initial tpm broker

serving/enrol-broker/Dockerfile

@@ -0,0 +1,22 @@
+# fleet-enrol-broker — TPM identity enrolment broker (docs/tpm-enrolment-design.md).
+#
+# Two stages: a reproducible static Go build, then the smallstep `step` CLI image
+# as the runtime base (the production signer shells out to `step ca token` +
+# `step ca sign`). The broker is stdlib-only, so the build needs no module
+# download (GOPROXY=off) and the verity-style reproducibility flags apply.
+#
+# Pin + mirror these base tags through your registry (like the rest of the stack)
+# if the build/serving host has no egress.
+FROM golang:1.23-alpine AS build
+WORKDIR /src
+COPY go.mod .
+COPY *.go wordlist.txt ./
+ENV CGO_ENABLED=0 GOPROXY=off GOTOOLCHAIN=local
+RUN go build -trimpath -buildvcs=false -ldflags '-s -w -buildid=' -o /enrol-broker .
+
+FROM smallstep/step-cli:latest
+COPY --from=build /enrol-broker /usr/local/bin/enrol-broker
+# Non-root by default (the step-cli image runs as uid 1000 "step"); the broker
+# binds loopback ports >1024 and only READS the mounted CA root + provisioner
+# password, so no extra privilege is needed.
+ENTRYPOINT ["/usr/local/bin/enrol-broker"]