14 lines
906 B
Bash
14 lines
906 B
Bash
# Copy to .env and edit, then: docker compose up -d step-ca
|
|
CA_DNS=ca.fleet.lab # DNS name(s) clients reach step-ca on (resolved by serving dnsmasq)
|
|
CA_PORT=8443 # step-ca listen port (host networking)
|
|
CA_PASSWORD=changeme-bench # password protecting the CA keys (bench only)
|
|
RADIUS_SECRET=testing123 # shared secret between the authenticator (hostapd) and FreeRADIUS
|
|
|
|
# --- enrol-broker (TPM identity enrolment; docs/tpm-enrolment-design.md) -------
|
|
# Before `docker compose up -d enrol-broker`, issue the admin mTLS PKI (a
|
|
# DEDICATED admin CA, separate from the fleet CA) and one client cert per admin:
|
|
# ../enrol-broker/admin-pki.sh ./pki/broker alice
|
|
# then import pki/broker/clients/alice.p12 (empty password) into the browser and
|
|
# open https://127.0.0.1:9443/ . The public /enrol/ endpoint is reached via the
|
|
# serving stack's nginx (http://boot.fleet.lab/enrol/).
|