# Fleet-generic wired 802.1X EAP-TLS + MACsec configuration.
# Identical on every host: per-host identity comes from the TPM
# (key at persistent handle, cert extracted from NV at boot).
ctrl_interface=/run/wpa_supplicant
eapol_version=3
ap_scan=0

network={
    key_mgmt=IEEE8021X
    eap=TLS
    # RADIUS derives the real identity from the certificate CN/SAN
    identity="fleet-host"
    ca_cert="/etc/dot1x/radius-ca.pem"
    client_cert="/run/dot1x/client.pem"

    # BENCH-VERIFY: TPM key reference method on your wpa_supplicant build.
    # Handle is the fleet signing-key handle (non-reserved owner handle; NOT the
    # EK slot 0x81010001 — see CLAUDE.md invariant #1). Keep in sync with the
    # enrolment -handle / rd.dot1x.handle default.
    # Option A (OpenSSL tpm2 provider, direct persistent handle):
    private_key="handle:0x81000100"
    # Option B (tpm2-pkcs11 with a store regenerated into /run at boot):
    # private_key="pkcs11:token=fleet;object=dot1x-key;type=private;pin-value=..."

    macsec_policy=1          # require MACsec
    macsec_integ_only=0      # confidentiality (encrypt), not integrity-only
    macsec_replay_protect=1
    macsec_replay_window=0
}