bolyai/CIS490
3
0
Fork 0
Code Issues 5 Pull requests Projects 1 Releases Packages Wiki Activity Actions

fix: ca_bundle in lab-host.toml.example pointed at client CA, not Caddy root

Browse source 
wg-ca.pem (from the bootstrap tarball) is the CIS490 Lab-Host Client
CA — the receiver's trust anchor for our client cert. The shipper's
ca_bundle is used to verify the *server's* TLS cert on collector.wg,
which is signed by the Caddy Local Authority. Point ca_bundle at
/opt/cis490/etc/caddy-root.crt (the Caddy root bundled in the repo)
so TLS verification succeeds.

Closes spectral/CIS490#12

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
elliott 2026-04-30 15:34:10 -06:00
parent 86a088c204
commit 786b8da600
1 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
etc/lab-host.toml.example
View file

@ -17,10 +17,12 @@ qcow_image = "/var/lib/cis490/vm/images/metasploitable2.qcow2"
[receiver]
# The receiver lives behind Caddy on the WG-side collector host. The
# hostname must resolve over WG (collector.wg in the canonical
# spectral lab). The wg-pki CA must be on every lab-host so the
# Caddy-issued internal cert validates.
# spectral lab). ca_bundle pins the Caddy root CA (bundled in the
# repo) so the shipper can verify the server's TLS cert. The wg-pki
# client CA (wg-ca.pem from the bootstrap tarball) is the RECEIVER's
# trust anchor for our client cert — we don't configure it here.
url = "https://collector.wg"
ca_bundle = "/etc/cis490/certs/wg-ca.pem"
ca_bundle = "/opt/cis490/etc/caddy-root.crt"
# mTLS: leaf cert + private key issued by wg-pki for THIS host_id.
# Comment these out to fall back to bearer-token auth during early