# =============================================================================
# Secure-path bench: step-ca (fleet CA) + FreeRADIUS (EAP-TLS), on the SERVING
# host (the trusted side). The authenticator (hostapd-wired + MACsec) is NOT
# here — it runs on a node between each workstation and this host (see
# authenticator/). Host networking so FreeRADIUS sees RADIUS/1812 from the
# authenticator and step-ca is reachable for enrolment.
#
#   cp .env.example .env   # set CA_DNS / CA_PASSWORD / RADIUS_SECRET
#   docker compose up -d step-ca && ./step-ca/bootstrap.sh && docker compose up -d freeradius
#
# Images are pulled from Docker Hub here; mirror them through your registry
# (like the serving stack does for nginx/alpine) if you don't have egress.
# =============================================================================

services:
  # --- Fleet CA (signs TPM-generated CSRs; trust anchor for the image) --------
  step-ca:
    image: harbor.bitasylum.org/dockerhub/smallstep/step-ca:latest
    network_mode: host
    restart: unless-stopped
    environment:
      # Auto-init on first start (smallstep image convention). bootstrap.sh adds
      # the enrolment provisioner + issues the RADIUS server cert afterwards.
      DOCKER_STEPCA_INIT_NAME: "Fleet Bench CA"
      DOCKER_STEPCA_INIT_DNS_NAMES: "${CA_DNS:-ca.fleet.lab},localhost"
      DOCKER_STEPCA_INIT_ADDRESS: ":${CA_PORT:-8443}"
      DOCKER_STEPCA_INIT_PROVISIONER_NAME: "enrol"
      # Password to encrypt the CA keys + 'enrol' provisioner. Must be the VALUE
      # (_PASSWORD), not _PASSWORD_FILE: the latter is an INPUT path the entrypoint
      # reads FROM (for a mounted docker secret), which doesn't exist at first
      # init → `step ca init` fails → no CA, no secrets/password (the "CA not
      # initialised" error). With _PASSWORD the entrypoint WRITES it to
      # /home/step/secrets/password, where bootstrap.sh + the enrol-broker read it.
      DOCKER_STEPCA_INIT_PASSWORD: "${CA_PASSWORD:-changeme-bench}"
    volumes:
      - ./pki/stepca:/home/step          # CA state (root/intermediate/keys/db) — gitignored
      - ./pki:/export                     # bootstrap.sh drops root_ca.crt here for the image/radius

  # --- RADIUS (EAP-TLS; validates client cert vs step-ca root, returns MSK) ---
  freeradius:
    image: harbor.bitasylum.org/dockerhub/freeradius/freeradius-server:latest
    network_mode: host                    # RADIUS 1812/1813 from the authenticator
    restart: unless-stopped
    depends_on:
      - step-ca
    # -X = full debug to stdout; priceless for the first bring-up. Drop to plain
    # `radiusd -f` once EAP-TLS is green.
    command: ["radiusd", "-X"]
    volumes:
      - ./freeradius/clients.conf:/etc/raddb/clients.conf:ro
      - ./freeradius/mods-available/eap:/etc/raddb/mods-available/eap:ro
      # certs issued by bootstrap.sh: the RADIUS server cert/key + the CA root.
      - ./pki/radius:/etc/raddb/certs/fleet:ro

  # --- TPM enrolment broker (the ONE unauthenticated, pre-auth endpoint) -------
  # docs/tpm-enrolment-design.md. Host networking so the SERVING stack's nginx
  # reaches the public listener on 127.0.0.1:9090 (proxied as /enrol/) and step-ca
  # is reachable for signing. The admin web UI (mTLS) listens on 127.0.0.1:9443 —
  # bind it to the management network ONLY; never expose it to the boot LAN.
  #
  # First issue the admin mTLS PKI (dedicated admin CA, NOT the fleet root):
  #   ../enrol-broker/admin-pki.sh ./pki/broker <admin-name>
  enrol-broker:
    build: ../enrol-broker
    network_mode: host
    restart: unless-stopped
    depends_on:
      - step-ca
    environment:
      BROKER_PUBLIC_ADDR: "127.0.0.1:9090"
      BROKER_ADMIN_ADDR: "127.0.0.1:9443"
      BROKER_SIGNER: "step"
      STEP_CA_URL: "https://${CA_DNS:-ca.fleet.lab}:${CA_PORT:-8443}"
      STEP_CA_ROOT: "/pki/root_ca.crt"
      STEP_PROVISIONER: "enrol"
      STEP_PROVISIONER_PASSWORD_FILE: "/pki/stepca/secrets/password"
      STEP_CERT_NOT_AFTER: "720h"
      BROKER_PENDING_TTL: "10m"
      BROKER_WORDS: "8"
      HOSTNQN_BASE: "nqn.2026-06.org.example.fleet:host-"
      # Admin mTLS — server cert/key + the DEDICATED admin client CA (see above).
      BROKER_ADMIN_CERT: "/pki/broker/server.crt"
      BROKER_ADMIN_KEY: "/pki/broker/server.key"
      BROKER_ADMIN_CLIENT_CA: "/pki/broker/admin-ca.crt"
      # HOST plane (SSH host-cert issuance, F-02/P-17). mTLS on the boot LAN:
      # FLEET-signed server cert + the fleet CA (root+intermediate) as the client
      # CA that verifies each host's TPM identity. Certs issued by
      # step-ca/ssh-ca-bootstrap.sh (run it once after bootstrap.sh). 0.0.0.0 so
      # booted hosts can reach it — firewall to the boot LAN.
      BROKER_HOST_ADDR: "0.0.0.0:9444"
      BROKER_HOST_CERT: "/pki/broker/host-server.crt"
      BROKER_HOST_KEY: "/pki/broker/host-server.key"
      BROKER_HOST_CLIENT_CA: "/pki/broker/fleet-client-ca.crt"
      STEP_SSH_CERT_NOT_AFTER: "720h"
    volumes:
      - ./pki:/pki:ro