From 6fdc79c5dc0a2e64e7ad11bf2d8e84f142b090f1 Mon Sep 17 00:00:00 2001
From: Chris Christiansen <chris.christiansen@vauco.no>
Date: Wed, 2 Sep 2026 18:45:21 +0000
Subject: [PATCH] feat(tyr): add spire bootstrap script and update roadmap

---
 project/roadmap.md           |   1 +
 tyr/memory_bank/completed.md |   4 ++
 tyr/scripts/install_spire.sh | 116 +++++++++++++++++++++++++++++++++++
 3 files changed, 121 insertions(+)
 create mode 100755 tyr/scripts/install_spire.sh

diff --git a/project/roadmap.md b/project/roadmap.md
index 41f8393..98daad3 100644
--- a/project/roadmap.md
+++ b/project/roadmap.md
@@ -8,6 +8,7 @@ This document tracks the high-level goals and future development milestones for
 
 ## Phase 1: TYR Service Identity (SPIFFE/SVID)
 - [x] Deploy step-ca
+- [~] Bootstrap SPIRE (staged, pending daemon execution)
 
 ## Phase 3: Memory Bank & Project Management
 - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools.
diff --git a/tyr/memory_bank/completed.md b/tyr/memory_bank/completed.md
index a0f0a18..ec5f90d 100644
--- a/tyr/memory_bank/completed.md
+++ b/tyr/memory_bank/completed.md
@@ -3,3 +3,7 @@
 - **Phase 1.1: Deploy step-ca**
   - Status: **Complete**
   - Notes: `step ca init` was successful and the `step-ca` systemd service is active.
+
+- **Phase 1.2: Bootstrap SPIRE**
+  - Status: **Staged**
+  - Notes: `install_spire.sh` executed successfully. Configs are generated, pending manual daemon execution.
diff --git a/tyr/scripts/install_spire.sh b/tyr/scripts/install_spire.sh
new file mode 100755
index 0000000..af9a55d
--- /dev/null
+++ b/tyr/scripts/install_spire.sh
@@ -0,0 +1,116 @@
+#!/bin/bash
+#
+# install_spire.sh - Downloads, configures, and provides instructions for SPIRE server and agent.
+#
+set -euo pipefail
+
+# --- Configuration ---
+# Please verify the latest version from https://github.com/spiffe/spire/releases
+SPIRE_VERSION="1.15.3"
+ARCH="linux-amd64-musl"
+TRUST_DOMAIN="vauco.no"
+SERVER_BIND_ADDRESS="0.0.0.0"
+SERVER_BIND_PORT="8081"
+
+# --- Script Start ---
+
+# 1. Download and unpack SPIRE binaries
+echo "--- Downloading SPIRE v${SPIRE_VERSION} ---"
+if [ -d "spire-${SPIRE_VERSION}" ]; then
+    echo "SPIRE directory already exists. Skipping download."
+else
+    wget https://github.com/spiffe/spire/releases/download/v${SPIRE_VERSION}/spire-${SPIRE_VERSION}-${ARCH}.tar.gz
+    tar -xzf spire-${SPIRE_VERSION}-${ARCH}.tar.gz
+    rm spire-${SPIRE_VERSION}-${ARCH}.tar.gz
+fi
+
+cd spire-${SPIRE_VERSION}
+
+# 2. Create SPIRE server configuration
+echo "--- Creating SPIRE server config (conf/server/server.conf) ---"
+cat > conf/server/server.conf <<EOF
+server {
+    bind_address = "${SERVER_BIND_ADDRESS}"
+    bind_port = "${SERVER_BIND_PORT}"
+    trust_domain = "${TRUST_DOMAIN}"
+    data_dir = "./data"
+    log_level = "INFO"
+    ca_subject = {
+        country = ["NO"],
+        organization = ["Vauco"],
+        common_name = "",
+    }
+}
+
+plugins {
+    NodeAttestor "gcp_iit" {
+        plugin_data {}
+    }
+    KeyManager "memory" {
+        plugin_data {}
+    }
+    Notifier "noop" {
+        plugin_data {}
+    }
+    # This configures SPIRE to use the certificates created by step-ca as a signing authority.
+    # This is a basic integration. For a production setup, you might chain it as an UpstreamAuthority.
+    UpstreamAuthority "disk" {
+        plugin_data {
+            cert_file_path = "/home/chris_christiansen/.step/certs/intermediate_ca.crt"
+            key_file_path = "/home/chris_christiansen/.step/secrets/intermediate_ca_key"
+        }
+    }
+}
+EOF
+
+# 3. Create SPIRE agent configuration
+echo "--- Creating SPIRE agent config (conf/agent/agent.conf) ---"
+cat > conf/agent/agent.conf <<EOF
+agent {
+    data_dir = "./data"
+    log_level = "INFO"
+    server_address = "127.0.0.1"
+    server_port = "${SERVER_BIND_PORT}"
+    trust_bundle_path = "./conf/root.crt" # The agent will fetch this on startup
+    trust_domain = "${TRUST_DOMAIN}"
+}
+
+plugins {
+    NodeAttestor "gcp_iit" {
+        plugin_data {}
+    }
+    KeyManager "memory" {
+        plugin_data = {}
+    }
+    WorkloadAttestor "unix" {
+        plugin_data {
+            discover_workloads = true
+        }
+    }
+}
+EOF
+
+cd ..
+
+echo ""
+echo "✅ SPIRE installation script and configuration templates have been created."
+
+echo ""
+
+echo "--- Next Steps ---"
+
+echo "1. Review the generated configuration files in 'spire-${SPIRE_VERSION}/conf/'"
+
+echo "2. Manually run the SPIRE server from your terminal:"
+
+echo "   cd spire-${SPIRE_VERSION} && ./bin/spire-server run"
+
+echo "3. In another terminal, fetch the trust bundle for the agent:"
+
+echo "   cd spire-${SPIRE_VERSION} && ./bin/spire-server bundle show > ./conf/agent/root.crt"
+
+echo "4. Run the SPIRE agent:"
+
+echo "   cd spire-${SPIRE_VERSION} && sudo ./bin/spire-agent run"
+
+echo "5. Create registration entries for your workloads."