A new start

systems/x86_64-linux/sgx-nixos/default.nix

@@ -0,0 +1,50 @@
+{ pkgs, lib, config, ... }:
+with lib;
+with lib.metacfg;
+{
+  imports = [ ./hardware-configuration.nix ];
+
+  boot.kernel.sysctl."net.ipv4.conf.all.route_localnet" = 1;
+  networking.firewall.extraCommands = ''
+    iptables -t nat -A OUTPUT -o lo -p tcp --dport 8081 -j DNAT --to-destination 192.168.122.1:8081
+    iptables -t nat -A POSTROUTING -j MASQUERADE
+  '';
+
+  metacfg = {
+    base.enable = true;
+    nix-ld.enable = true;
+    nix.enable = true;
+    aesmd_dcap.enable = true;
+    user.extraGroups = [ "docker" "sgx" ];
+  };
+
+  environment.etc."sgx_default_qcnl.conf".text = ''
+    {
+      "pccs_url": "https://192.168.122.1:8081/sgx/certification/v4/"
+      "use_secure_cert": false,
+      "collateral_service": "https://api.trustedservices.intel.com/sgx/certification/v4/",
+      "retry_times": 6,
+      "retry_delay": 10,
+      "pck_cache_expire_hours": 168,
+      "verify_collateral_cache_expire_hours": 168,
+      "local_cache_only": false
+    }
+  '';
+
+  virtualisation.docker.enable = true;
+
+  system.autoUpgrade = {
+    enable = true;
+    operation = "switch";
+    allowReboot = true;
+  };
+
+  security.tpm2.enable = false;
+  security.tpm2.abrmd.enable = false;
+
+  networking.wireless.enable = false; # Enables wireless support via wpa_supplicant.
+
+  powerManagement.cpuFreqGovernor = "ondemand";
+
+  system.stateVersion = "23.11";
+}

systems/x86_64-linux/sgx-nixos/hardware-configuration.nix

@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/ebb90474-ddcb-484b-9663-d71863827af4";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/941C-7B02";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}