Self-enroll a node using a provisioning token (no API key)

Node ed25519 identity public key (base64 raw, 32 bytes). Identity v2 collision-safe anchor: the box generates this once, keeps the private key at /etc/vectorlay/identity.key, and signs every enroll with it. Optional — absent = legacy (v1) enroll.

Stable per-box identity (SMBIOS product_uuid / serial / cloud instance-id). Primary global node-identity key; fingerprint is the fallback when empty.

Node Nebula public key PEM (from nebula-cert keygen)

Node runtime detected by enroll.sh: qemu (VFIO/KVM passthrough) or gvisor (container GPUs). Default gvisor.

base64 ed25519 signature (v2) proving possession of identityPubkey over the identity-critical enroll fields (token hash, identity pubkey, nebula pubkey hash, fingerprint, machineId, hostname, signedAt). Required iff identityPubkey is set.

Unix seconds when the enroll body was signed (v2). Rejected if more than 300s from server time.

Provisioning token (vtk_...)

CertIssuer CA the gateway pins; optional

node data-plane mTLS cert (gateway tunnel); optional

node data-plane mTLS key; optional

host:port the node-agent dials (QUIC/UDP); optional

expected CN on the gateway server cert; optional

durable node token for the node-agent self-update fetch (GET /v1/nodes/agent); optional