sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
Files
33de300af824e48ca1952ef03d41541a4475b496
diskless-workstation/serving/.env.example
T
Audiobuzz 8376f9a92e enrol-broker: run in serving stack + fix step signer path end-to-end 
Verifying the step signer against a real step-ca surfaced two real bugs the
mock signer had hidden, plus made the bench CA actually initialise:

- signer.go: move --not-after from `step ca token` (validity caps ~1h ->
  "token validity too long") to `step ca sign` (it is the CERT lifetime).
  Without this the step signer never issues a cert.
- dot1x-bench compose: DOCKER_STEPCA_INIT_PASSWORD_FILE pointed at a file that
  does not exist at first init (it is an INPUT path), so `step ca init` failed
  and never wrote secrets/password. Use DOCKER_STEPCA_INIT_PASSWORD (the value)
  which the entrypoint writes to secrets/password, where bootstrap + broker read.
- bootstrap.sh: self-heal the root-owned ./pki Docker auto-creates; detect the
  CA password at $STEPPATH/password or secrets/password (varies by image
  version); raise authority.claims.maxTLSCertDuration so 720h fleet certs are
  allowed (stock cap 24h, which also blocked bootstrap's own RADIUS cert); fix
  RADIUS cert paths to write via the /export mount (were host paths run inside
  the container, so they never resolved).

- serving stack: add the enrol-broker service (temporary home; nginx already
  proxies /enrol/) defaulting to the zero-dependency lab path (mock signer +
  insecure loopback admin), with ENROL_* knobs to switch to step + mTLS.
- verify-serving.sh: exercise request -> approve -> cert through the deployed
  nginx /enrol/ proxy.
- TODO #11: record the step-signer verification + the two fixes.

Step signer VERIFIED end-to-end against a real step-ca: issued cert chains to
the fleet root, EKU clientAuth, hostnqn derived from serial.
2026-07-02 08:35:35 +00:00

130 lines
6.7 KiB
Bash
Raw Blame History

# Copy to .env and edit for your test LAN/bridge, then: docker compose up -d
# Release being served. Must match the Packer build (fleet-<version>.efi).
IMAGE_VERSION=0.0.0-2eefd97
# OCI release-artifact image (built by scripts/build-oci.sh). Mounted directly
# as a Docker image volume — the default artifact source. Pin by digest in
# production, e.g. OCI_IMAGE=git.bitasylum.org/audiobuzz/fleet-boot@sha256:…
OCI_IMAGE=git.bitasylum.org/audiobuzz/fleet-boot
# Fallback only (Docker < 28 / offline): local Packer output dir, used by the
# commented bind-mounts in docker-compose.yml. Ignored when image volumes work.
ARTIFACT_SRC=../artifacts/0.0.0-2eefd97
# SPDK NVMe/TCP target image — prebuilt + pushed by CI
# (.gitea/workflows/spdk-image.yaml); the serving host just pulls it.
SPDK_IMAGE=git.bitasylum.org/audiobuzz/spdk-nvmf
SPDK_VERSION=v24.09
# dnsmasq image — prebuilt + pushed by CI (.gitea/workflows/dnsmasq-image.yaml);
# GENERIC (no Secure Boot keys / no iPXE binary). Pulled, not built at deploy.
DNSMASQ_IMAGE=git.bitasylum.org/audiobuzz/fleet-dnsmasq
DNSMASQ_VERSION=latest
# fleet-ipxe image — the SIGNED iPXE bootloader (snponly.efi) for PXE-only hosts,
# built + signed (fleet db key) + pushed by CI (.gitea/workflows/ipxe-image.yaml).
# Mounted into dnsmasq at /ipxe. Per-environment (signature is db-key-specific);
# pin by digest in production, e.g. fleet-ipxe@sha256:…
IPXE_IMAGE=git.bitasylum.org/audiobuzz/fleet-ipxe
IPXE_VERSION=latest
# kiosk SPA image — the spaceship-terminal web app, now an INDEPENDENT project
# (the kiosk-app git submodule) with its own CI that builds + pushes this image.
# The 'kiosk' compose service pulls it; the main nginx reverse-proxies /kiosk/ to
# it. For local dev, uncomment `build: ./kiosk-app` on that service instead.
KIOSK_IMAGE=git.bitasylum.org/audiobuzz/fleet-kiosk
KIOSK_VERSION=latest
# --- This serving host on the boot LAN -------------------------------------
BOOT_IFACE=ens19 # interface facing the booting client / test bridge
SERVER_IP=192.168.50.10 # this host's address on BOOT_IFACE (DHCP/DNS/HTTP/NVMe)
GATEWAY_IP=192.168.50.1
UPSTREAM_DNS=10.42.42.254
# --- DHCP scope ------------------------------------------------------------
DHCP_RANGE_START=192.168.50.100
DHCP_RANGE_END=192.168.50.200
DHCP_LEASE=12h
# --- Kiosk SPA -------------------------------------------------------------
# Loopback port the kiosk-app container publishes; the host-network main nginx
# reverse-proxies /kiosk/ to http://127.0.0.1:${KIOSK_APP_PORT}. Change only if
# 8088 clashes on the serving host (also update http/default.conf proxy_pass).
KIOSK_APP_PORT=8088
# Local testing secrets for the kiosk BFF. This file is GITIGNORED — safe to
# paste a real token here. Template/docs: .env.example.
HASS_URL=http://cortana.bitasylum.org:8123
# 👇 paste your Home Assistant long-lived access token here, then restart the BFF
# (npm run bff). Test it with: curl -s localhost:8787/api/health | jq
HASS_TOKEN=<insert-token>
# --- DNS names -------------------------------------------------------------
BOOT_DOMAIN=fleet.lab
BOOT_HOST=boot.fleet.lab # HTTP boot server name (UKI)
# NVMe/TCP discovery name. Put THIS value in the UKI cmdline as NVMET_TRADDR
# (extract-artifacts.sh) so rd.nvmf.discover resolves here per environment.
NVME_HOST=nvme.fleet.lab
# Remote audit collector name. Host-generic — bake into the image's rsyslog
# forward rule so every host offloads auditd here; resolved to this serving host.
AUDIT_HOST=audit.fleet.lab
# --- NVMe/TCP target -------------------------------------------------------
# Per-version subsystem NQN base. The long-lived target serves each rootfs
# version as its OWN subsystem "<base>-<version>" (so a new build is added live
# without disturbing connected hosts). Per release the exact NQN is read from
# that version's verity.json (.subnqn, written by extract-artifacts.sh); this is
# only the fallback/default base and MUST match SUBNQN_BASE in that script.
SUBNQN_BASE=nqn.2026-06.org.example.fleet:rootfs
# Legacy single-version NQN (only the deprecated serving/spdk-setup.sh path).
SUBNQN=nqn.2026-06.org.example.fleet:rootfs
TARGET_PORT=4420
SPDK_CPUMASK=0x1 # one polling core is plenty for a read-only boot fs
# --- TPM enrolment broker (TEMPORARY in this stack — see docs/TODO.md #11) ---
# The broker is the one unauthenticated pre-auth endpoint (nginx proxies /enrol/
# to it). Defaults run the zero-dependency LAB path: a `mock` signer (ephemeral
# CA; certs NOT trusted by RADIUS/NVMe) + plaintext loopback admin — enough to
# exercise the request/approve/poll flow while the host side is built.
#
# For REAL enrolment: set ENROL_SIGNER=step, point ENROL_STEP_CA_URL at a
# reachable step-ca (e.g. the one in serving/dot1x-bench/), drop its root +
# provisioner password into ./enrol-pki/, generate the admin mTLS PKI
# (./enrol-broker/admin-pki.sh ./enrol-pki/broker <admin>), and set
# ENROL_ADMIN_INSECURE=false. Then it belongs in its own CA-co-located stack.
ENROL_SIGNER=mock # mock (lab, no CA) | step (real, needs a CA)
ENROL_ADMIN_INSECURE=true # true = plaintext loopback admin (LAB ONLY); false = mTLS
ENROL_PENDING_TTL=10m # time-box on unapproved requests
ENROL_WORDS=8 # fingerprint word count
ENROL_HOSTNQN_BASE=nqn.2026-06.org.example.fleet:host-
# step signer (only when ENROL_SIGNER=step) — paths are INSIDE the container
# (./enrol-pki is mounted at /pki):
ENROL_STEP_CA_URL= # e.g. https://ca.fleet.lab:8443
ENROL_STEP_CA_ROOT=/pki/root_ca.crt
ENROL_STEP_PROVISIONER=enrol
ENROL_STEP_PASSWORD_FILE=/pki/password
# Issued-cert lifetime. NOTE: the step-ca provisioner must ALLOW this — a stock
# step-ca caps certs at 24h, so 720h is rejected ("requested duration ... more
# than the authorized maximum certificate duration of 24h"). The bench
# step-ca/bootstrap.sh now raises authority.claims.maxTLSCertDuration; a
# different CA needs the same. Verified end-to-end against a real step-ca.
ENROL_CERT_NOT_AFTER=720h
# admin mTLS (only when ENROL_ADMIN_INSECURE=false):
ENROL_ADMIN_CERT=/pki/broker/server.crt
ENROL_ADMIN_KEY=/pki/broker/server.key
ENROL_ADMIN_CLIENT_CA=/pki/broker/admin-ca.crt
# --- SPDK version loader / reaper (declarative rolling updates) -------------
# The spdk-loader service stages + adds ${IMAGE_VERSION} to the long-lived target
# on `compose up`, then auto-removes OLD versions once they drain. Migration =
# bump IMAGE_VERSION above + `docker compose up -d`.
REAP_OLD=true # false = keep old versions until you remove them manually
REAP_POLL_SECONDS=30 # how often to poll connection counts
# Sustained-zero window before an old version is removed. Keep it comfortably
# ABOVE the host's nvme ctrl_loss_tmo so a transient reconnect never gets reaped.
REAP_GRACE_SECONDS=300
Reference in New Issue View Git Blame Copy Permalink