sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
112 Commits 1 Branch 0 Tags
a370f80332dc747f376408a2907d4da14003dce1
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Audiobuzz a370f80332 TODO #11: step signer re-verified on the serving host (720h claim, chain) 2026-07-02 08:45:30 +00:00
Audiobuzz b8f88091f1 bootstrap: connect to step-ca via localhost, not ca.fleet.lab 
The `step` CLI ran against --ca-url https://ca.fleet.lab:8443, but that name is
only served by the fleet dnsmasq to booting clients — the serving host's own
resolver can't resolve it ("no such host on 127.0.0.53"), so provisioner list +
RADIUS cert issuance failed. Connect over CA_CONNECT (default localhost, which
the compose puts in the CA cert SAN); CA_DNS stays the cert/SAN + RADIUS CN name.
 2026-07-02 08:41:03 +00:00
Audiobuzz 8376f9a92e enrol-broker: run in serving stack + fix step signer path end-to-end 
Verifying the step signer against a real step-ca surfaced two real bugs the
mock signer had hidden, plus made the bench CA actually initialise:

- signer.go: move --not-after from `step ca token` (validity caps ~1h ->
  "token validity too long") to `step ca sign` (it is the CERT lifetime).
  Without this the step signer never issues a cert.
- dot1x-bench compose: DOCKER_STEPCA_INIT_PASSWORD_FILE pointed at a file that
  does not exist at first init (it is an INPUT path), so `step ca init` failed
  and never wrote secrets/password. Use DOCKER_STEPCA_INIT_PASSWORD (the value)
  which the entrypoint writes to secrets/password, where bootstrap + broker read.
- bootstrap.sh: self-heal the root-owned ./pki Docker auto-creates; detect the
  CA password at $STEPPATH/password or secrets/password (varies by image
  version); raise authority.claims.maxTLSCertDuration so 720h fleet certs are
  allowed (stock cap 24h, which also blocked bootstrap's own RADIUS cert); fix
  RADIUS cert paths to write via the /export mount (were host paths run inside
  the container, so they never resolved).

- serving stack: add the enrol-broker service (temporary home; nginx already
  proxies /enrol/) defaulting to the zero-dependency lab path (mock signer +
  insecure loopback admin), with ENROL_* knobs to switch to step + mTLS.
- verify-serving.sh: exercise request -> approve -> cert through the deployed
  nginx /enrol/ proxy.
- TODO #11: record the step-signer verification + the two fixes.

Step signer VERIFIED end-to-end against a real step-ca: issued cert chains to
the fleet root, EKU clientAuth, hostnqn derived from serial.
 2026-07-02 08:35:35 +00:00
Audiobuzz 9e1dbd3ef7 initial tpm broker 2026-06-28 10:33:14 +00:00
Audiobuzz 3bcf16e384 Merge remote-tracking branch 'origin/main' into tpm-enroll 2026-06-28 18:32:39 +09:30
Audiobuzz 5232b36614 tpm design 2026-06-28 18:32:36 +09:30
audiobuzz 889db569e5 Merge pull request 'workstation-api' (#9) from workstation-api into main 
Reviewed-on: https://git.bitasylum.org/audiobuzz/diskless-workstation/pulls/9
 2026-06-28 08:45:20 +00:00
Audiobuzz bc14b8986d fixing final SPDK deployment 2026-06-28 08:44:49 +00:00
Audiobuzz 2cf7ad4ffb Apply chromium policy hardening 2026-06-28 03:18:54 +00:00
Audiobuzz ad6b7e3366 Add Host API and fix kiosk performance 2026-06-28 03:14:25 +00:00
Audiobuzz b5163f958e Fix upper case branch name bug 2026-06-28 02:19:36 +00:00
Audiobuzz b159bc678c Fix discovery duplicate 2026-06-28 02:11:08 +00:00
Audiobuzz 5e4ee87e88 Fix symnlinking of releases 2026-06-28 01:50:33 +00:00
Audiobuzz 02ffd7d885 Adding spdk loader 2026-06-27 10:44:42 +00:00
Audiobuzz e43112b0f1 Permanent SPDK trial 2026-06-27 19:29:19 +09:30
Audiobuzz ce5af959ad Add SIEM 2026-06-27 08:52:17 +00:00
audiobuzz 4d51fa97c2 Merge pull request 'kiosk-app-separate' (#8) from kiosk-app-separate into main 
Reviewed-on: https://git.bitasylum.org/audiobuzz/diskless-workstation/pulls/8
 2026-06-26 00:25:05 +00:00
Audiobuzz 184c7859cf exclude non-rootfs files from main gitea workflow 2026-06-26 00:06:49 +00:00
Audiobuzz 1612af3a23 Add kiosk-app as a submodule 2026-06-26 09:26:57 +09:30
Audiobuzz c02937f855 Remove kiosk-app (moving to submodule) 2026-06-26 09:26:37 +09:30
Audiobuzz 25d0cfff7c Prep kiosk-app for submodule split 2026-06-25 23:55:29 +00:00
Audiobuzz c3507cda6e Update SSP 2026-06-25 23:46:42 +00:00
Audiobuzz dea7ca451a Adding dot1x support 2026-06-22 20:50:48 +00:00
Audiobuzz 1f62e5ab17 Add multi branch handling 2026-06-21 09:18:22 +00:00
Audiobuzz 3226a44d5a Refactor dnsmasq to build as a container. Add signed iPXE image build 2026-06-21 09:11:23 +00:00
Audiobuzz 535793228e Merge remote-tracking branch 'origin/main' into pxe 2026-06-20 21:47:53 +09:30
Audiobuzz d2b2156a22 Fixed the secure boot enrollment script 2026-06-20 12:16:37 +00:00
audiobuzz fd80a081da Merge pull request 'Add secure boot helper' (#6) from secureboot into main 
Reviewed-on: https://git.bitasylum.org/audiobuzz/diskless-workstation/pulls/6
 2026-06-20 09:26:01 +00:00
Audiobuzz 33583bb4d8 Tidy up pxe flow 2026-06-20 09:19:01 +00:00
Audiobuzz fb69068980 Update pxe boot flow 2026-06-20 09:17:05 +00:00
audiobuzz 3120ee49c4 Merge pull request 'secureboot' (#5) from secureboot into main 
Reviewed-on: https://git.bitasylum.org/audiobuzz/diskless-workstation/pulls/5
 2026-06-20 09:14:10 +00:00
Audiobuzz e3978bb210 Add secure boot helper 2026-06-20 06:04:04 +00:00
Audiobuzz 417f36d1b7 Merge branch 'stig' into secureboot 2026-06-20 14:51:11 +09:30
Audiobuzz 9b0d4a61ea Change email notification to syslog 2026-06-20 14:50:40 +09:30
Audiobuzz 1887b6f0a2 Add sbsigntool to the build image 2026-06-20 03:32:56 +00:00
Audiobuzz 249aeea591 Update device type for packer vm 2026-06-20 01:31:36 +00:00
Audiobuzz 65768b759c Update core layout for packer vm 2026-06-20 01:29:40 +00:00
Audiobuzz ec92417312 Initial Secure boot setup 2026-06-20 00:40:59 +00:00
Audiobuzz b67a23e718 Tightening Stig hardening 2026-06-20 00:05:19 +00:00
audiobuzz b9258e7490 Merge pull request 'app' (#4) from app into main 
Reviewed-on: https://git.bitasylum.org/audiobuzz/diskless-workstation/pulls/4
 2026-06-19 23:52:58 +00:00
Audiobuzz 9f7d8d13f4 Fix kiosk startup 2026-06-19 11:58:41 +00:00
Audiobuzz 98c71474d3 Add fleet hostnaming 2026-06-19 09:59:49 +00:00
Audiobuzz 13ac648267 adding secure rsyslog exceptions 2026-06-19 05:01:32 +00:00
Audiobuzz 18b47ca5b0 re-enable stig 2026-06-19 04:22:03 +00:00
Audiobuzz 77416a8e37 Fix fapolicyd for kiosk 2026-06-19 04:21:15 +00:00
Audiobuzz c150dd6eba Point images at harbor 2026-06-19 04:00:47 +00:00
Audiobuzz 51d2385b21 disable stig for now 2026-06-19 02:45:39 +00:00
Audiobuzz 72e57174c6 disable stig for now 2026-06-19 02:05:51 +00:00
Audiobuzz bc8247b410 Add audit log sending 2026-06-19 00:20:34 +00:00
Audiobuzz 5e2bfef575 Add banner and debug shell 2026-06-19 00:06:39 +00:00
Audiobuzz 6608818902 Fix stig over hardening of kiosk account 2026-06-18 13:28:01 +00:00
Audiobuzz 215b0eb10c Merge branch 'main' into app 2026-06-18 21:37:33 +09:30
audiobuzz d192ac0215 Merge pull request 'hardening' (#3) from hardening into main 
Reviewed-on: https://git.bitasylum.org/audiobuzz/diskless-workstation/pulls/3
 2026-06-18 12:05:16 +00:00
Audiobuzz 3b776dd970 Add app 2026-06-18 12:03:45 +00:00
Audiobuzz ada4aa4b18 Add STIG hrdening 2026-06-18 10:00:41 +00:00
Audiobuzz 210ab9283d Merge branch 'main' into plymouth 2026-06-18 19:09:30 +09:30
audiobuzz c6a9671fae Merge pull request 'plymouth-working' (#2) from plymouth-working into main 
Reviewed-on: https://git.bitasylum.org/audiobuzz/diskless-workstation/pulls/2
 2026-06-18 09:38:48 +00:00
Audiobuzz a53357216d Add ntp time source and browser policy 2026-06-18 09:35:58 +00:00
Audiobuzz 8f8e24ac28 Update boot theme 2026-06-18 08:41:22 +00:00
Audiobuzz 838ffd600b Lock down chromium policy 2026-06-17 22:52:18 +00:00
Audiobuzz 0fdc7980cc Enable boot splash 2026-06-17 22:21:08 +00:00
Audiobuzz de0c832fb4 Merge branch 'main' into plymouth 2026-06-17 23:59:25 +09:30
Audiobuzz 3ef34745c9 Adding Plymouth 2026-06-17 14:28:27 +00:00
audiobuzz 82d029ded2 Merge pull request 'Network Manager refactor' (#1) from network-manager into main 
Reviewed-on: https://git.bitasylum.org/audiobuzz/diskless-workstation/pulls/1
 2026-06-17 14:27:42 +00:00
Audiobuzz 55aa517976 Network Manager refactor 2026-06-17 13:40:28 +00:00
Audiobuzz 4b0e0135b3 Fix kiosk mode 2026-06-17 13:20:52 +00:00
Audiobuzz fd84ba4180 Turn off kiosk by default 2026-06-17 12:44:07 +00:00
Audiobuzz d483cbae98 Tidy up docs that are not needed 2026-06-17 11:37:00 +00:00
Audiobuzz efd756df6c Reducing size with late cleanup 2026-06-17 10:59:48 +00:00
Audiobuzz 0bcf6fb2aa Update kiosk to use weston 2026-06-17 09:32:59 +00:00
Audiobuzz 61088d4e6d Add kiosk 2026-06-16 20:38:26 +00:00
Audiobuzz d331ff5589 Fix user ownership bug 2026-06-16 12:23:16 +00:00
Audiobuzz a2e0a3af62 stripping ssh host keys from build 2026-06-16 12:18:48 +00:00
Audiobuzz df27be40f1 Change to a non-root account with ssh key 2026-06-16 11:12:23 +00:00
Audiobuzz 450a989d4e maintain selinux attributes into the erofs build 2026-06-15 21:45:59 +00:00
Audiobuzz 72d3f49369 split out hash because rocky doesnt support it inline 2026-06-15 12:52:27 +00:00
Audiobuzz 2037531771 Add debug to packer build 2026-06-15 12:02:50 +00:00
Audiobuzz da78ddbd29 Add debug to packer build 2026-06-15 11:39:21 +00:00
Audiobuzz 60a792d1fd Add debug to packer build 2026-06-15 11:16:06 +00:00
Audiobuzz e44dd15267 Fix stuff 2026-06-15 10:52:43 +00:00
Audiobuzz 62e49e6b42 pivot to a systemd unit for the online hook 2026-06-15 08:52:19 +00:00
Audiobuzz 2eefd97c50 Fix missing online hook 2026-06-14 21:50:38 +00:00
Audiobuzz a508dce5cf Fix missing online hook 2026-06-14 13:11:10 +00:00
Audiobuzz 9841455072 Fixing double ip assignment 2026-06-14 12:24:35 +00:00
Audiobuzz 67802e259f Fix pipeline not passing the right variuable 2026-06-14 11:42:00 +00:00
Audiobuzz 754eced171 Disable lz4 compression as the kernel doesnt support it 2026-06-14 10:26:23 +00:00
Audiobuzz 2a09476649 Adding pinned uuid for rootfs 2026-06-14 10:10:02 +00:00
Audiobuzz 942d1cd0dd Fix dhcp of interface 2026-06-14 09:31:52 +00:00
Audiobuzz cbd92baae7 Fix missing head command 2026-06-14 08:23:52 +00:00
Audiobuzz cada9520be Fixinf SPDK 2026-06-14 07:32:06 +00:00
Audiobuzz 1a0cd5c37f Fix dpdk build deps 2026-06-14 06:12:35 +00:00
Audiobuzz dbf0d075bc Fix build dependencies 2026-06-14 06:02:51 +00:00
Audiobuzz 62e997297c Add SPDDK build 2026-06-14 05:58:55 +00:00
Audiobuzz e98d8813cf Adding vfs to buildah script 2026-06-13 08:30:59 +00:00
Audiobuzz b948557cd7 Add systemd-boot-efi to the runner 2026-06-13 07:02:38 +00:00
Audiobuzz ce87ebdbbd Fix ukify 2026-06-13 05:56:32 +00:00
Audiobuzz 327799a666 Adding packer host tooling 2026-06-13 05:07:49 +00:00
Audiobuzz 8f7833a7e0 Updating docs 2026-06-13 05:06:44 +00:00
Audiobuzz b27913a7c9 Update Documents to latest implementation 2026-06-13 04:46:01 +00:00
Audiobuzz ea7548bd35 Fixing rootovl references 2026-06-13 04:45:41 +00:00