Initial commit

files/etc/dot1x/radius-ca.pem

@@ -0,0 +1,2 @@
+# PLACEHOLDER - replace with your RADIUS server CA chain (PEM) before building.
+# The build will succeed with this placeholder but authentication will not.

files/etc/dot1x/wpa_supplicant-dot1x.conf

@@ -0,0 +1,26 @@
+# Fleet-generic wired 802.1X EAP-TLS + MACsec configuration.
+# Identical on every host: per-host identity comes from the TPM
+# (key at persistent handle, cert extracted from NV at boot).
+ctrl_interface=/run/wpa_supplicant
+eapol_version=3
+ap_scan=0
+
+network={
+    key_mgmt=IEEE8021X
+    eap=TLS
+    # RADIUS derives the real identity from the certificate CN/SAN
+    identity="fleet-host"
+    ca_cert="/etc/dot1x/radius-ca.pem"
+    client_cert="/run/dot1x/client.pem"
+
+    # BENCH-VERIFY: TPM key reference method on your wpa_supplicant build.
+    # Option A (OpenSSL tpm2 provider, direct persistent handle):
+    private_key="handle:0x81010001"
+    # Option B (tpm2-pkcs11 with a store regenerated into /run at boot):
+    # private_key="pkcs11:token=fleet;object=dot1x-key;type=private;pin-value=..."
+
+    macsec_policy=1          # require MACsec
+    macsec_integ_only=0      # confidentiality (encrypt), not integrity-only
+    macsec_replay_protect=1
+    macsec_replay_window=0
+}