harald/teepot
1
0
Fork 0
mirror of https://github.com/matter-labs/teepot.git synced 2025-07-22 07:24:48 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

chore: cleanup and nixify

Browse source 
* create containers with nix
* updated README.md
* added SPDX license headers

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
This commit is contained in:
Harald Hoyer 2024-02-27 12:04:31 +01:00
parent c8082debc7
commit 91f1612e0f
Signed by: harald
GPG key ID: F519A1143B3FBE32
36 changed files with 900 additions and 659 deletions
Download patch file Download diff file Expand all files Collapse all files

77
packages/container-vault-sgx-azure/vault.manifest.toml Normal file
View file

@ -0,0 +1,77 @@
libos.entrypoint = "{{ tee_ratls_preexec }}"
[loader]
entrypoint = "file:{{ gramine.libos }}"
argv = [
"{{ tee_ratls_preexec }}",
"--",
"{{ vault_exec }}",
"server",
"-config=/opt/vault/config.hcl",
"-log-level=trace",
]
# set a log level for gramine
log_level = "{{ log_level }}"
[loader.env]
LD_LIBRARY_PATH = "/lib"
SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt"
PATH = "{{ execdir }}"
HOME = "/opt/vault"
VAULT_CLUSTER_ADDR.passthrough = true
VAULT_API_ADDR.passthrough = true
VAULT_RAFT_NODE_ID.passthrough = true
DNS_NAMES = "vault-1,vault-2,vault-3"
# otherwise vault will lock a lot of unused EPC memory
VAULT_RAFT_INITIAL_MMAP_SIZE = "0"
# possible tweak option, if problems with raft
# VAULT_RAFT_DISABLE_MAP_POPULATE = "true"
[fs]
root.uri = "file:/"
start_dir = "/opt/vault"
mounts = [
{ path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
{ path = "{{ gramine.runtimedir() }}/libdcap_quoteprov.so", uri = "file:/lib/libdcap_quoteprov.so" },
{ type = "tmpfs", path = "/var/tmp" },
{ type = "tmpfs", path = "/tmp" },
{ type = "tmpfs", path = "/opt/vault/tls" },
{ type = "tmpfs", path = "/opt/vault/.dcap-qcnl" },
{ type = "tmpfs", path = "/opt/vault/.az-dcap-client" },
{ type = "encrypted", path = "/opt/vault/.cache", uri = "file:/opt/vault/.cache", key_name = "_sgx_mrsigner" },
{ type = "encrypted", path = "/opt/vault/data", uri = "file:/opt/vault/data", key_name = "_sgx_mrsigner" },
]
[sgx]
debug = false
edmm_enable = false
enclave_size = "8G"
max_threads = 64
nonpie_binary = true
remote_attestation = "dcap"
trusted_files = [
"file:/bin/",
"file:/etc/gai.conf",
"file:/etc/ssl/certs/ca-bundle.crt",
"file:/lib/",
"file:/nix/",
"file:/opt/vault/plugins/",
"file:/opt/vault/config.hcl",
"file:/opt/vault/cacert.pem",
"file:/opt/vault/cakey.pem",
"file:{{ gramine.libos }}",
"file:{{ gramine.runtimedir() }}/",
]
[sys]
stack.size = "1M"
enable_extra_runtime_domain_names_conf = true
enable_sigterm_injection = true
# vault needs flock
experimental__enable_flock = true