg rd.fleet.enrol_url=); [ -n "$ENROL_URL" ] || ENROL_URL=http://boot.fleet.lab/enrol
+NETTMO=$(getarg rd.dot1x.timeout=); [ -n "$NETTMO" ] || NETTMO=60
+# Human-approval wait. Generous but bounded: an abandoned enrol must not hang the
+# box forever (it drops to emergency, where the missing cert is diagnosable).
+WAITTMO=$(getarg rd.fleet.enrol.timeout=); [ -n "$WAITTMO" ] || WAITTMO=1800
+
+# Wait briefly for the TPM resource-manager device so an early settle (before the
+# TPM driver is up) doesn't misread NV as empty and wrongly trigger enrolment.
+i=0
+while [ ! -e /dev/tpmrm0 ] && [ "$i" -lt 10 ]; do sleep 1; i=$((i + 1)); done
+if [ ! -e /dev/tpmrm0 ]; then
+    warn "tpm-enrol: /dev/tpmrm0 absent — no TPM; leaving to the secure path"
+    exit 0
+fi
+
+# --- 0. already enrolled? then this is a normal boot — get out of the way ----
+# A present, non-empty NV cert means identity exists; dot1x-macsec-up.sh (next
+# hook) reads it and runs the secure path. Only an EMPTY/undefined NV enrols.
+if tpm2_nvread "$NVINDEX" -o /run/dot1x/nvprobe.der >/dev/null 2>&1 \
+   && [ -s /run/dot1x/nvprobe.der ]; then
+    info "tpm-enrol: client cert present at NV $NVINDEX — normal boot"
+    rm -f /run/dot1x/nvprobe.der
+    exit 0
+fi
+
+# Committed to enrolling — set the once-per-boot lock now.
+: > "$STAMP"
+warn "tpm-enrol: NV $NVINDEX empty — starting FIRST-TIME TPM enrolment"
+ply enrol-active
+plymsg "TPM enrolment: contacting fleet…"
+
+# NIC: explicit rd.dot1x.if=, else first non-loopback, non-macsec interface.
+NIC=$(getarg rd.dot1x.if=)
+if [ -z "$NIC" ]; then
+    for _dev in /sys/class/net/*; do
+        _name=${_dev##*/}
+        case "$_name" in lo|macsec*) continue ;; esac
+        NIC=$_name; break
+    done
+fi
+[ -n "$NIC" ] || { warn "tpm-enrol: no network interface found"; exit 1; }
+
+# --- 1. persistent TPM signing key (create only if absent) ------------------
+if ! tpm2_readpublic -c "$HANDLE" >/dev/null 2>&1; then
+    info "tpm-enrol: creating TPM signing key, persisting at $HANDLE"
+    if ! { tpm2_createprimary -C o -G ecc -g sha256 -c /run/dot1x/primary.ctx >/dev/null \
+        && tpm2_create -C /run/dot1x/primary.ctx -G ecc256:ecdsa-sha256 \
+             -u /run/dot1x/key.pub -r /run/dot1x/key.priv >/dev/null \
+        && tpm2_load -C /run/dot1x/primary.ctx -u /run/dot1x/key.pub \
+             -r /run/dot1x/key.priv -c /run/dot1x/key.ctx >/dev/null \
+        && tpm2_evictcontrol -C o -c /run/dot1x/key.ctx "$HANDLE" >/dev/null; }; then
+        warn "tpm-enrol: failed to create/persist TPM key at $HANDLE"
+        plymsg "TPM enrolment FAILED (key generation)"; exit 1
+    fi
+else
+    info "tpm-enrol: reusing existing persistent key at $HANDLE"
+fi
+
+# --- 2. CSR with the TPM key (private key never leaves the TPM) -------------
+if ! openssl req -new -provider tpm2 -provider default \
+        -key "handle:$HANDLE" -subj "/O=fleet/CN=$CN" \
+        -out /run/dot1x/enrol.csr 2>/run/dot1x/enrol.err; then
+    warn "tpm-enrol: CSR generation failed (openssl tpm2 provider?): $(cat /run/dot1x/enrol.err 2>/dev/null)"
+    plymsg "TPM enrolment FAILED (CSR / tpm2 provider)"; exit 1
+fi
+
+# --- 3. pre-auth network on the PHYSICAL NIC --------------------------------
+# Secure-mode nm-unmanaged.sh leaves en* UNMANAGED (wpa_supplicant would own it),
+# but there is no supplicant yet — so explicitly hand the NIC to NM for a
+# plaintext pre-auth DHCP lease (same permit-set the firmware used for the UKI).
+# The runtime `nmcli device set managed yes` overrides the unmanaged drop-in.
+ip link set "$NIC" up 2>/dev/null || true
+nmcli device set "$NIC" managed yes 2>/dev/null || true
+nmcli -w 0 device connect "$NIC" 2>/dev/null || true
+i=0
+while [ "$i" -lt "$NETTMO" ]; do
+    ip -4 addr show "$NIC" 2>/dev/null | grep -q 'inet ' && break
+    sleep 1; i=$((i + 1))
+done
+if [ "$i" -ge "$NETTMO" ]; then
+    warn "tpm-enrol: no pre-auth DHCP lease on $NIC after ${NETTMO}s"
+    plymsg "TPM enrolment FAILED (no network)"; exit 1
+fi
+info "tpm-enrol: pre-auth lease on $NIC; reaching broker at $ENROL_URL"
+
+# --- device context (advisory; helps the admin recognise the device) --------
+MAC=$(cat "/sys/class/net/$NIC/address" 2>/dev/null)
+DMI_UUID=$(cat /sys/class/dmi/id/product_uuid 2>/dev/null)
+DMI_SERIAL=$(cat /sys/class/dmi/id/product_serial 2>/dev/null)
+EK_HASH=""
+if tpm2_createek -G ecc -u /run/dot1x/ek.pub -c /run/dot1x/ek.ctx >/dev/null 2>&1; then
+    EK_HASH=$(sha256sum /run/dot1x/ek.pub 2>/dev/null | cut -d' ' -f1)
+    tpm2_flushcontext /run/dot1x/ek.ctx >/dev/null 2>&1 || true
+fi
+
+# --- 4. POST the CSR + context ----------------------------------------------
+# JSON body, no jq in the initramfs: escape the PEM (newlines -> \n, quotes) with
+# awk and interpolate. curl uses the fleet CA for an https endpoint.
+CSR_ESC=$(awk 'BEGIN{ORS=""}{gsub(/\\/,"\\\\");gsub(/"/,"\\\"");printf "%s\\n",$0}' /run/dot1x/enrol.csr)
+printf '{"csr":"%s","context":{"mac":"%s","dmi_uuid":"%s","dmi_serial":"%s","ek_hash":"%s"}}' \
+    "$CSR_ESC" "$MAC" "$DMI_UUID" "$DMI_SERIAL" "$EK_HASH" > /run/dot1x/enrol-req.json
+
+CURL_TLS=()
+case "$ENROL_URL" in https:*) CURL_TLS=(--cacert /etc/dot1x/radius-ca.pem) ;; esac
+
+if ! curl -fsS "${CURL_TLS[@]}" -X POST "$ENROL_URL/request" \
+        -H 'Content-Type: application/json' --data @/run/dot1x/enrol-req.json \
+        -o /run/dot1x/enrol-resp.json 2>/run/dot1x/enrol.err; then
+    warn "tpm-enrol: broker /request failed: $(cat /run/dot1x/enrol.err 2>/dev/null)"
+    plymsg "TPM enrolment FAILED (broker unreachable)"; exit 1
+fi
+ENROL_ID=$(sed -n 's/.*"enrol_id":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-resp.json)
+FP=$(sed -n 's/.*"fingerprint":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-resp.json)
+if [ -z "$ENROL_ID" ]; then
+    warn "tpm-enrol: broker did not return an enrol_id: $(cat /run/dot1x/enrol-resp.json 2>/dev/null)"
+    plymsg "TPM enrolment FAILED (bad broker response)"; exit 1
+fi
+info "tpm-enrol: enrol_id=$ENROL_ID fingerprint=$FP"
+
+# --- 5. show the fingerprint + poll for approval ----------------------------
+# The fingerprint is PUBLIC (derived from the CSR public key) — displaying it is
+# allowed under invariant #1 (state, not a secret). An admin cross-checks it
+# against the broker's pending queue and approves.
+ply enrol-wait
+plymsg "APPROVE THIS DEVICE — code: $FP"
+
+i=0
+while [ "$i" -lt "$WAITTMO" ]; do
+    if curl -fsS "${CURL_TLS[@]}" "$ENROL_URL/status/$ENROL_ID" \
+            -o /run/dot1x/enrol-status.json 2>/dev/null; then
+        STATE=$(sed -n 's/.*"state":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-status.json)
+        case "$STATE" in
+            approved) break ;;
+            denied)   warn "tpm-enrol: enrolment DENIED by admin"
+                      plymsg "TPM enrolment DENIED"; exit 1 ;;
+            expired)  warn "tpm-enrol: enrolment request expired"
+                      plymsg "TPM enrolment EXPIRED — reboot to retry"; exit 1 ;;
+        esac
+    fi
+    sleep 5; i=$((i + 5))
+done
+if [ "${STATE:-}" != "approved" ]; then
+    warn "tpm-enrol: no approval within ${WAITTMO}s"
+    plymsg "TPM enrolment TIMED OUT"; exit 1
+fi
+
+# --- 6. write the issued cert to NV + reboot into the secure path -----------
+ply enrol-done
+plymsg "Enrolment approved — installing identity"
+# Extract the cert PEM (leaf first if a chain was returned), unescape \n.
+CERT_ESC=$(sed -n 's/.*"cert":"\(.*\)","hostnqn":.*/\1/p' /run/dot1x/enrol-status.json)
+[ -n "$CERT_ESC" ] || CERT_ESC=$(sed -n 's/.*"cert":"\(.*\)".*/\1/p' /run/dot1x/enrol-status.json)
+printf '%b' "$CERT_ESC" > /run/dot1x/enrol-cert.pem
+# Keep only the FIRST certificate (the leaf) for NV — the hostnqn/EAP identity.
+awk 'BEGIN{n=0} /BEGIN CERTIFICATE/{n++} n==1{print} /END CERTIFICATE/{if(n==1)exit}' \
+    /run/dot1x/enrol-cert.pem > /run/dot1x/enrol-leaf.pem
+if ! openssl x509 -in /run/dot1x/enrol-leaf.pem -outform DER \
+        -out /run/dot1x/enrol-leaf.der 2>/dev/null; then
+    warn "tpm-enrol: issued cert is not valid PEM"; plymsg "TPM enrolment FAILED (bad cert)"; exit 1
+fi
+SZ=$(wc -c < /run/dot1x/enrol-leaf.der)
+info "tpm-enrol: writing ${SZ}-byte cert to NV $NVINDEX"
+tpm2_nvundefine "$NVINDEX" -C o >/dev/null 2>&1 || true
+if ! { tpm2_nvdefine "$NVINDEX" -C o -s "$SZ" \
+         -a 'ownerread|ownerwrite|authread|authwrite' >/dev/null \
+    && tpm2_nvwrite "$NVINDEX" -C o -i /run/dot1x/enrol-leaf.der >/dev/null; }; then
+    warn "tpm-enrol: failed to write cert to NV $NVINDEX (TPM owner auth?)"
+    plymsg "TPM enrolment FAILED (NV write)"; exit 1
+fi
+
+SERIAL=$(openssl x509 -in /run/dot1x/enrol-leaf.pem -serial -noout 2>/dev/null | cut -d= -f2 | tr 'A-F' 'a-f')
+info "tpm-enrol: ENROLLED (cert serial $SERIAL). Rebooting into the secure path."
+plymsg "Enrolment complete — rebooting"
+sleep 2
+systemctl --no-block reboot 2>/dev/null || reboot -f 2>/dev/null || \
+    { echo 1 > /proc/sys/kernel/sysrq 2>/dev/null; echo b > /proc/sysrq-trigger 2>/dev/null; }
+# Do not fall through to the secure path in this (pre-reboot) boot.
+exit 0

files/plymouth/themes/fleet/fleet.script

@@ -66,11 +66,26 @@ foot = Sprite(foot_img);
 foot.SetX(sw / 2 - foot_img.GetWidth() / 2);
 foot.SetY(sh / 2 + 150);
 
+# ---- first-boot TPM enrolment banner (only shown on an empty-NV host) ----
+# tpm-enrol.sh drives enrol-active/enrol-wait/enrol-done; the public fingerprint
+# rides the message line (on_message) below. States only, no per-host secret.
+enrol_b = Sprite(); enrol_b.SetOpacity(0);
+fun enrol_banner(text, r, g, b) {
+    eimg = Image.Text(text, r, g, b, 1, "Sans Bold 16");
+    enrol_b.SetImage(eimg);
+    enrol_b.SetX(sw / 2 - eimg.GetWidth() / 2);
+    enrol_b.SetY(sh / 2 - 70);
+    enrol_b.SetOpacity(1.0);
+}
+
 # ---- status tokens from the boot hooks ----
 fun set(i, s) { state[i] = s; draw(i); }
 
 fun on_status(t) {
     if (t == "mode-test")     { set(0, 3); set(1, 3); set(2, 3); }
+    if (t == "enrol-active")  { set(0, 1); enrol_banner("FIRST-BOOT TPM ENROLMENT", 1.00, 0.72, 0.10); }
+    if (t == "enrol-wait")    enrol_banner("AWAITING ADMIN APPROVAL — verify the code below", 1.00, 0.72, 0.10);
+    if (t == "enrol-done")    { enrol_banner("IDENTITY ENROLLED — rebooting", 0.10, 1.00, 0.50); set(0, 2); }
     if (t == "tpm-active")    set(0, 1);
     if (t == "tpm-done")      set(0, 2);
     if (t == "dot1x-active")  set(1, 1);

scripts/extract-artifacts.sh

@@ -23,6 +23,10 @@ DISABLE_DOT1X=${3:-false}
 # environments. Defaults to the literal placeholder so build-oci.sh's warning
 # fires if it was never set.
 NVMET_TRADDR=${NVMET_TRADDR:-NVMET_TRADDR}
+# Enrolment broker URL baked into the cmdline (rd.fleet.enrol_url) for the inline
+# empty-NV first-boot enrolment. Per-environment DNS name (the serving nginx
+# reverse-proxies /enrol/ to the broker); only used by a host with no TPM cert.
+ENROL_URL=${ENROL_URL:-http://boot.fleet.lab/enrol}
 # Plymouth boot splash toggle (from the boot_splash Packer var). "true" bakes
 # "rhgb quiet" so Plymouth shows the graphical splash; anything else bakes
 # "plymouth.enable=0" for a fully verbose console boot (boot-chain debugging).
@@ -217,6 +221,7 @@ printf '%s' \
   "$DOT1X_FRAGMENT" \
   "rd.neednet=1 systemd.volatile=overlay " \
   "rd.dot1x.nvindex=0x01800001 rd.dot1x.timeout=60 " \
+  "rd.fleet.enrol_url=${ENROL_URL} " \
   "rd.nvmf.discover=tcp,${NVMET_TRADDR},4420 " \
   "root=/dev/mapper/root rootfstype=erofs rootflags=ro " \
   "systemd.verity=yes roothash=${ROOT_HASH} " \