initial tpm broker

serving/dot1x-bench/.env.example

@@ -3,3 +3,11 @@ CA_DNS=ca.fleet.lab          # DNS name(s) clients reach step-ca on (resolved by
 CA_PORT=8443                 # step-ca listen port (host networking)
 CA_PASSWORD=changeme-bench   # password protecting the CA keys (bench only)
 RADIUS_SECRET=testing123     # shared secret between the authenticator (hostapd) and FreeRADIUS
+
+# --- enrol-broker (TPM identity enrolment; docs/tpm-enrolment-design.md) -------
+# Before `docker compose up -d enrol-broker`, issue the admin mTLS PKI (a
+# DEDICATED admin CA, separate from the fleet CA) and one client cert per admin:
+#   ../enrol-broker/admin-pki.sh ./pki/broker alice
+# then import pki/broker/clients/alice.p12 (empty password) into the browser and
+# open https://127.0.0.1:9443/ . The public /enrol/ endpoint is reached via the
+# serving stack's nginx (http://boot.fleet.lab/enrol/).

serving/dot1x-bench/docker-compose.yml

@@ -45,3 +45,36 @@ services:
       - ./freeradius/mods-available/eap:/etc/raddb/mods-available/eap:ro
       # certs issued by bootstrap.sh: the RADIUS server cert/key + the CA root.
       - ./pki/radius:/etc/raddb/certs/fleet:ro
+
+  # --- TPM enrolment broker (the ONE unauthenticated, pre-auth endpoint) -------
+  # docs/tpm-enrolment-design.md. Host networking so the SERVING stack's nginx
+  # reaches the public listener on 127.0.0.1:9090 (proxied as /enrol/) and step-ca
+  # is reachable for signing. The admin web UI (mTLS) listens on 127.0.0.1:9443 —
+  # bind it to the management network ONLY; never expose it to the boot LAN.
+  #
+  # First issue the admin mTLS PKI (dedicated admin CA, NOT the fleet root):
+  #   ../enrol-broker/admin-pki.sh ./pki/broker <admin-name>
+  enrol-broker:
+    build: ../enrol-broker
+    network_mode: host
+    restart: unless-stopped
+    depends_on:
+      - step-ca
+    environment:
+      BROKER_PUBLIC_ADDR: "127.0.0.1:9090"
+      BROKER_ADMIN_ADDR: "127.0.0.1:9443"
+      BROKER_SIGNER: "step"
+      STEP_CA_URL: "https://${CA_DNS:-ca.fleet.lab}:${CA_PORT:-8443}"
+      STEP_CA_ROOT: "/pki/root_ca.crt"
+      STEP_PROVISIONER: "enrol"
+      STEP_PROVISIONER_PASSWORD_FILE: "/pki/stepca/secrets/password"
+      STEP_CERT_NOT_AFTER: "720h"
+      BROKER_PENDING_TTL: "10m"
+      BROKER_WORDS: "8"
+      HOSTNQN_BASE: "nqn.2026-06.org.example.fleet:host-"
+      # Admin mTLS — server cert/key + the DEDICATED admin client CA (see above).
+      BROKER_ADMIN_CERT: "/pki/broker/server.crt"
+      BROKER_ADMIN_KEY: "/pki/broker/server.key"
+      BROKER_ADMIN_CLIENT_CA: "/pki/broker/admin-ca.crt"
+    volumes:
+      - ./pki:/pki:ro