sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

initial tpm broker

Browse Source
This commit is contained in:
Audiobuzz
2026-06-28 10:33:14 +00:00
parent 3bcf16e384
commit 9e1dbd3ef7
17 changed files with 1584 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/dot1x-bench/.env.example
+8
View File
@@ -3,3 +3,11 @@ CA_DNS=ca.fleet.lab # DNS name(s) clients reach step-ca on (resolved by
CA_PORT=8443 # step-ca listen port (host networking)
CA_PASSWORD=changeme-bench # password protecting the CA keys (bench only)
RADIUS_SECRET=testing123 # shared secret between the authenticator (hostapd) and FreeRADIUS
# --- enrol-broker (TPM identity enrolment; docs/tpm-enrolment-design.md) -------
# Before `docker compose up -d enrol-broker`, issue the admin mTLS PKI (a
# DEDICATED admin CA, separate from the fleet CA) and one client cert per admin:
# ../enrol-broker/admin-pki.sh ./pki/broker alice
# then import pki/broker/clients/alice.p12 (empty password) into the browser and
# open https://127.0.0.1:9443/ . The public /enrol/ endpoint is reached via the
# serving stack's nginx (http://boot.fleet.lab/enrol/).