harald/nixcfg
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

sgx: factor out aesmd

Browse source 
Signed-off-by: Harald Hoyer <harald@hoyer.xyz>
This commit is contained in:
Harald Hoyer 2024-03-20 16:53:28 +01:00
parent 0b9fb35062
commit f1899875ce
3 changed files with 45 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
modules/nixos/sgx/aesmd_dcap/default.nix Normal file
View file

@ -0,0 +1,30 @@
{ options, config, lib, pkgs, ... }:
with lib;
with lib.metacfg;
let
cfg = config.metacfg.aesmd_dcap;
in
{
options.metacfg.aesmd_dcap = with types; {
enable = mkBoolOpt false "Whether or not to enable aesmd in dcap mode.";
};
config = mkIf cfg.enable {
metacfg = {
nix.extra-substituters = {
"https://nixsgx.cachix.org".key = "nixsgx.cachix.org-1:tGi36DlY2joNsIXOlGnSgWW0+E094V6hW0umQRo/KoE=";
};
};
services.aesmd = {
enable = true;
quoteProviderLibrary = pkgs.nixsgx.sgx-dcap.default_qpl;
};
systemd.services.aesmd = {
environment.LD_LIBRARY_PATH = lib.mkForce (lib.makeLibraryPath [ pkgs.nixsgx.sgx-dcap.default_qpl pkgs.curl.out ]);
serviceConfig.BindReadOnlyPaths = [
"/etc/sgx_default_qcnl.conf"
];
};
};
}

16
systems/x86_64-linux/sgx-nixos/default.nix
View file

@ -14,9 +14,23 @@ with lib.metacfg;
base.enable = true; base.enable = true;
nix-ld.enable = true; nix-ld.enable = true;
nix.enable = true; nix.enable = true;
aesmd_dcap.enable = true;
user.extraGroups = [ "docker" "sgx" ]; user.extraGroups = [ "docker" "sgx" ];
}; };
environment.etc."sgx_default_qcnl.conf".text = ''
{
"pccs_url": "https://192.168.122.1:8081/sgx/certification/v4/"
"use_secure_cert": false,
"collateral_service": "https://api.trustedservices.intel.com/sgx/certification/v4/",
"retry_times": 6,
"retry_delay": 10,
"pck_cache_expire_hours": 168,
"verify_collateral_cache_expire_hours": 168,
"local_cache_only": false
}
'';
virtualisation.docker.enable = true; virtualisation.docker.enable = true;
system.autoUpgrade = { system.autoUpgrade = {
@ -30,8 +44,6 @@ with lib.metacfg;
networking.wireless.enable = false; # Enables wireless support via wpa_supplicant. networking.wireless.enable = false; # Enables wireless support via wpa_supplicant.
services.aesmd.enable = true;
powerManagement.cpuFreqGovernor = "ondemand"; powerManagement.cpuFreqGovernor = "ondemand";
system.stateVersion = "23.11"; system.stateVersion = "23.11";

12
systems/x86_64-linux/sgx/default.nix
View file

@ -14,6 +14,7 @@ in
gui.enable = false; gui.enable = false;
nix-ld.enable = true; nix-ld.enable = true;
nix.enable = true; nix.enable = true;
aesmd_dcap.enable = true;
pccs.enable = true; pccs.enable = true;
pccs.secret = config.sops.secrets.pccs.path; pccs.secret = config.sops.secrets.pccs.path;
podman.enable = true; podman.enable = true;
@ -33,17 +34,6 @@ in
security.tpm2.enable = false; security.tpm2.enable = false;
security.tpm2.abrmd.enable = false; security.tpm2.abrmd.enable = false;
services.aesmd = {
enable = true;
quoteProviderLibrary = pkgs.nixsgx.sgx-dcap.default_qpl;
};
systemd.services.aesmd = {
environment.LD_LIBRARY_PATH = lib.mkForce (lib.makeLibraryPath [ pkgs.nixsgx.sgx-dcap.default_qpl pkgs.curl.out ]);
serviceConfig.BindReadOnlyPaths = [
"/etc/sgx_default_qcnl.conf"
];
};
services.pcscd.enable = true; services.pcscd.enable = true;
powerManagement.cpuFreqGovernor = "ondemand"; powerManagement.cpuFreqGovernor = "ondemand";