Audiobuzz
2ef0c1747d
Complete the deployment story for the server-side control plane: - docker-compose.yml: private InfluxDB (published to loopback only) + a host-networked fleet-manager (reaches the loopback enrol-broker on 127.0.0.1:9443 and binds a routable gRPC agent listener, like the broker). - .env.example: RP origin (diskless-server.bitasylum.org), Influx token/DB password, cert/PKI paths; the Influx token wires influxdb + manager with one value. - server-pki.sh: issue the agent-plane server cert from the fleet CA (step) and stage the fleet root as the client-verify CA. - DEPLOY.md: end-to-end runbook — three-cert PKI (fleet-CA agent cert, broker admin-client cert, Let's Encrypt DNS-01 UI cert), register-admin passkey bootstrap, compose up, hardware-free smoke test, backups. - .dockerignore: keep host node_modules/dist/pki/secrets out of the build context so the embedded SPA is the one built in-image. - .gitignore: never commit .env / issued PKI / data. Design docs marked as-built: fleet-management-design.md as-built note (resolved forks — gRPC bidi transport, InfluxDB metrics, SPA graphs, passkey admin auth, broker fold-in "alongside"); tpm-enrolment-design.md (broker fold-in + agent transport fork resolved); TODO.md #14 → partly built, with the on-host agent + per-host boot-version assignment (#6) called out as the remaining work.
72 lines
3.3 KiB
Bash
Executable File
72 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# server-pki.sh — issue the fleet-manager AGENT-plane server cert from the fleet
|
|
# CA, and stage the fleet root as the agent client-verify CA.
|
|
#
|
|
# The agent plane is gRPC + mTLS: enrolled hosts present their TPM identity cert
|
|
# (fleet CA), and they verify the MANAGER's server cert against the same fleet
|
|
# root they hold. So the manager's agent-plane server cert MUST be signed by the
|
|
# fleet CA — this script issues it via `step ca certificate` against the running
|
|
# fleet step-ca (serving/dot1x-bench/), the same CA that signs enrolment certs.
|
|
#
|
|
# This does NOT issue:
|
|
# - the ADMIN-plane UI cert -> Let's Encrypt DNS-01 (external ACME client;
|
|
# drop fullchain/privkey into ./pki/admin/). See DEPLOY.md.
|
|
# - the manager's BROKER client cert -> ../enrol-broker/admin-pki.sh (admin CA):
|
|
# ../enrol-broker/admin-pki.sh ../dot1x-bench/pki/broker fleet-manager
|
|
#
|
|
# Usage: server-pki.sh
|
|
# env overrides:
|
|
# OUT=./pki/agent output dir
|
|
# AGENT_SANS=diskless-server.bitasylum.org,10.0.0.1 SANs hosts dial (DNS/IP, comma-sep)
|
|
# FLEET_CA_URL=https://ca.fleet.lab:8443
|
|
# FLEET_CA_ROOT=../dot1x-bench/pki/root_ca.crt
|
|
# STEP_PROVISIONER=enrol
|
|
# STEP_PROVISIONER_PASSWORD_FILE=../dot1x-bench/pki/stepca/secrets/password
|
|
# CERT_NOT_AFTER=8760h
|
|
set -euo pipefail
|
|
|
|
OUT=${OUT:-./pki/agent}
|
|
AGENT_SANS=${AGENT_SANS:-diskless-server.bitasylum.org}
|
|
FLEET_CA_URL=${FLEET_CA_URL:-https://ca.fleet.lab:8443}
|
|
FLEET_CA_ROOT=${FLEET_CA_ROOT:-../dot1x-bench/pki/root_ca.crt}
|
|
STEP_PROVISIONER=${STEP_PROVISIONER:-enrol}
|
|
STEP_PROVISIONER_PASSWORD_FILE=${STEP_PROVISIONER_PASSWORD_FILE:-../dot1x-bench/pki/stepca/secrets/password}
|
|
CERT_NOT_AFTER=${CERT_NOT_AFTER:-8760h}
|
|
|
|
command -v step >/dev/null || { echo "error: 'step' CLI not found (smallstep/cli)"; exit 1; }
|
|
[ -f "$FLEET_CA_ROOT" ] || { echo "error: fleet root not found at $FLEET_CA_ROOT (bootstrap the fleet CA first)"; exit 1; }
|
|
[ -f "$STEP_PROVISIONER_PASSWORD_FILE" ] || { echo "error: provisioner password not found at $STEP_PROVISIONER_PASSWORD_FILE"; exit 1; }
|
|
|
|
mkdir -p "$OUT"
|
|
|
|
# The fleet root doubles as the agent-plane CLIENT CA (verifies host TPM certs).
|
|
cp "$FLEET_CA_ROOT" "$OUT/fleet-ca.crt"
|
|
|
|
# First SAN is the CN; every SAN (DNS name / IP) hosts might dial goes in --san.
|
|
primary=${AGENT_SANS%%,*}
|
|
san_args=()
|
|
IFS=',' read -ra sans <<<"$AGENT_SANS"
|
|
for s in "${sans[@]}"; do san_args+=(--san "$s"); done
|
|
|
|
echo "==> issuing agent-plane server cert (CN=$primary, SANs=$AGENT_SANS)"
|
|
step ca certificate "$primary" "$OUT/server.crt" "$OUT/server.key" \
|
|
--ca-url "$FLEET_CA_URL" \
|
|
--root "$FLEET_CA_ROOT" \
|
|
--provisioner "$STEP_PROVISIONER" \
|
|
--provisioner-password-file "$STEP_PROVISIONER_PASSWORD_FILE" \
|
|
--not-after "$CERT_NOT_AFTER" \
|
|
--force \
|
|
"${san_args[@]}"
|
|
|
|
chmod 600 "$OUT/server.key"
|
|
|
|
echo
|
|
echo "done. staged in $OUT :"
|
|
echo " server.crt / server.key -> FLEET_MGR_AGENT_CERT / _KEY"
|
|
echo " fleet-ca.crt -> FLEET_MGR_AGENT_CLIENT_CA (verifies host TPM certs)"
|
|
echo
|
|
echo "next:"
|
|
echo " - admin UI cert : Let's Encrypt DNS-01 -> ./pki/admin/{fullchain,privkey}.pem (DEPLOY.md)"
|
|
echo " - broker client : ../enrol-broker/admin-pki.sh ../dot1x-bench/pki/broker fleet-manager"
|
|
echo " then: cp -r ../dot1x-bench/pki/broker ./pki/broker"
|