Initial commit

files/etc/NetworkManager/99-dot1x-unmanaged.conf

@@ -0,0 +1,6 @@
+# The physical NIC and macsec0 are owned by the initramfs-launched
+# @wpa_supplicant (root storage daemon). NetworkManager must not touch
+# them, or it will spawn a competing supplicant and drop the MKA session
+# carrying the root filesystem.
+[keyfile]
+unmanaged-devices=interface-name:macsec0;interface-name:en*

files/etc/dot1x/radius-ca.pem

@@ -0,0 +1,2 @@
+# PLACEHOLDER - replace with your RADIUS server CA chain (PEM) before building.
+# The build will succeed with this placeholder but authentication will not.

files/etc/dot1x/wpa_supplicant-dot1x.conf

@@ -0,0 +1,26 @@
+# Fleet-generic wired 802.1X EAP-TLS + MACsec configuration.
+# Identical on every host: per-host identity comes from the TPM
+# (key at persistent handle, cert extracted from NV at boot).
+ctrl_interface=/run/wpa_supplicant
+eapol_version=3
+ap_scan=0
+
+network={
+    key_mgmt=IEEE8021X
+    eap=TLS
+    # RADIUS derives the real identity from the certificate CN/SAN
+    identity="fleet-host"
+    ca_cert="/etc/dot1x/radius-ca.pem"
+    client_cert="/run/dot1x/client.pem"
+
+    # BENCH-VERIFY: TPM key reference method on your wpa_supplicant build.
+    # Option A (OpenSSL tpm2 provider, direct persistent handle):
+    private_key="handle:0x81010001"
+    # Option B (tpm2-pkcs11 with a store regenerated into /run at boot):
+    # private_key="pkcs11:token=fleet;object=dot1x-key;type=private;pin-value=..."
+
+    macsec_policy=1          # require MACsec
+    macsec_integ_only=0      # confidentiality (encrypt), not integrity-only
+    macsec_replay_protect=1
+    macsec_replay_window=0
+}

files/etc/dracut.conf.d/90-diskless.conf

@@ -0,0 +1,11 @@
+# Fleet-generic initramfs for diskless 802.1X/MACsec hosts.
+# Root = erofs image on a shared read-only NVMe/TCP namespace,
+# integrity-verified by dm-verity, tmpfs overlay for runtime state.
+# Built with --no-hostonly; assert everything the real hardware needs,
+# because the build VM only has virtio devices.
+hostonly="no"
+add_dracutmodules+=" 95dot1x-macsec network-legacy nvmf systemd-veritysetup overlayfs "
+filesystems+=" erofs overlay "
+add_drivers+=" macsec nvme-tcp nvme-fabrics dm-verity @NIC_DRIVERS@ "
+install_items+=" /etc/dot1x/radius-ca.pem /etc/dot1x/wpa_supplicant-dot1x.conf "
+compress="zstd"