Merge remote-tracking branch 'origin/main' into secure-ntp

serving/docker-compose.yml

@@ -201,50 +201,15 @@ services:
     # For HTTPS boot (production), terminate TLS here with the boot-infra CA's
     # cert and switch the dhcp-boot URL above to https://. Left HTTP for the lab.
 
-  # --- TPM enrolment broker (TEMPORARY home — see docs/TODO.md #11) -----------
-  # The `http` nginx already reverse-proxies /enrol/ -> 127.0.0.1:9090 (this
-  # broker's public listener), so an empty-NV host can POST its CSR and poll for
-  # the signed cert via the normal serving host. For now the broker runs HERE so
-  # a single `compose up` in serving/ brings the enrolment endpoint up.
-  #
-  # ⚠ PROPER HOME is its own stack co-located with step-ca (the fleet CA), i.e.
-  # serving/dot1x-bench/, since REAL signing needs that CA. SPLIT THIS BACK OUT
-  # once the CA lives beside it. Do NOT run this AND dot1x-bench's enrol-broker on
-  # the same host — they collide on 9090/9443.
-  #
-  # Defaults below are the zero-dependency LAB path: `mock` signer (ephemeral
-  # in-process CA — certs are NOT trusted by RADIUS/NVMe) + plaintext loopback
-  # admin. For REAL enrolment, in .env set ENROL_SIGNER=step + point
-  # ENROL_STEP_CA_* at a reachable step-ca, and set ENROL_ADMIN_INSECURE=false
-  # after generating the admin mTLS PKI (a DEDICATED admin CA, not the fleet root):
-  #   ./enrol-broker/admin-pki.sh ./enrol-pki/broker <admin-name>
-  # then import enrol-pki/broker/clients/<admin>.p12 and open https://127.0.0.1:9443/
-  enrol-broker:
-    build: ./enrol-broker
-    network_mode: host          # public on 127.0.0.1:9090 (nginx proxies /enrol/)
-    restart: unless-stopped
-    environment:
-      BROKER_PUBLIC_ADDR: "127.0.0.1:9090"   # nginx /enrol/ proxies here
-      BROKER_ADMIN_ADDR: "127.0.0.1:9443"    # mgmt/loopback ONLY — never the boot LAN
-      BROKER_SIGNER: ${ENROL_SIGNER:-mock}
-      BROKER_PENDING_TTL: ${ENROL_PENDING_TTL:-10m}
-      BROKER_WORDS: ${ENROL_WORDS:-8}
-      HOSTNQN_BASE: ${ENROL_HOSTNQN_BASE:-nqn.2026-06.org.example.fleet:host-}
-      # --- step signer (only consulted when ENROL_SIGNER=step) ---
-      STEP_CA_URL: ${ENROL_STEP_CA_URL:-}
-      STEP_CA_ROOT: ${ENROL_STEP_CA_ROOT:-/pki/root_ca.crt}
-      STEP_PROVISIONER: ${ENROL_STEP_PROVISIONER:-enrol}
-      STEP_PROVISIONER_PASSWORD_FILE: ${ENROL_STEP_PASSWORD_FILE:-/pki/password}
-      STEP_CERT_NOT_AFTER: ${ENROL_CERT_NOT_AFTER:-720h}
-      # --- admin mTLS (set ENROL_ADMIN_INSECURE=false for real mTLS) ---
-      BROKER_ADMIN_INSECURE: ${ENROL_ADMIN_INSECURE:-true}
-      BROKER_ADMIN_CERT: ${ENROL_ADMIN_CERT:-/pki/broker/server.crt}
-      BROKER_ADMIN_KEY: ${ENROL_ADMIN_KEY:-/pki/broker/server.key}
-      BROKER_ADMIN_CLIENT_CA: ${ENROL_ADMIN_CLIENT_CA:-/pki/broker/admin-ca.crt}
-    volumes:
-      # CA root + provisioner password (step signer) and admin mTLS certs live
-      # here; unused/empty for the default mock+insecure path. Gitignored.
-      - ./enrol-pki:/pki:ro
+  # --- TPM enrolment broker — NOT defined here (lives in the CA stack) --------
+  # The broker's home is co-located with step-ca (the fleet CA), i.e.
+  # serving/dot1x-bench/, since real signing needs that CA. A `mock`-signer
+  # convenience copy used to run here too, but two host-networked brokers collide
+  # on 9090/9443 and the mock copy issued certs RADIUS/NVMe don't trust — so it was
+  # removed (bench 2026-07-11; see docs/ssh-host-certificate-design.md). The `http`
+  # nginx still reverse-proxies /enrol/ -> 127.0.0.1:9090; bring up
+  # serving/dot1x-bench on the same host (its broker binds that loopback port) to
+  # serve enrolment. Do NOT re-add a second broker here.
 
   # --- Kiosk SPA (spaceship terminal shown by the diskless kiosk) ------------
   # Svelte + Tailwind app built into a static bundle served by its own nginx.