initial tpm broker

serving/dot1x-bench/docker-compose.yml

@@ -45,3 +45,36 @@ services:
       - ./freeradius/mods-available/eap:/etc/raddb/mods-available/eap:ro
       # certs issued by bootstrap.sh: the RADIUS server cert/key + the CA root.
       - ./pki/radius:/etc/raddb/certs/fleet:ro
+
+  # --- TPM enrolment broker (the ONE unauthenticated, pre-auth endpoint) -------
+  # docs/tpm-enrolment-design.md. Host networking so the SERVING stack's nginx
+  # reaches the public listener on 127.0.0.1:9090 (proxied as /enrol/) and step-ca
+  # is reachable for signing. The admin web UI (mTLS) listens on 127.0.0.1:9443 —
+  # bind it to the management network ONLY; never expose it to the boot LAN.
+  #
+  # First issue the admin mTLS PKI (dedicated admin CA, NOT the fleet root):
+  #   ../enrol-broker/admin-pki.sh ./pki/broker <admin-name>
+  enrol-broker:
+    build: ../enrol-broker
+    network_mode: host
+    restart: unless-stopped
+    depends_on:
+      - step-ca
+    environment:
+      BROKER_PUBLIC_ADDR: "127.0.0.1:9090"
+      BROKER_ADMIN_ADDR: "127.0.0.1:9443"
+      BROKER_SIGNER: "step"
+      STEP_CA_URL: "https://${CA_DNS:-ca.fleet.lab}:${CA_PORT:-8443}"
+      STEP_CA_ROOT: "/pki/root_ca.crt"
+      STEP_PROVISIONER: "enrol"
+      STEP_PROVISIONER_PASSWORD_FILE: "/pki/stepca/secrets/password"
+      STEP_CERT_NOT_AFTER: "720h"
+      BROKER_PENDING_TTL: "10m"
+      BROKER_WORDS: "8"
+      HOSTNQN_BASE: "nqn.2026-06.org.example.fleet:host-"
+      # Admin mTLS — server cert/key + the DEDICATED admin client CA (see above).
+      BROKER_ADMIN_CERT: "/pki/broker/server.crt"
+      BROKER_ADMIN_KEY: "/pki/broker/server.key"
+      BROKER_ADMIN_CLIENT_CA: "/pki/broker/admin-ca.crt"
+    volumes:
+      - ./pki:/pki:ro