sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into secure-ntp

Browse Source
This commit is contained in:
Audiobuzz
2026-07-11 21:03:23 +09:30
parent 0a3deca335 b0890cfc09
commit d1621e9b74
9 changed files with 207 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/defaults.env
+7 -32
View File
@@ -109,38 +109,13 @@ SUBNQN=nqn.2026-06.org.example.fleet:rootfs
TARGET_PORT=4420
SPDK_CPUMASK=0x1 # one polling core is plenty for a read-only boot fs
# --- TPM enrolment broker (TEMPORARY in this stack — see docs/TODO.md #11) ---
# The broker is the one unauthenticated pre-auth endpoint (nginx proxies /enrol/
# to it). Defaults run the zero-dependency LAB path: a `mock` signer (ephemeral
# CA; certs NOT trusted by RADIUS/NVMe) + plaintext loopback admin — enough to
# exercise the request/approve/poll flow while the host side is built.
#
# For REAL enrolment: set ENROL_SIGNER=step, point ENROL_STEP_CA_URL at a
# reachable step-ca (e.g. the one in serving/dot1x-bench/), drop its root +
# provisioner password into ./enrol-pki/, generate the admin mTLS PKI
# (./enrol-broker/admin-pki.sh ./enrol-pki/broker <admin>), and set
# ENROL_ADMIN_INSECURE=false. Then it belongs in its own CA-co-located stack.
ENROL_SIGNER=mock # mock (lab, no CA) | step (real, needs a CA)
ENROL_ADMIN_INSECURE=true # true = plaintext loopback admin (LAB ONLY); false = mTLS
ENROL_PENDING_TTL=10m # time-box on unapproved requests
ENROL_WORDS=8 # fingerprint word count
ENROL_HOSTNQN_BASE=nqn.2026-06.org.example.fleet:host-
# step signer (only when ENROL_SIGNER=step) — paths are INSIDE the container
# (./enrol-pki is mounted at /pki):
ENROL_STEP_CA_URL= # e.g. https://ca.fleet.lab:8443
ENROL_STEP_CA_ROOT=/pki/root_ca.crt
ENROL_STEP_PROVISIONER=enrol
ENROL_STEP_PASSWORD_FILE=/pki/password
# Issued-cert lifetime. NOTE: the step-ca provisioner must ALLOW this — a stock
# step-ca caps certs at 24h, so 720h is rejected ("requested duration ... more
# than the authorized maximum certificate duration of 24h"). The bench
# step-ca/bootstrap.sh now raises authority.claims.maxTLSCertDuration; a
# different CA needs the same. Verified end-to-end against a real step-ca.
ENROL_CERT_NOT_AFTER=720h
# admin mTLS (only when ENROL_ADMIN_INSECURE=false):
ENROL_ADMIN_CERT=/pki/broker/server.crt
ENROL_ADMIN_KEY=/pki/broker/server.key
ENROL_ADMIN_CLIENT_CA=/pki/broker/admin-ca.crt
# --- TPM enrolment broker — configured in the CA-co-located stack -----------
# The broker no longer runs in this stack (a mock-signer copy here collided with
# the real one on 9090/9443 and issued untrusted certs — removed 2026-07-11). It
# lives in serving/dot1x-bench/ alongside step-ca (real signing needs the CA), and
# the `http` nginx here still proxies /enrol/ -> 127.0.0.1:9090 to reach it on the
# same host. Configure the broker (signer, provisioner, admin mTLS) in
# serving/dot1x-bench/.env, not here.
# --- SPDK version loader / reaper (declarative rolling updates) -------------
# The spdk-loader service stages + adds ${IMAGE_VERSION} to the long-lived target