initial tpm broker

2026-06-28 10:33:14 +00:00
parent 3bcf16e384
commit 9e1dbd3ef7
17 changed files with 1584 additions and 19 deletions
@@ -20,6 +20,21 @@ server {
        autoindex on;
    }

+    # TPM enrolment broker (docs/tpm-enrolment-design.md) — the ONE unauthenticated,
+    # pre-auth endpoint. An empty-NV host POSTs its CSR and polls for the signed
+    # cert; the admin approve/deny plane is a SEPARATE mTLS listener and is NOT
+    # exposed here. Proxied to the broker (dot1x-bench stack) on loopback; the
+    # trailing slash strips /enrol/ so the broker sees /request and /status/{id}.
+    location /enrol/ {
+        proxy_pass           http://127.0.0.1:9090/;
+        proxy_http_version   1.1;
+        proxy_set_header     Host            $host;
+        proxy_set_header     X-Forwarded-For $remote_addr;
+        proxy_set_header     Connection "";
+        client_max_body_size 16k;     # a CSR is ~1KB — cap abuse
+        proxy_read_timeout   30s;
+    }
+
    # Kiosk SPA. The diskless kiosk (kiosk_url) points at
    # http://boot.fleet.lab/kiosk/ — resolved to this host by the stack's dnsmasq
    # and proxied to the kiosk-app container.