chore: cleanup and nixify

* create containers with nix
* updated README.md
* added SPDX license headers

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>

packages/container-vault-unseal-sgx-azure/Dockerfile

@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2024 Matter Labs
+
+FROM teepot-vault-unseal-sgx-azure:base
+
+WORKDIR /app
+
+COPY packages/container-vault-sgx-azure/test-enclave-key.pem /tmp/
+
+RUN set -eux; \
+    gramine-manifest -Darch_libdir=/lib/x86_64-linux-gnu \
+      -Dentrypoint=$(readlink /bin/tee-vault-unseal) \
+      -Dvault_auth_tee_sha=1505ffe3ef0994de63206ccce1dec6715d55e72955960cb7314e4571811c4422 \
+      -Dvault_auth_tee_version=0.1.0+dev \
+      -Dexecdir=/bin \
+      -Dlog_level=warning \
+      tee-vault-unseal.manifest.toml tee-vault-unseal.manifest; \
+    gramine-sgx-sign --manifest tee-vault-unseal.manifest --output tee-vault-unseal.manifest.sgx --key /tmp/test-enclave-key.pem; \
+    rm /tmp/test-enclave-key.pem
+
+EXPOSE 8443
+
+ENTRYPOINT ["/bin/sh", "-c"]
+ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+CMD [ "echo tee-vault-unseal in SGX mode starting; restart-aesmd ; exec gramine-sgx tee-vault-unseal" ]

packages/container-vault-unseal-sgx-azure/default.nix

@@ -0,0 +1,54 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2024 Matter Labs
+{ pkgs
+, vat
+, nixsgx
+, curl
+, teepot
+, bash
+, coreutils
+, openssl
+, vault
+}:
+let manifest = ./tee-vault-unseal.manifest.toml;
+in pkgs.dockerTools.buildLayeredImage {
+  name = "teepot-vault-unseal-sgx-azure";
+  tag = "base";
+
+  config.Entrypoint = [ "/bin/sh" "-c" ];
+
+  contents = pkgs.buildEnv {
+    name = "image-root";
+
+    paths = with pkgs.dockerTools; with nixsgx; with teepot;[
+      bash
+      coreutils
+      openssl
+      vault
+      azure-dcap-client
+      curl
+      vat.vault-auth-tee.sha
+      teepot.teepot.tee_vault_unseal
+      gramine
+      restart-aesmd
+      sgx-dcap.quote_verify
+      sgx-psw
+      usrBinEnv
+      binSh
+      caCertificates
+      fakeNss
+    ];
+    pathsToLink = [ "/bin" "/lib" "/etc" "/share" "/app" ];
+    postBuild = ''
+      mkdir -p $out/{app,etc}
+      cp ${manifest} $out/app/tee-vault-unseal.manifest.toml
+      mkdir -p $out/var/run
+      mkdir -p $out/${nixsgx.sgx-psw.out}/aesm/
+      touch $out/etc/sgx_default_qcnl.conf
+      mkdir -p $out/opt/vault/.cache $out/opt/vault/tls
+      ln -s ${curl.out}/lib/libcurl.so $out/${nixsgx.sgx-psw.out}/aesm/
+      ln -s ${nixsgx.azure-dcap-client.out}/lib/libdcap_quoteprov.so $out/${nixsgx.sgx-psw.out}/aesm/libdcap_quoteprov.so.1
+      printf "precedence ::ffff:0:0/96  100\n" > $out/etc/gai.conf
+    '';
+  };
+}

packages/container-vault-unseal-sgx-azure/tee-vault-unseal.manifest.toml

@@ -0,0 +1,74 @@
+libos.entrypoint = "{{ entrypoint }}"
+
+[loader]
+argv = ["{{ entrypoint }}"]
+entrypoint = "file:{{ gramine.libos }}"
+
+[loader.env]
+### Admin Config ###
+PORT = { passthrough = true }
+
+### VAULT attestation ###
+VAULT_ADDR = { passthrough = true }
+VAULT_SGX_MRENCLAVE = { passthrough = true }
+VAULT_SGX_MRSIGNER = { passthrough = true }
+VAULT_SGX_ALLOWED_TCB_LEVELS = { passthrough = true }
+
+### DEBUG ###
+RUST_BACKTRACE = "1"
+RUST_LOG = "info,tee_vault_unseal=trace,teepot=trace,vault_tee_client=trace,tee_client=trace,awc=debug"
+
+### Enclave security ###
+ALLOWED_TCB_LEVELS = "SwHardeningNeeded"
+
+### Fixed values ###
+LD_LIBRARY_PATH = "/lib"
+SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt"
+PATH = "/bin"
+HOME = "/app"
+
+MALLOC_ARENA_MAX = "1"
+AZDCAP_DEBUG_LOG_LEVEL = "ignore"
+AZDCAP_COLLATERAL_VERSION = "v4"
+
+VAULT_AUTH_TEE_SHA256 = "{{ vault_auth_tee_sha }}"
+VAULT_AUTH_TEE_VERSION = "{{ vault_auth_tee_version }}"
+
+[fs]
+root.uri = "file:/"
+start_dir = "/app"
+mounts = [
+  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
+  { path = "{{ gramine.runtimedir() }}/libdcap_quoteprov.so", uri = "file:/lib/libdcap_quoteprov.so" },
+  { type = "tmpfs", path = "/var/tmp" },
+  { type = "tmpfs", path = "/tmp" },
+  { type = "tmpfs", path = "/app/.dcap-qcnl" },
+  { type = "tmpfs", path = "/app/.az-dcap-client" },
+]
+
+[sgx]
+trusted_files = [
+  "file:/app/",
+  "file:/bin/",
+  "file:/etc/gai.conf",
+  "file:/etc/sgx_default_qcnl.conf",
+  "file:/etc/ssl/certs/ca-bundle.crt",
+  "file:/lib/",
+  "file:/lib/libdcap_quoteprov.so",
+  "file:/nix/",
+  "file:{{ gramine.libos }}",
+  "file:{{ gramine.runtimedir() }}/",
+]
+remote_attestation = "dcap"
+max_threads = 64
+edmm_enable = false
+## max enclave size
+enclave_size = "2G"
+
+[sys]
+enable_extra_runtime_domain_names_conf = true
+enable_sigterm_injection = true
+
+# possible tweak option, if problems with mio
+# currently mio is compiled with `mio_unsupported_force_waker_pipe`
+# insecure__allow_eventfd = true