Audiobuzz
d5c833addf
Build the on-host agent that pairs with fleet-hostapi and feeds the fleet-manager control plane (TODO #14 "STILL TO BUILD (a)"). Nothing on the workstation talked to the manager before this; Monitor + InfluxDB stayed empty. Scope: telemetry only. The agent reuses the host TPM identity for mTLS (read-only tpmkey.LoadSigner at 0x81000100 + cert from NV 0x01800100; the private key never leaves the TPM), opens the long-lived FleetAgent.Session bidi stream, sends Hello + periodic HealthSnapshot (load/cpu/temp/mem/tmpfs/nvme/auth/selinux/chrony/kiosk, probed read-only from /proc+/sys plus hostapi facts), and LOGS but does not act on the DesiredState/Command it receives. Reconcile actuators (kiosk URL, reboot, drain) are deferred until the telemetry half is bench-verified. - files/agent/: new module (go-tpm + grpc), static CGO_ENABLED=0 like enrol/hostapi. Copies the enrol tpmkey (+ read-only LoadSigner) and the generated fleet.agent.v1 proto so it stays self-contained without importing the initramfs enrol module. - files/agent/simtest/: proves the TPM-signed cert completes a real mTLS client-auth handshake (RequireAndVerifyClientCert) against the go-tpm software simulator. - files/etc/fleet-agent/agent.env: fleet-generic config (manager DNS name, fleet CA reused from radius-ca.pem, TPM handle/nvindex, interval). No per-host state. - fleet-agent.service: hardened unit (tss group for /dev/tpmrm0, INET egress). - CI builds fleet-agent out-of-VM + runs vet/test + the simulator handshake test. - Packer: enable_agent flag (default on) + 2b-agent provisioner + fapolicyd trust. Post-switch-root only, so no dracut/initramfs changes. - docs: TODO #14 + fleet-management-design as-built updated. Requires the host already enrolled (broker approve births the inventory row) — else the manager returns PermissionDenied, the correct "not enrolled yet" signal.
54 lines
1.9 KiB
Desktop File
54 lines
1.9 KiB
Desktop File
[Unit]
|
|
Description=Fleet on-host control-plane agent (telemetry: TPM-mTLS to fleet-manager)
|
|
Documentation=https://git.bitasylum.org/audiobuzz/diskless-workstation/docs/fleet-management-design.md
|
|
# Needs the network up to dial the manager; hostapi is a SOFT dep (facts source) —
|
|
# After, not Requires, so the agent still streams health if hostapi is down.
|
|
After=network-online.target fleet-hostapi.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=exec
|
|
EnvironmentFile=/etc/fleet-agent/agent.env
|
|
ExecStart=/usr/local/bin/fleet-agent
|
|
# Always retry — a diskless box has nothing better to do than reconnect. The agent
|
|
# also self-reconnects the stream; Restart covers a hard crash / TPM transient.
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# --- sandboxing (STIG-friendly; looser than hostapi — needs the TPM + egress) ---
|
|
# Runs as a transient unprivileged user in the tss group for /dev/tpmrm0 (the
|
|
# private key stays in the TPM; the agent only signs the TLS handshake through it).
|
|
DynamicUser=yes
|
|
SupplementaryGroups=tss
|
|
# Expose ONLY the TPM resource-manager node (no PrivateDevices — that would hide it).
|
|
DeviceAllow=/dev/tpmrm0 rw
|
|
DevicePolicy=closed
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
ProtectProc=default
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged @resources
|
|
# INET egress to the manager (not loopback-only, unlike hostapi); AF_UNIX for the
|
|
# journal, AF_NETLINK for Go's source-address/interface selection.
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|