[client][management] feat: TPM/Secure Enclave certificate-based device authentication#5881

Closed

dexion wants to merge 11 commits intonetbirdio:mainfrom

dexion:feature/tpm-cert-auth

Commits on Apr 14, 2026

feat(proto): add device certificate authentication RPCs

beLIEai
authored and
beLIEai
committed
feat(store): add DeviceCertificate/DeviceEnrollment models and store interface

beLIEai
authored and
beLIEai
committed
feat(secretenc): add AES-256-GCM envelope encryption for CA private keys

beLIEai
authored and
beLIEai
committed
feat(devicepki): in-process CA, external CA adapters, and attestation chain verification

beLIEai
authored and
beLIEai
committed
feat(management/grpc): mTLS enforcement, device enrollment RPC, TPM/SE attestation handler

beLIEai
authored and
beLIEai
committed
feat(management/http): device auth HTTP API — CA config, enrollments, certificates, inventory

beLIEai
authored and
beLIEai
committed
feat(client/tpm): TPM 2.0 hardware attestation provider

beLIEai
authored and
beLIEai
committed
feat(client): enrollment manager and mTLS connection upgrade

beLIEai
authored and
beLIEai
committed
feat(ci): GitHub Actions workflows for device auth and TPM integration tests

beLIEai
authored and
beLIEai
committed
chore: dev stand, demo tools, and infrastructure updates

beLIEai
authored and
beLIEai
committed
docs: add DEVICE-SECURITY.md — architecture, sequence diagrams, known limitations

beLIEai
authored and
beLIEai
committed