mirror of
https://github.com/matter-labs/teepot.git
synced 2025-07-21 15:13:56 +02:00
refactor(tdx_google): modularize tdx_google configuration
- Split `tdx_google/configuration.nix` into smaller modules: `vector.nix`, and `container.nix`. - Simplified the main configuration by leveraging modular imports for better readability and maintainability. Signed-off-by: Harald Hoyer <harald@matterlabs.dev> # Conflicts: # packages/tdx_google/configuration.nix
This commit is contained in:
Harald Hoyer
parent
4d273076ee
commit
5d2ad57cfd
GPG key ID:
F519A1143B3FBE32
3 changed files with 117 additions and 107 deletions
|
|
@ -8,61 +8,6 @@
|
||||||
"${toString modulesPath}/profiles/qemu-guest.nix"
|
"${toString modulesPath}/profiles/qemu-guest.nix"
|
||||||
];
|
];
|
||||||
|
|
||||||
services.vector.enable = true;
|
|
||||||
services.vector.settings = {
|
|
||||||
api.enabled = false;
|
|
||||||
sources = {
|
|
||||||
otlp = {
|
|
||||||
type = "opentelemetry";
|
|
||||||
grpc = { address = "127.0.0.1:4317"; };
|
|
||||||
http = {
|
|
||||||
address = "127.0.0.1:4318";
|
|
||||||
keepalive = {
|
|
||||||
max_connection_age_jitter_factor = 0.1;
|
|
||||||
max_connection_age_secs = 300;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
sinks = {
|
|
||||||
console = {
|
|
||||||
inputs = [ "otlp.logs" ];
|
|
||||||
target = "stdout";
|
|
||||||
type = "console";
|
|
||||||
encoding = { codec = "json"; };
|
|
||||||
};
|
|
||||||
kafka = {
|
|
||||||
type = "kafka";
|
|
||||||
inputs = [ "otlp.logs" ];
|
|
||||||
bootstrap_servers = "\${KAFKA_URLS:-127.0.0.1:0}";
|
|
||||||
topic = "\${KAFKA_TOPIC:-tdx-google}";
|
|
||||||
encoding = {
|
|
||||||
codec = "json";
|
|
||||||
compression = "lz4";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
systemd.services.vector.path = [ pkgs.curl pkgs.coreutils ];
|
|
||||||
# `-` means, that the file can be missing, so that `ExecStartPre` can execute and create it
|
|
||||||
systemd.services.vector.serviceConfig.EnvironmentFile = "-/run/vector/env";
|
|
||||||
# `+` means, that the process has access to all files, to be able to write to `/run`
|
|
||||||
systemd.services.vector.serviceConfig.ExecStartPre = "+" + toString (
|
|
||||||
pkgs.writeShellScript "vector-start-pre" ''
|
|
||||||
set -eu -o pipefail
|
|
||||||
: "''${KAFKA_URLS:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/kafka_urls" -H "Metadata-Flavor: Google")}"
|
|
||||||
: "''${KAFKA_TOPIC:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/kafka_topic" -H "Metadata-Flavor: Google")}"
|
|
||||||
|
|
||||||
KAFKA_TOPIC="''${KAFKA_TOPIC:-tdx-google}"
|
|
||||||
|
|
||||||
mkdir -p /run/vector
|
|
||||||
cat >/run/vector/env <<EOF
|
|
||||||
KAFKA_URLS="''${KAFKA_URLS}"
|
|
||||||
KAFKA_TOPIC="''${KAFKA_TOPIC}"
|
|
||||||
EOF
|
|
||||||
''
|
|
||||||
);
|
|
||||||
|
|
||||||
services.journald.console = "/dev/ttyS0";
|
services.journald.console = "/dev/ttyS0";
|
||||||
systemd.services."serial-getty@ttyS0".enable = lib.mkForce false;
|
systemd.services."serial-getty@ttyS0".enable = lib.mkForce false;
|
||||||
|
|
||||||
|
|
@ -83,58 +28,6 @@
|
||||||
# don't fill up the logs
|
# don't fill up the logs
|
||||||
networking.firewall.logRefusedConnections = false;
|
networking.firewall.logRefusedConnections = false;
|
||||||
|
|
||||||
virtualisation.docker.enable = true;
|
|
||||||
|
|
||||||
systemd.services.docker_start_container = {
|
|
||||||
description = "The main application container";
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
after = [ "network-online.target" "docker.service" "vector.service" "chronyd.service" ];
|
|
||||||
requires = [ "network-online.target" "docker.service" "vector.service" ];
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "exec";
|
|
||||||
User = "root";
|
|
||||||
EnvironmentFile = "-/run/container/env";
|
|
||||||
ExecStartPre = "+" + toString (
|
|
||||||
pkgs.writeShellScript "container-start-pre" ''
|
|
||||||
set -eu -o pipefail
|
|
||||||
: "''${CONTAINER_IMAGE:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_image" -H "Metadata-Flavor: Google")}"
|
|
||||||
: "''${CONTAINER_HUB:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_hub" -H "Metadata-Flavor: Google")}"
|
|
||||||
: "''${CONTAINER_USER:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_user" -H "Metadata-Flavor: Google")}"
|
|
||||||
: "''${CONTAINER_TOKEN:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_token" -H "Metadata-Flavor: Google")}"
|
|
||||||
|
|
||||||
: "''${CONTAINER_IMAGE:?Error: Missing CONTAINER_IMAGE}"
|
|
||||||
: "''${CONTAINER_HUB:?Error: Missing CONTAINER_HUB}"
|
|
||||||
|
|
||||||
mkdir -p /run/container
|
|
||||||
cat >/run/container/env <<EOF
|
|
||||||
CONTAINER_IMAGE="''${CONTAINER_IMAGE}"
|
|
||||||
CONTAINER_HUB="''${CONTAINER_HUB}"
|
|
||||||
CONTAINER_USER="''${CONTAINER_USER}"
|
|
||||||
CONTAINER_TOKEN="''${CONTAINER_TOKEN}"
|
|
||||||
EOF
|
|
||||||
''
|
|
||||||
);
|
|
||||||
};
|
|
||||||
path = [ pkgs.curl pkgs.docker pkgs.teepot.teepot.tdx_extend pkgs.coreutils ];
|
|
||||||
script = ''
|
|
||||||
set -eu -o pipefail
|
|
||||||
if [[ $CONTAINER_USER ]] && [[ $CONTAINER_TOKEN ]]; then
|
|
||||||
docker login -u "$CONTAINER_USER" -p "$CONTAINER_TOKEN" "$CONTAINER_HUB"
|
|
||||||
fi
|
|
||||||
|
|
||||||
docker pull "''${CONTAINER_HUB}/''${CONTAINER_IMAGE}"
|
|
||||||
DIGEST=$(docker inspect --format '{{.Id}}' "''${CONTAINER_HUB}/''${CONTAINER_IMAGE}")
|
|
||||||
DIGEST=''${DIGEST#sha256:}
|
|
||||||
echo "Measuring $DIGEST" >&2
|
|
||||||
test -c /dev/tdx_guest && tdx-extend --digest "$DIGEST" --rtmr 3
|
|
||||||
exec docker run --env "GOOGLE_METADATA=1" --network=host --init --privileged "sha256:$DIGEST"
|
|
||||||
'';
|
|
||||||
|
|
||||||
postStop = lib.mkDefault ''
|
|
||||||
shutdown --reboot +5
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
services.prometheus.exporters.node = {
|
services.prometheus.exporters.node = {
|
||||||
enable = true;
|
enable = true;
|
||||||
port = 9100;
|
port = 9100;
|
||||||
|
|
|
||||||
57
packages/tdx_google/container.nix
Normal file
57
packages/tdx_google/container.nix
Normal file
|
|
@ -0,0 +1,57 @@
|
||||||
|
{ lib
|
||||||
|
, modulesPath
|
||||||
|
, pkgs
|
||||||
|
, ...
|
||||||
|
}: {
|
||||||
|
virtualisation.docker.enable = true;
|
||||||
|
|
||||||
|
systemd.services.docker_start_container = {
|
||||||
|
description = "The main application container";
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
after = [ "network-online.target" "docker.service" "vector.service" "chronyd.service" ];
|
||||||
|
requires = [ "network-online.target" "docker.service" "vector.service" ];
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "exec";
|
||||||
|
User = "root";
|
||||||
|
EnvironmentFile = "-/run/container/env";
|
||||||
|
ExecStartPre = "+" + toString (
|
||||||
|
pkgs.writeShellScript "container-start-pre" ''
|
||||||
|
set -eu -o pipefail
|
||||||
|
: "''${CONTAINER_IMAGE:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_image" -H "Metadata-Flavor: Google")}"
|
||||||
|
: "''${CONTAINER_HUB:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_hub" -H "Metadata-Flavor: Google")}"
|
||||||
|
: "''${CONTAINER_USER:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_user" -H "Metadata-Flavor: Google")}"
|
||||||
|
: "''${CONTAINER_TOKEN:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_token" -H "Metadata-Flavor: Google")}"
|
||||||
|
|
||||||
|
: "''${CONTAINER_IMAGE:?Error: Missing CONTAINER_IMAGE}"
|
||||||
|
: "''${CONTAINER_HUB:?Error: Missing CONTAINER_HUB}"
|
||||||
|
|
||||||
|
mkdir -p /run/container
|
||||||
|
cat >/run/container/env <<EOF
|
||||||
|
CONTAINER_IMAGE="''${CONTAINER_IMAGE}"
|
||||||
|
CONTAINER_HUB="''${CONTAINER_HUB}"
|
||||||
|
CONTAINER_USER="''${CONTAINER_USER}"
|
||||||
|
CONTAINER_TOKEN="''${CONTAINER_TOKEN}"
|
||||||
|
EOF
|
||||||
|
''
|
||||||
|
);
|
||||||
|
};
|
||||||
|
path = [ pkgs.curl pkgs.docker pkgs.teepot.teepot.tdx_extend pkgs.coreutils ];
|
||||||
|
script = ''
|
||||||
|
set -eu -o pipefail
|
||||||
|
if [[ $CONTAINER_USER ]] && [[ $CONTAINER_TOKEN ]]; then
|
||||||
|
docker login -u "$CONTAINER_USER" -p "$CONTAINER_TOKEN" "$CONTAINER_HUB"
|
||||||
|
fi
|
||||||
|
|
||||||
|
docker pull "''${CONTAINER_HUB}/''${CONTAINER_IMAGE}"
|
||||||
|
DIGEST=$(docker inspect --format '{{.Id}}' "''${CONTAINER_HUB}/''${CONTAINER_IMAGE}")
|
||||||
|
DIGEST=''${DIGEST#sha256:}
|
||||||
|
echo "Measuring $DIGEST" >&2
|
||||||
|
test -c /dev/tdx_guest && tdx-extend --digest "$DIGEST" --rtmr 3
|
||||||
|
exec docker run --env "GOOGLE_METADATA=1" --network=host --init --privileged "sha256:$DIGEST"
|
||||||
|
'';
|
||||||
|
|
||||||
|
postStop = lib.mkDefault ''
|
||||||
|
shutdown --reboot +5
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
}
|
||||||
60
packages/tdx_google/vector.nix
Normal file
60
packages/tdx_google/vector.nix
Normal file
|
|
@ -0,0 +1,60 @@
|
||||||
|
{ lib
|
||||||
|
, modulesPath
|
||||||
|
, pkgs
|
||||||
|
, ...
|
||||||
|
}: {
|
||||||
|
services.vector.enable = true;
|
||||||
|
services.vector.settings = {
|
||||||
|
api.enabled = false;
|
||||||
|
sources = {
|
||||||
|
otlp = {
|
||||||
|
type = "opentelemetry";
|
||||||
|
grpc = { address = "127.0.0.1:4317"; };
|
||||||
|
http = {
|
||||||
|
address = "127.0.0.1:4318";
|
||||||
|
keepalive = {
|
||||||
|
max_connection_age_jitter_factor = 0.1;
|
||||||
|
max_connection_age_secs = 300;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
sinks = {
|
||||||
|
console = {
|
||||||
|
inputs = [ "otlp.logs" ];
|
||||||
|
target = "stdout";
|
||||||
|
type = "console";
|
||||||
|
encoding = { codec = "json"; };
|
||||||
|
};
|
||||||
|
kafka = {
|
||||||
|
type = "kafka";
|
||||||
|
inputs = [ "otlp.logs" ];
|
||||||
|
bootstrap_servers = "\${KAFKA_URLS:-127.0.0.1:0}";
|
||||||
|
topic = "\${KAFKA_TOPIC:-tdx-google}";
|
||||||
|
encoding = {
|
||||||
|
codec = "json";
|
||||||
|
compression = "lz4";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
systemd.services.vector.path = [ pkgs.curl pkgs.coreutils ];
|
||||||
|
# `-` means, that the file can be missing, so that `ExecStartPre` can execute and create it
|
||||||
|
systemd.services.vector.serviceConfig.EnvironmentFile = "-/run/vector/env";
|
||||||
|
# `+` means, that the process has access to all files, to be able to write to `/run`
|
||||||
|
systemd.services.vector.serviceConfig.ExecStartPre = "+" + toString (
|
||||||
|
pkgs.writeShellScript "vector-start-pre" ''
|
||||||
|
set -eu -o pipefail
|
||||||
|
: "''${KAFKA_URLS:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/kafka_urls" -H "Metadata-Flavor: Google")}"
|
||||||
|
: "''${KAFKA_TOPIC:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/kafka_topic" -H "Metadata-Flavor: Google")}"
|
||||||
|
|
||||||
|
KAFKA_TOPIC="''${KAFKA_TOPIC:-tdx-google}"
|
||||||
|
|
||||||
|
mkdir -p /run/vector
|
||||||
|
cat >/run/vector/env <<EOF
|
||||||
|
KAFKA_URLS="''${KAFKA_URLS}"
|
||||||
|
KAFKA_TOPIC="''${KAFKA_TOPIC}"
|
||||||
|
EOF
|
||||||
|
''
|
||||||
|
);
|
||||||
|
}
|
||||||
Loading…
Add table
Add a link
Reference in a new issue