Self-enroll a node using a provisioning token (no API key)

Node ed25519 identity public key (base64 raw, 32 bytes). The collision-safe node anchor: the box generates this once, keeps the private key at /etc/vectorlay/identity.key, and signs every enroll with it. Required by the server: an enroll without it is refused (401 BAD_SIGNATURE).

Stable per-box identity (SMBIOS product_uuid / serial / cloud instance-id). Primary global node-identity key; fingerprint is the fallback when empty.

Node Nebula public key PEM (from nebula-cert keygen)

Node runtime, detected on the box by enroll.sh from the host shape: qemu (VFIO/KVM passthrough VM host) on baremetal, runc (GPU-container Pod node) on a cloud guest. The control plane refuses an enroll whose runtime is absent or contradicts hostShape (matched case-insensitively).

base64 ed25519 signature proving possession of identityPubkey over the identity-critical enroll fields (token hash, identity pubkey, nebula pubkey hash, fingerprint, machineId, hostname, signedAt). Required by the server: an enroll without it is refused (401 BAD_SIGNATURE).

Unix seconds when the enroll body was signed. Required by the server: an unsigned enroll is refused (401 BAD_SIGNATURE); rejected if more than 300s from server time.

Provisioning token (vtk_...)

CertIssuer CA the gateway pins; optional

node data-plane mTLS cert (gateway tunnel); optional

node data-plane mTLS key; optional

host:port the node-agent dials (QUIC/UDP); optional

expected CN on the gateway server cert; optional

durable node token for the node-agent self-update fetch (GET /v1/nodes/agent); optional

The control plane has determined the node's Nomad record is gone (record GC'd past node_gc_threshold, or purged) and no live workload is pinned here, so enroll.sh must reset the local Nomad client (stop nomad, kill orphaned VM processes, delete the client state DB) before the fresh introduction token can register a new record. Never set while any workload is placed, so a running VM's processes are never stranded.