radiuscontroller/entrypoint.sh

@@ -34,9 +34,11 @@ fi
 # Generate FreeRADIUS EAP certificates if missing
 if [ ! -f /etc/freeradius/3.0/certs/server.pem ]; then
     echo "Generating FreeRADIUS EAP certificates..."
-    if [ -f /etc/freeradius/3.0/certs/bootstrap ]; then
+    cd /etc/freeradius/3.0/certs
-        /etc/freeradius/3.0/certs/bootstrap || true
+    if [ -f ./bootstrap ]; then
+        ./bootstrap || true
     fi
+    cd /app
 fi
 
 # Ensure correct permissions for FreeRADIUS config directory

radiuscontroller/raddb/mods-enabled/eap

@@ -5,27 +5,7 @@ eap {
 	cisco_accounting_username_bug = no
 	max_sessions = ${max_requests}
 
-	# PEAP Configuration
+	# TLS configuration section named "certs"
-	peap {
-		default_eap_type = mschapv2
-		copy_request_to_tunnel = yes
-		use_tunneled_reply = yes
-		virtual_server = "inner-tunnel"
-	}
-
-	# TTLS Configuration
-	ttls {
-		default_eap_type = mschapv2
-		copy_request_to_tunnel = yes
-		use_tunneled_reply = yes
-		virtual_server = "inner-tunnel"
-	}
-
-	# MSCHAPv2 Configuration
-	mschapv2 {
-	}
-
-	# TLS Configuration for PEAP / TTLS
 	tls-config certs {
 		private_key_password = whatever
 		private_key_file = ${certdir}/server.pem
@@ -37,4 +17,26 @@ eap {
 		tls_min_version = "1.0"
 		tls_max_version = "1.2"
 	}
+
+	# PEAP configuration referencing tls-config certs
+	peap {
+		tls = certs
+		default_eap_type = mschapv2
+		copy_request_to_tunnel = yes
+		use_tunneled_reply = yes
+		virtual_server = "inner-tunnel"
+	}
+
+	# TTLS configuration referencing tls-config certs
+	ttls {
+		tls = certs
+		default_eap_type = mschapv2
+		copy_request_to_tunnel = yes
+		use_tunneled_reply = yes
+		virtual_server = "inner-tunnel"
+	}
+
+	# MSCHAPv2 configuration
+	mschapv2 {
+	}
 }