fleet-agent: on-host TPM-mTLS telemetry client (v1)

Build the on-host agent that pairs with fleet-hostapi and feeds the
fleet-manager control plane (TODO #14 "STILL TO BUILD (a)"). Nothing on the
workstation talked to the manager before this; Monitor + InfluxDB stayed empty.

Scope: telemetry only. The agent reuses the host TPM identity for mTLS (read-only
tpmkey.LoadSigner at 0x81000100 + cert from NV 0x01800100; the private key never
leaves the TPM), opens the long-lived FleetAgent.Session bidi stream, sends Hello
+ periodic HealthSnapshot (load/cpu/temp/mem/tmpfs/nvme/auth/selinux/chrony/kiosk,
probed read-only from /proc+/sys plus hostapi facts), and LOGS but does not act on
the DesiredState/Command it receives. Reconcile actuators (kiosk URL, reboot,
drain) are deferred until the telemetry half is bench-verified.

- files/agent/: new module (go-tpm + grpc), static CGO_ENABLED=0 like enrol/hostapi.
  Copies the enrol tpmkey (+ read-only LoadSigner) and the generated fleet.agent.v1
  proto so it stays self-contained without importing the initramfs enrol module.
- files/agent/simtest/: proves the TPM-signed cert completes a real mTLS client-auth
  handshake (RequireAndVerifyClientCert) against the go-tpm software simulator.
- files/etc/fleet-agent/agent.env: fleet-generic config (manager DNS name, fleet CA
  reused from radius-ca.pem, TPM handle/nvindex, interval). No per-host state.
- fleet-agent.service: hardened unit (tss group for /dev/tpmrm0, INET egress).
- CI builds fleet-agent out-of-VM + runs vet/test + the simulator handshake test.
- Packer: enable_agent flag (default on) + 2b-agent provisioner + fapolicyd trust.
  Post-switch-root only, so no dracut/initramfs changes.
- docs: TODO #14 + fleet-management-design as-built updated.

Requires the host already enrolled (broker approve births the inventory row) —
else the manager returns PermissionDenied, the correct "not enrolled yet" signal.

diskless.pkr.hcl

@@ -130,6 +130,12 @@ variable "kiosk_url" {
   default     = "http://boot.fleet.lab/kiosk/"
 }
 
+variable "enable_agent" {
+  type        = bool
+  description = "Build-time feature flag for the on-host fleet-agent (telemetry client that dials the fleet-manager over TPM-mTLS and streams health; docs/fleet-management-design.md). true (default) installs /usr/local/bin/fleet-agent + fleet-agent.service; false skips it (the auth stack still boots — the agent is a management add-on). Config is fleet-generic in files/etc/fleet-agent/agent.env; set the manager DNS name there per environment."
+  default     = true
+}
+
 variable "boot_splash" {
   type        = bool
   description = "true (default): bake 'rhgb quiet' into the UKI cmdline so Plymouth shows a graphical boot splash (covers the network-auth + NVMe/TCP + verity phase). false: bake 'plymouth.enable=0' for a fully verbose console boot — use while debugging the boot chain. Plymouth itself is always in the image; this only flips the cmdline. (The cmdline is immutable once signed, so this is a build-time choice.)"
@@ -259,6 +265,18 @@ build {
     destination = "/tmp/fleet-hostapi"
   }
 
+  # On-host fleet-agent: the systemd unit is staged from here; the static binary
+  # (built OUT OF THE VM like enrol/hostapi) is staged separately. The baked,
+  # fleet-generic config lands via the /tmp/etc-stage contents upload below.
+  provisioner "file" {
+    source      = "files/agent"
+    destination = "/tmp/"
+  }
+  provisioner "file" {
+    source      = "files/agent/bin/fleet-agent"
+    destination = "/tmp/fleet-agent"
+  }
+
   # Custom 'fleet' Plymouth theme (scripted security-handshake splash). Staged to
   # /tmp/plymouth, installed + set default in the package step before dracut runs.
   provisioner "file" {
@@ -608,6 +626,32 @@ build {
     ]
   }
 
+  # --- 2b-agent. On-host fleet-agent (Go, TPM-mTLS telemetry client) --------
+  # Installs the OUT-OF-VM-built /usr/local/bin/fleet-agent (the "Build host Go
+  # binaries" CI step; staged to /tmp/fleet-agent) + its systemd unit + baked,
+  # fleet-generic config, and enables it. The agent dials the fleet-manager over
+  # mTLS using the host's reused TPM identity (signing key at 0x81000100 + cert in
+  # NV 0x01800100) and streams health; NOTHING host-specific is baked (invariant
+  # #1) — the manager DNS name in agent.env is fleet-generic. Gated on
+  # enable_agent so a lean/auth-only build can skip it. The binary is
+  # fapolicyd-trusted in 2c-STIG-postfix (non-RPM exec, like hostapi/kiosk-session).
+  provisioner "shell" {
+    environment_vars = [
+      "ENABLE_AGENT=${var.enable_agent}",
+    ]
+    inline = [
+      "set -euxo pipefail",
+      "if [ \"$ENABLE_AGENT\" != \"true\" ]; then echo 'enable_agent=false -> skipping fleet-agent install.'; exit 0; fi",
+      "install -D -m0755 /tmp/fleet-agent /usr/local/bin/fleet-agent",
+      "install -D -m0644 /tmp/agent/fleet-agent.service /etc/systemd/system/fleet-agent.service",
+      "install -D -m0644 /tmp/etc-stage/fleet-agent/agent.env /etc/fleet-agent/agent.env",
+      "restorecon -R /usr/local/bin/fleet-agent /etc/systemd/system/fleet-agent.service /etc/fleet-agent 2>/dev/null || true",
+      "systemctl enable fleet-agent.service",
+      "rm -rf /tmp/agent /tmp/fleet-agent",
+      "echo '==> fleet-agent enabled (TPM-mTLS telemetry to the fleet-manager)'",
+    ]
+  }
+
   # --- 2c. Admin access: sudo-enabled key user + locked root --------------
   # Fleet-generic (same user + key on every host => NOT per-host state). The
   # key comes from var.ssh_authorized_key (CI secret). If no key is supplied we
@@ -871,9 +915,9 @@ build {
       # custom kiosk files: add them to fapolicyd's trust DB and rebuild it. weston
       # /chromium are RPM-installed so already trusted. (See docs/stig-deviations.md.)
       "if command -v fapolicyd-cli >/dev/null 2>&1; then",
-      "  for f in /usr/local/bin/kiosk-session /usr/local/bin/fleet-sb-enroll /usr/local/bin/fleet-hostapi /usr/sbin/fleet-enrol; do { [ -f \"$f\" ] && fapolicyd-cli --file add \"$f\"; } || true; done",
+      "  for f in /usr/local/bin/kiosk-session /usr/local/bin/fleet-sb-enroll /usr/local/bin/fleet-hostapi /usr/local/bin/fleet-agent /usr/sbin/fleet-enrol; do { [ -f \"$f\" ] && fapolicyd-cli --file add \"$f\"; } || true; done",
       "  fapolicyd-cli --update 2>/dev/null || true",
-      "  echo '==> fapolicyd: trusted custom binaries (kiosk-session, fleet-sb-enroll, fleet-hostapi) + rebuilt trust db'",
+      "  echo '==> fapolicyd: trusted custom binaries (kiosk-session, fleet-sb-enroll, fleet-hostapi, fleet-agent) + rebuilt trust db'",
       "fi",
     ]
   }