Self-enroll a node using a provisioning token (no API key)

Node ed25519 identity public key (base64 raw, 32 bytes). The collision-safe node anchor: the box generates this once, keeps the private key at /etc/vectorlay/identity.key, and signs every enroll with it. Required by the server: an enroll without it is refused (401 BAD_SIGNATURE).

Stable per-box identity (SMBIOS product_uuid / serial / cloud instance-id). Primary global node-identity key; fingerprint is the fallback when empty.

Node Nebula public key PEM (from nebula-cert keygen)

Node runtime, detected on the box by enroll.sh from the host shape: qemu (VFIO/KVM passthrough VM host) on baremetal, runc (GPU-container Pod node) on a cloud guest. The control plane refuses an enroll whose runtime is absent or contradicts hostShape (matched case-insensitively).

base64 ed25519 signature proving possession of identityPubkey over the identity-critical enroll fields (token hash, identity pubkey, nebula pubkey hash, fingerprint, machineId, hostname, signedAt). Required by the server: an enroll without it is refused (401 BAD_SIGNATURE).

Unix seconds when the enroll body was signed. Required by the server: an unsigned enroll is refused (401 BAD_SIGNATURE); rejected if more than 300s from server time.

Provisioning token (vtk_...)

CertIssuer CA the gateway pins; optional

node data-plane mTLS cert (gateway tunnel); optional

node data-plane mTLS key; optional

host:port the node-agent dials (QUIC/UDP); optional

expected CN on the gateway server cert; optional

durable node token for the node-agent self-update fetch (GET /v1/nodes/agent); optional