Audiobuzz
28d31e436c
F-02/P-17 SSH host-cert flow was proven end-to-end on comet-beacon-54
(2026-07-11); these fix the correctness/scoping/cleanup defects the bench
surfaced:
- ssh-hostcert: derive the FQDN principal <hostname>.<domain> from the DHCP
search domain at runtime (resolv.conf), alongside the short hostname, so an
admin `@cert-authority *.<domain>` line accepts by-FQDN logins instead of
"name is not a listed principal". Never baked (invariant #1). + tests.
- ssh-ca-bootstrap.sh: export the SSH host CA public key in OpenSSH wire format
(ssh-keygen -i -m PKCS8), not the PEM/PKCS8 that `step crypto keypair` writes
-- a PEM @cert-authority anchor is unparseable and silently falls back to TOFU.
- ssh-ca-bootstrap.sh: fail loudly (and verify enableSSHCA=true) if the
provisioner SSH-enable step fails, instead of swallowing it and shipping a CA
that 502s every runtime sign.
- dot1x-bench: point the co-located broker at https://localhost:8443, not the
fleet dnsmasq name ca.fleet.lab (unresolvable from the broker's host netns ->
"no such host" at sign time). localhost is in the CA cert SAN.
- serving: remove the mock-signer enrol-broker copy -- two host-networked
brokers collide on 9090/9443 and the mock issued untrusted certs. The real
broker lives with step-ca (dot1x-bench); nginx /enrol/ still proxies to it on
loopback.
- enrol-broker: retire the HTML admin console; the fleet-manager passkey SPA now
drives the mTLS JSON API (/pending, /approve|deny). Removes a weaker,
client-cert-only parallel human-approve path.
Design-doc bench note deferred: docs/ssh-host-certificate-design.md lives on the
secure-ntp branch (fbb8100), not here -- to be added there / on reconcile.
102 lines
5.3 KiB
YAML
102 lines
5.3 KiB
YAML
# =============================================================================
|
|
# Secure-path bench: step-ca (fleet CA) + FreeRADIUS (EAP-TLS), on the SERVING
|
|
# host (the trusted side). The authenticator (hostapd-wired + MACsec) is NOT
|
|
# here — it runs on a node between each workstation and this host (see
|
|
# authenticator/). Host networking so FreeRADIUS sees RADIUS/1812 from the
|
|
# authenticator and step-ca is reachable for enrolment.
|
|
#
|
|
# cp .env.example .env # set CA_DNS / CA_PASSWORD / RADIUS_SECRET
|
|
# docker compose up -d step-ca && ./step-ca/bootstrap.sh && docker compose up -d freeradius
|
|
#
|
|
# Images are pulled from Docker Hub here; mirror them through your registry
|
|
# (like the serving stack does for nginx/alpine) if you don't have egress.
|
|
# =============================================================================
|
|
|
|
services:
|
|
# --- Fleet CA (signs TPM-generated CSRs; trust anchor for the image) --------
|
|
step-ca:
|
|
image: harbor.bitasylum.org/dockerhub/smallstep/step-ca:latest
|
|
network_mode: host
|
|
restart: unless-stopped
|
|
environment:
|
|
# Auto-init on first start (smallstep image convention). bootstrap.sh adds
|
|
# the enrolment provisioner + issues the RADIUS server cert afterwards.
|
|
DOCKER_STEPCA_INIT_NAME: "Fleet Bench CA"
|
|
DOCKER_STEPCA_INIT_DNS_NAMES: "${CA_DNS:-ca.fleet.lab},localhost"
|
|
DOCKER_STEPCA_INIT_ADDRESS: ":${CA_PORT:-8443}"
|
|
DOCKER_STEPCA_INIT_PROVISIONER_NAME: "enrol"
|
|
# Password to encrypt the CA keys + 'enrol' provisioner. Must be the VALUE
|
|
# (_PASSWORD), not _PASSWORD_FILE: the latter is an INPUT path the entrypoint
|
|
# reads FROM (for a mounted docker secret), which doesn't exist at first
|
|
# init → `step ca init` fails → no CA, no secrets/password (the "CA not
|
|
# initialised" error). With _PASSWORD the entrypoint WRITES it to
|
|
# /home/step/secrets/password, where bootstrap.sh + the enrol-broker read it.
|
|
DOCKER_STEPCA_INIT_PASSWORD: "${CA_PASSWORD:-changeme-bench}"
|
|
volumes:
|
|
- ./pki/stepca:/home/step # CA state (root/intermediate/keys/db) — gitignored
|
|
- ./pki:/export # bootstrap.sh drops root_ca.crt here for the image/radius
|
|
|
|
# --- RADIUS (EAP-TLS; validates client cert vs step-ca root, returns MSK) ---
|
|
freeradius:
|
|
image: harbor.bitasylum.org/dockerhub/freeradius/freeradius-server:latest
|
|
network_mode: host # RADIUS 1812/1813 from the authenticator
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- step-ca
|
|
# -X = full debug to stdout; priceless for the first bring-up. Drop to plain
|
|
# `radiusd -f` once EAP-TLS is green.
|
|
command: ["radiusd", "-X"]
|
|
volumes:
|
|
- ./freeradius/clients.conf:/etc/raddb/clients.conf:ro
|
|
- ./freeradius/mods-available/eap:/etc/raddb/mods-available/eap:ro
|
|
# certs issued by bootstrap.sh: the RADIUS server cert/key + the CA root.
|
|
- ./pki/radius:/etc/raddb/certs/fleet:ro
|
|
|
|
# --- TPM enrolment broker (the ONE unauthenticated, pre-auth endpoint) -------
|
|
# docs/tpm-enrolment-design.md. Host networking so the SERVING stack's nginx
|
|
# reaches the public listener on 127.0.0.1:9090 (proxied as /enrol/) and step-ca
|
|
# is reachable for signing. The admin web UI (mTLS) listens on 127.0.0.1:9443 —
|
|
# bind it to the management network ONLY; never expose it to the boot LAN.
|
|
#
|
|
# First issue the admin mTLS PKI (dedicated admin CA, NOT the fleet root):
|
|
# ../enrol-broker/admin-pki.sh ./pki/broker <admin-name>
|
|
enrol-broker:
|
|
build: ../enrol-broker
|
|
network_mode: host
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- step-ca
|
|
environment:
|
|
BROKER_PUBLIC_ADDR: "127.0.0.1:9090"
|
|
BROKER_ADMIN_ADDR: "127.0.0.1:9443"
|
|
BROKER_SIGNER: "step"
|
|
# Co-located with step-ca (both network_mode: host), so reach it over
|
|
# loopback — NOT the fleet DNS name. ca.fleet.lab is a dnsmasq name for
|
|
# boot-LAN clients; the broker's host resolver doesn't know it, so signing
|
|
# died with "lookup ca.fleet.lab: no such host" (bench 2026-07-11). localhost
|
|
# is always in the CA cert SAN (DOCKER_STEPCA_INIT_DNS_NAMES) so TLS verifies.
|
|
STEP_CA_URL: "https://localhost:${CA_PORT:-8443}"
|
|
STEP_CA_ROOT: "/pki/root_ca.crt"
|
|
STEP_PROVISIONER: "enrol"
|
|
STEP_PROVISIONER_PASSWORD_FILE: "/pki/stepca/secrets/password"
|
|
STEP_CERT_NOT_AFTER: "720h"
|
|
BROKER_PENDING_TTL: "10m"
|
|
BROKER_WORDS: "8"
|
|
HOSTNQN_BASE: "nqn.2026-06.org.example.fleet:host-"
|
|
# Admin mTLS — server cert/key + the DEDICATED admin client CA (see above).
|
|
BROKER_ADMIN_CERT: "/pki/broker/server.crt"
|
|
BROKER_ADMIN_KEY: "/pki/broker/server.key"
|
|
BROKER_ADMIN_CLIENT_CA: "/pki/broker/admin-ca.crt"
|
|
# HOST plane (SSH host-cert issuance, F-02/P-17). mTLS on the boot LAN:
|
|
# FLEET-signed server cert + the fleet CA (root+intermediate) as the client
|
|
# CA that verifies each host's TPM identity. Certs issued by
|
|
# step-ca/ssh-ca-bootstrap.sh (run it once after bootstrap.sh). 0.0.0.0 so
|
|
# booted hosts can reach it — firewall to the boot LAN.
|
|
BROKER_HOST_ADDR: "0.0.0.0:9444"
|
|
BROKER_HOST_CERT: "/pki/broker/host-server.crt"
|
|
BROKER_HOST_KEY: "/pki/broker/host-server.key"
|
|
BROKER_HOST_CLIENT_CA: "/pki/broker/fleet-client-ca.crt"
|
|
STEP_SSH_CERT_NOT_AFTER: "720h"
|
|
volumes:
|
|
- ./pki:/pki:ro
|