48 lines
2.4 KiB
YAML
48 lines
2.4 KiB
YAML
# =============================================================================
|
|
# Secure-path bench: step-ca (fleet CA) + FreeRADIUS (EAP-TLS), on the SERVING
|
|
# host (the trusted side). The authenticator (hostapd-wired + MACsec) is NOT
|
|
# here — it runs on a node between each workstation and this host (see
|
|
# authenticator/). Host networking so FreeRADIUS sees RADIUS/1812 from the
|
|
# authenticator and step-ca is reachable for enrolment.
|
|
#
|
|
# cp .env.example .env # set CA_DNS / CA_PASSWORD / RADIUS_SECRET
|
|
# docker compose up -d step-ca && ./step-ca/bootstrap.sh && docker compose up -d freeradius
|
|
#
|
|
# Images are pulled from Docker Hub here; mirror them through your registry
|
|
# (like the serving stack does for nginx/alpine) if you don't have egress.
|
|
# =============================================================================
|
|
|
|
services:
|
|
# --- Fleet CA (signs TPM-generated CSRs; trust anchor for the image) --------
|
|
step-ca:
|
|
image: smallstep/step-ca:latest
|
|
network_mode: host
|
|
restart: unless-stopped
|
|
environment:
|
|
# Auto-init on first start (smallstep image convention). bootstrap.sh adds
|
|
# the enrolment provisioner + issues the RADIUS server cert afterwards.
|
|
DOCKER_STEPCA_INIT_NAME: "Fleet Bench CA"
|
|
DOCKER_STEPCA_INIT_DNS_NAMES: "${CA_DNS:-ca.fleet.lab},localhost"
|
|
DOCKER_STEPCA_INIT_ADDRESS: ":${CA_PORT:-8443}"
|
|
DOCKER_STEPCA_INIT_PROVISIONER_NAME: "enrol"
|
|
DOCKER_STEPCA_INIT_PASSWORD_FILE: "/home/step/secrets/password"
|
|
volumes:
|
|
- ./pki/stepca:/home/step # CA state (root/intermediate/keys/db) — gitignored
|
|
- ./pki:/export # bootstrap.sh drops root_ca.crt here for the image/radius
|
|
|
|
# --- RADIUS (EAP-TLS; validates client cert vs step-ca root, returns MSK) ---
|
|
freeradius:
|
|
image: freeradius/freeradius-server:latest
|
|
network_mode: host # RADIUS 1812/1813 from the authenticator
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- step-ca
|
|
# -X = full debug to stdout; priceless for the first bring-up. Drop to plain
|
|
# `radiusd -f` once EAP-TLS is green.
|
|
command: ["radiusd", "-X"]
|
|
volumes:
|
|
- ./freeradius/clients.conf:/etc/raddb/clients.conf:ro
|
|
- ./freeradius/mods-available/eap:/etc/raddb/mods-available/eap:ro
|
|
# certs issued by bootstrap.sh: the RADIUS server cert/key + the CA root.
|
|
- ./pki/radius:/etc/raddb/certs/fleet:ro
|