# hostapd wired 802.1X authenticator + MACsec, ONE per supplicant-facing link.
# Copy per link and set `interface=` to that link's NIC (e.g. eth1 for vmbr-secA).
# Run: hostapd -dd authenticator/hostapd-wired-<link>.conf
#
# BENCH-VERIFY: wired+MACsec authenticator directives vary by hostapd build/version
# (CONFIG_MACSEC + CONFIG_DRIVER_WIRED must be compiled in). Confirm your hostapd
# was built with MACsec; `hostapd -v` / package notes. This is the half most
# likely to need tweaking on first bring-up.

interface=eth1
driver=wired

# --- 802.1X (external RADIUS = FreeRADIUS on the serving host) ---------------
ieee8021x=1
eap_server=0
eapol_version=2
use_pae_group_addr=1                  # listen on 01:80:c2:00:00:03 (PAE)

auth_server_addr=192.168.50.10        # serving host (FreeRADIUS)
auth_server_port=1812
auth_server_shared_secret=testing123  # MUST match freeradius/clients.conf + .env RADIUS_SECRET

# --- MACsec / MKA -----------------------------------------------------------
# macsec_policy=1 requires MACsec; the CAK is derived from the EAP MSK and MKA
# negotiates the SAK. This hostapd is the MKA key server for the link.
macsec_policy=1
macsec_integ_only=0                   # confidentiality (encrypt), matches the supplicant
macsec_replay_protect=1
macsec_replay_window=0
mka_priority=128                      # lower than the supplicant's default => we're key server

# After MKA succeeds the kernel creates a macsec iface on top of `interface`.
# setup-link.sh bridges that to the serving uplink so DHCP/NVMe flow through.