Audiobuzz
e6b1f0308e
Follow the code removal through the rest of the tree now that Traefik owns UI TLS: - compose: drop FLEET_MGR_ADMIN_BEHIND_PROXY + ADMIN_CERT/_KEY from the manager env; correct the ./pki mount comment (agent + broker certs only). - .env.example: drop the BEHIND_PROXY + cert vars + self-TLS note. - DEPLOY.md / README: remove the self-TLS "alternative" and the BEHIND_PROXY / ADMIN_CERT config rows. - server-pki.sh: point the admin UI cert at Traefik, not ./pki/admin. - delete serving/fleet-manager/acme/ (the retired ACME side-car).
72 lines
3.3 KiB
Bash
Executable File
72 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# server-pki.sh — issue the fleet-manager AGENT-plane server cert from the fleet
|
|
# CA, and stage the fleet root as the agent client-verify CA.
|
|
#
|
|
# The agent plane is gRPC + mTLS: enrolled hosts present their TPM identity cert
|
|
# (fleet CA), and they verify the MANAGER's server cert against the same fleet
|
|
# root they hold. So the manager's agent-plane server cert MUST be signed by the
|
|
# fleet CA — this script issues it via `step ca certificate` against the running
|
|
# fleet step-ca (serving/dot1x-bench/), the same CA that signs enrolment certs.
|
|
#
|
|
# This does NOT issue:
|
|
# - the ADMIN-plane UI cert -> owned by the Traefik ingress (Let's Encrypt
|
|
# DNS-01); the manager never terminates TLS. See DEPLOY.md §2c.
|
|
# - the manager's BROKER client cert -> ../enrol-broker/admin-pki.sh (admin CA):
|
|
# ../enrol-broker/admin-pki.sh ../dot1x-bench/pki/broker fleet-manager
|
|
#
|
|
# Usage: server-pki.sh
|
|
# env overrides:
|
|
# OUT=./pki/agent output dir
|
|
# AGENT_SANS=diskless-server.bitasylum.org,10.0.0.1 SANs hosts dial (DNS/IP, comma-sep)
|
|
# FLEET_CA_URL=https://ca.fleet.lab:8443
|
|
# FLEET_CA_ROOT=../dot1x-bench/pki/root_ca.crt
|
|
# STEP_PROVISIONER=enrol
|
|
# STEP_PROVISIONER_PASSWORD_FILE=../dot1x-bench/pki/stepca/secrets/password
|
|
# CERT_NOT_AFTER=8760h
|
|
set -euo pipefail
|
|
|
|
OUT=${OUT:-./pki/agent}
|
|
AGENT_SANS=${AGENT_SANS:-diskless-server.bitasylum.org}
|
|
FLEET_CA_URL=${FLEET_CA_URL:-https://ca.fleet.lab:8443}
|
|
FLEET_CA_ROOT=${FLEET_CA_ROOT:-../dot1x-bench/pki/root_ca.crt}
|
|
STEP_PROVISIONER=${STEP_PROVISIONER:-enrol}
|
|
STEP_PROVISIONER_PASSWORD_FILE=${STEP_PROVISIONER_PASSWORD_FILE:-../dot1x-bench/pki/stepca/secrets/password}
|
|
CERT_NOT_AFTER=${CERT_NOT_AFTER:-8760h}
|
|
|
|
command -v step >/dev/null || { echo "error: 'step' CLI not found (smallstep/cli)"; exit 1; }
|
|
[ -f "$FLEET_CA_ROOT" ] || { echo "error: fleet root not found at $FLEET_CA_ROOT (bootstrap the fleet CA first)"; exit 1; }
|
|
[ -f "$STEP_PROVISIONER_PASSWORD_FILE" ] || { echo "error: provisioner password not found at $STEP_PROVISIONER_PASSWORD_FILE"; exit 1; }
|
|
|
|
mkdir -p "$OUT"
|
|
|
|
# The fleet root doubles as the agent-plane CLIENT CA (verifies host TPM certs).
|
|
cp "$FLEET_CA_ROOT" "$OUT/fleet-ca.crt"
|
|
|
|
# First SAN is the CN; every SAN (DNS name / IP) hosts might dial goes in --san.
|
|
primary=${AGENT_SANS%%,*}
|
|
san_args=()
|
|
IFS=',' read -ra sans <<<"$AGENT_SANS"
|
|
for s in "${sans[@]}"; do san_args+=(--san "$s"); done
|
|
|
|
echo "==> issuing agent-plane server cert (CN=$primary, SANs=$AGENT_SANS)"
|
|
step ca certificate "$primary" "$OUT/server.crt" "$OUT/server.key" \
|
|
--ca-url "$FLEET_CA_URL" \
|
|
--root "$FLEET_CA_ROOT" \
|
|
--provisioner "$STEP_PROVISIONER" \
|
|
--provisioner-password-file "$STEP_PROVISIONER_PASSWORD_FILE" \
|
|
--not-after "$CERT_NOT_AFTER" \
|
|
--force \
|
|
"${san_args[@]}"
|
|
|
|
chmod 600 "$OUT/server.key"
|
|
|
|
echo
|
|
echo "done. staged in $OUT :"
|
|
echo " server.crt / server.key -> FLEET_MGR_AGENT_CERT / _KEY"
|
|
echo " fleet-ca.crt -> FLEET_MGR_AGENT_CLIENT_CA (verifies host TPM certs)"
|
|
echo
|
|
echo "next:"
|
|
echo " - admin UI cert : owned by the Traefik ingress (LE DNS-01) — DEPLOY.md §2c"
|
|
echo " - broker client : ../enrol-broker/admin-pki.sh ../dot1x-bench/pki/broker fleet-manager"
|
|
echo " then: cp -r ../dot1x-bench/pki/broker ./pki/broker"
|