# Copy to .env and edit, then: docker compose up -d step-ca
CA_DNS=ca.fleet.lab          # DNS name(s) clients reach step-ca on (resolved by serving dnsmasq)
CA_PORT=8443                 # step-ca listen port (host networking)
CA_PASSWORD=changeme-bench   # password protecting the CA keys (bench only)
RADIUS_SECRET=testing123     # shared secret between the authenticator (hostapd) and FreeRADIUS

# --- enrol-broker (TPM identity enrolment; docs/tpm-enrolment-design.md) -------
# Before `docker compose up -d enrol-broker`, issue the admin mTLS PKI (a
# DEDICATED admin CA, separate from the fleet CA) and one client cert per admin:
#   ../enrol-broker/admin-pki.sh ./pki/broker alice
# then import pki/broker/clients/alice.p12 (empty password) into the browser and
# open https://127.0.0.1:9443/ . The public /enrol/ endpoint is reached via the
# serving stack's nginx (http://boot.fleet.lab/enrol/).