Audiobuzz
d5c833addf
Build the on-host agent that pairs with fleet-hostapi and feeds the fleet-manager control plane (TODO #14 "STILL TO BUILD (a)"). Nothing on the workstation talked to the manager before this; Monitor + InfluxDB stayed empty. Scope: telemetry only. The agent reuses the host TPM identity for mTLS (read-only tpmkey.LoadSigner at 0x81000100 + cert from NV 0x01800100; the private key never leaves the TPM), opens the long-lived FleetAgent.Session bidi stream, sends Hello + periodic HealthSnapshot (load/cpu/temp/mem/tmpfs/nvme/auth/selinux/chrony/kiosk, probed read-only from /proc+/sys plus hostapi facts), and LOGS but does not act on the DesiredState/Command it receives. Reconcile actuators (kiosk URL, reboot, drain) are deferred until the telemetry half is bench-verified. - files/agent/: new module (go-tpm + grpc), static CGO_ENABLED=0 like enrol/hostapi. Copies the enrol tpmkey (+ read-only LoadSigner) and the generated fleet.agent.v1 proto so it stays self-contained without importing the initramfs enrol module. - files/agent/simtest/: proves the TPM-signed cert completes a real mTLS client-auth handshake (RequireAndVerifyClientCert) against the go-tpm software simulator. - files/etc/fleet-agent/agent.env: fleet-generic config (manager DNS name, fleet CA reused from radius-ca.pem, TPM handle/nvindex, interval). No per-host state. - fleet-agent.service: hardened unit (tss group for /dev/tpmrm0, INET egress). - CI builds fleet-agent out-of-VM + runs vet/test + the simulator handshake test. - Packer: enable_agent flag (default on) + 2b-agent provisioner + fapolicyd trust. Post-switch-root only, so no dracut/initramfs changes. - docs: TODO #14 + fleet-management-design as-built updated. Requires the host already enrolled (broker approve births the inventory row) — else the manager returns PermissionDenied, the correct "not enrolled yet" signal.
23 lines
839 B
Plaintext
23 lines
839 B
Plaintext
reports
|
|
keys
|
|
# Throwaway USBGuard mass-storage test image (see the USBGuard verify steps)
|
|
/usbguard-test.img
|
|
|
|
# Secure Boot enrollment material baked into the image. The *.auth are PUBLIC but
|
|
# environment-specific, so keep the repo neutral: supply via CI secrets
|
|
# (SB_*_AUTH_B64) or `git add -f` if you choose to commit them. Keep README/.gitkeep.
|
|
/files/secureboot/keys/*.auth
|
|
/files/secureboot/keys/*.esl
|
|
/files/secureboot/keys/*.crt
|
|
|
|
# iPXE network bootloader binaries for the PXE fallback (serving/tftp). Binary,
|
|
# and the signed one is db-derived/environment-specific — supply per environment.
|
|
#/serving/tftp/*.efi
|
|
/serving/tftp/*.kpxe
|
|
|
|
# Out-of-VM CI-built host binaries (staged into the image by the Packer file
|
|
# provisioner; built by the "Build host Go binaries" CI step).
|
|
files/enrol/bin/
|
|
files/hostapi/bin/
|
|
files/agent/bin/
|