From c5cdc1e4ab3eb3c623d1497d55eafe3baccd3e70 Mon Sep 17 00:00:00 2001 From: Harald Hoyer Date: Mon, 10 Feb 2025 10:46:34 +0100 Subject: [PATCH 1/3] feat(google-tdx): disable LLMNR and MulticastDNS - Configured resolved service, disabling LLMNR and MulticastDNS for improved resolution settings. - Removed commented-out Prometheus Node config Signed-off-by: Harald Hoyer --- packages/tdx_google/configuration.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/packages/tdx_google/configuration.nix b/packages/tdx_google/configuration.nix index c25618c..9a23de8 100644 --- a/packages/tdx_google/configuration.nix +++ b/packages/tdx_google/configuration.nix @@ -26,6 +26,13 @@ networking.firewall.allowedTCPPortRanges = [{ from = 1024; to = 65535; }]; networking.firewall.allowedUDPPortRanges = [{ from = 1024; to = 65535; }]; + services.resolved.enable = true; + services.resolved.llmnr = "false"; + services.resolved.extraConfig = '' + [Resolve] + MulticastDNS=no + ''; + networking.useNetworkd = lib.mkDefault true; # don't fill up the logs @@ -80,8 +87,6 @@ disabledCollectors = [ "textfile" ]; - #openFirewall = true; - #firewallFilter = "-i br0 -p tcp -m tcp --dport 9100"; }; environment.systemPackages = with pkgs; [ From ff22db6054335c4c8800e97b126257176c043f00 Mon Sep 17 00:00:00 2001 From: Harald Hoyer Date: Mon, 10 Feb 2025 10:48:51 +0100 Subject: [PATCH 2/3] chore(google-tdx): removed commented-out ssh debugging Signed-off-by: Harald Hoyer --- packages/tdx_google/configuration.nix | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/packages/tdx_google/configuration.nix b/packages/tdx_google/configuration.nix index 9a23de8..6e2eb40 100644 --- a/packages/tdx_google/configuration.nix +++ b/packages/tdx_google/configuration.nix @@ -8,19 +8,6 @@ "${toString modulesPath}/profiles/qemu-guest.nix" ]; - /* - # SSH login for debugging - services.sshd.enable = true; - networking.firewall.allowedTCPPorts = [ 22 ]; - services.openssh.settings.PermitRootLogin = lib.mkOverride 999 "yes"; - users.users.root.openssh.authorizedKeys.keys = [ - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDsb/Tr69YN5MQLweWPuJaRGm+h2kOyxfD6sqKEDTIwoAAAABHNzaDo=" - "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBACLgT81iB1iWWVuXq6PdQ5GAAGhaZhSKnveQCvcNnAOZ5WKH80bZShKHyAYzrzbp8IGwLWJcZQ7TqRK+qZdfagAAAAEc3NoOg==" - "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAYbUTKpy4QR3s944/hjJ1UK05asFEs/SmWeUbtS0cdA660sT4xHnRfals73FicOoz+uIucJCwn/SCM804j+wtM=" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNsmP15vH8BVKo7bdvIiiEjiQboPGcRPqJK0+bH4jKD" - ]; - */ - # the container might want to listen on ports networking.firewall.enable = true; networking.firewall.allowedTCPPortRanges = [{ from = 1024; to = 65535; }]; From 9266a9f072a3238753fe834e1a689eab51932215 Mon Sep 17 00:00:00 2001 From: Harald Hoyer Date: Mon, 10 Feb 2025 11:35:25 +0100 Subject: [PATCH 3/3] feat(google-tdx): add Vector service integration - Enable Vector service and configure OpenTelemetry source. - Add sinks for logs output to console and Kafka. - Configure environment setup for Kafka using GCP metadata API. Signed-off-by: Harald Hoyer --- packages/tdx_google/configuration.nix | 57 +++++++++++++++++++++++- systems/x86_64-linux/tdxtest/default.nix | 5 +++ 2 files changed, 61 insertions(+), 1 deletion(-) diff --git a/packages/tdx_google/configuration.nix b/packages/tdx_google/configuration.nix index 6e2eb40..9c6b663 100644 --- a/packages/tdx_google/configuration.nix +++ b/packages/tdx_google/configuration.nix @@ -8,6 +8,61 @@ "${toString modulesPath}/profiles/qemu-guest.nix" ]; + services.vector.enable = true; + services.vector.settings = { + api.enabled = false; + sources = { + otlp = { + type = "opentelemetry"; + grpc = { address = "127.0.0.1:4317"; }; + http = { + address = "127.0.0.1:4318"; + keepalive = { + max_connection_age_jitter_factor = 0.1; + max_connection_age_secs = 300; + }; + }; + }; + }; + sinks = { + console = { + inputs = [ "otlp.logs" ]; + target = "stdout"; + type = "console"; + encoding = { codec = "json"; }; + }; + kafka = { + type = "kafka"; + inputs = [ "otlp.logs" ]; + bootstrap_servers = "\${KAFKA_URLS:-127.0.0.1:0}"; + topic = "\${KAFKA_TOPIC:-tdx-google}"; + encoding = { + codec = "json"; + compression = "lz4"; + }; + }; + }; + }; + systemd.services.vector.path = [ pkgs.curl pkgs.coreutils ]; + # `-` means, that the file can be missing, so that `ExecStartPre` can execute and create it + systemd.services.vector.serviceConfig.EnvironmentFile = "-/run/vector/env"; + # `+` means, that the process has access to all files, to be able to write to `/run` + systemd.services.vector.serviceConfig.ExecStartPre = "+" + toString ( + pkgs.writeShellScript "vector-start-pre" '' + set -eu -o pipefail + : "''${KAFKA_URLS:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/kafka_urls" -H "Metadata-Flavor: Google")}" + : "''${KAFKA_TOPIC:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/kafka_topic" -H "Metadata-Flavor: Google")}" + + KAFKA_TOPIC="''${KAFKA_TOPIC:-tdx-google}" + + mkdir -p /run/vector + cat >/run/vector/env <&2 test -c /dev/tdx_guest && tdx-extend --digest "$DIGEST" --rtmr 3 - exec docker run --init --privileged "sha256:$DIGEST" + exec docker run --network=host --init --privileged "sha256:$DIGEST" ''; postStop = lib.mkDefault '' diff --git a/systems/x86_64-linux/tdxtest/default.nix b/systems/x86_64-linux/tdxtest/default.nix index d95dce5..96a2e8c 100644 --- a/systems/x86_64-linux/tdxtest/default.nix +++ b/systems/x86_64-linux/tdxtest/default.nix @@ -34,6 +34,11 @@ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNsmP15vH8BVKo7bdvIiiEjiQboPGcRPqJK0+bH4jKD" ]; + environment.systemPackages = with pkgs; [ + strace + tcpdump + ]; + fileSystems = { "/" = {