Adding dot1x support

2026-06-22 20:50:48 +00:00
parent 1f62e5ab17
commit dea7ca451a
13 changed files with 592 additions and 0 deletions
@@ -0,0 +1,47 @@
+# =============================================================================
+# Secure-path bench: step-ca (fleet CA) + FreeRADIUS (EAP-TLS), on the SERVING
+# host (the trusted side). The authenticator (hostapd-wired + MACsec) is NOT
+# here — it runs on a node between each workstation and this host (see
+# authenticator/). Host networking so FreeRADIUS sees RADIUS/1812 from the
+# authenticator and step-ca is reachable for enrolment.
+#
+#   cp .env.example .env   # set CA_DNS / CA_PASSWORD / RADIUS_SECRET
+#   docker compose up -d step-ca && ./step-ca/bootstrap.sh && docker compose up -d freeradius
+#
+# Images are pulled from Docker Hub here; mirror them through your registry
+# (like the serving stack does for nginx/alpine) if you don't have egress.
+# =============================================================================
+
+services:
+  # --- Fleet CA (signs TPM-generated CSRs; trust anchor for the image) --------
+  step-ca:
+    image: smallstep/step-ca:latest
+    network_mode: host
+    restart: unless-stopped
+    environment:
+      # Auto-init on first start (smallstep image convention). bootstrap.sh adds
+      # the enrolment provisioner + issues the RADIUS server cert afterwards.
+      DOCKER_STEPCA_INIT_NAME: "Fleet Bench CA"
+      DOCKER_STEPCA_INIT_DNS_NAMES: "${CA_DNS:-ca.fleet.lab},localhost"
+      DOCKER_STEPCA_INIT_ADDRESS: ":${CA_PORT:-8443}"
+      DOCKER_STEPCA_INIT_PROVISIONER_NAME: "enrol"
+      DOCKER_STEPCA_INIT_PASSWORD_FILE: "/home/step/secrets/password"
+    volumes:
+      - ./pki/stepca:/home/step          # CA state (root/intermediate/keys/db) — gitignored
+      - ./pki:/export                     # bootstrap.sh drops root_ca.crt here for the image/radius
+
+  # --- RADIUS (EAP-TLS; validates client cert vs step-ca root, returns MSK) ---
+  freeradius:
+    image: freeradius/freeradius-server:latest
+    network_mode: host                    # RADIUS 1812/1813 from the authenticator
+    restart: unless-stopped
+    depends_on:
+      - step-ca
+    # -X = full debug to stdout; priceless for the first bring-up. Drop to plain
+    # `radiusd -f` once EAP-TLS is green.
+    command: ["radiusd", "-X"]
+    volumes:
+      - ./freeradius/clients.conf:/etc/raddb/clients.conf:ro
+      - ./freeradius/mods-available/eap:/etc/raddb/mods-available/eap:ro
+      # certs issued by bootstrap.sh: the RADIUS server cert/key + the CA root.
+      - ./pki/radius:/etc/raddb/certs/fleet:ro