# EAP module, trimmed to EAP-TLS for the fleet bench. Replaces the stock eap mod.
# EAP-TLS is mutual-cert by definition: the client (TPM cert) is validated against
# ca_file (= step-ca root); the server presents server.pem so the supplicant can
# validate it against the SAME root baked into the image as radius-ca.pem. On
# success FreeRADIUS exports the MSK (MS-MPPE keys) → the authenticator derives
# the MACsec CAK (MKA). No `users` entry is needed for cert-only auth.
eap {
    default_eap_type = tls
    timer_expire     = 60
    ignore_unknown_eap_types = no
    cisco_accounting_username_bug = no
    max_sessions = ${max_requests}

    tls-config tls-common {
        certificate_file = /etc/raddb/certs/fleet/server.pem
        private_key_file = /etc/raddb/certs/fleet/server.key
        # private_key_password unset — step-ca issues an unencrypted key here.
        ca_file = /etc/raddb/certs/fleet/ca.pem      # step-ca root: validates client (TPM) certs
        dh_file = ${certdir}/dh                       # shipped by the image's bootstrap
        random_file = /dev/urandom

        # BENCH-VERIFY: many wired-MACsec supplicants negotiate EAP-TLS 1.2; bump
        # to 1.3 once confirmed working. Keep min>=1.2.
        tls_min_version = "1.2"
        tls_max_version = "1.2"
        cipher_list = "DEFAULT"
        cipher_server_preference = no
        ecdh_curve = ""

        # OCSP/CRL against step-ca for revocation can be enabled here later
        # (ocsp { enable = yes ... }) — bench accepts any cert signed by the root.
    }

    tls {
        tls = tls-common
    }
}