feat(google-tdx): add Vector service integration

- Enable Vector service and configure OpenTelemetry source.
- Add sinks for logs output to console and Kafka.
- Configure environment setup for Kafka using GCP metadata API.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>

packages/tdx_google/configuration.nix

@@ -8,6 +8,61 @@
     "${toString modulesPath}/profiles/qemu-guest.nix"
   ];
 
+  services.vector.enable = true;
+  services.vector.settings = {
+    api.enabled = false;
+    sources = {
+      otlp = {
+        type = "opentelemetry";
+        grpc = { address = "127.0.0.1:4317"; };
+        http = {
+          address = "127.0.0.1:4318";
+          keepalive = {
+            max_connection_age_jitter_factor = 0.1;
+            max_connection_age_secs = 300;
+          };
+        };
+      };
+    };
+    sinks = {
+      console = {
+        inputs = [ "otlp.logs" ];
+        target = "stdout";
+        type = "console";
+        encoding = { codec = "json"; };
+      };
+      kafka = {
+        type = "kafka";
+        inputs = [ "otlp.logs" ];
+        bootstrap_servers = "\${KAFKA_URLS:-127.0.0.1:0}";
+        topic = "\${KAFKA_TOPIC:-tdx-google}";
+        encoding = {
+          codec = "json";
+          compression = "lz4";
+        };
+      };
+    };
+  };
+  systemd.services.vector.path = [ pkgs.curl pkgs.coreutils ];
+  # `-` means, that the file can be missing, so that `ExecStartPre` can execute and create it
+  systemd.services.vector.serviceConfig.EnvironmentFile = "-/run/vector/env";
+  # `+` means, that the process has access to all files, to be able to write to `/run`
+  systemd.services.vector.serviceConfig.ExecStartPre = "+" + toString (
+    pkgs.writeShellScript "vector-start-pre" ''
+      set -eu -o pipefail
+      : "''${KAFKA_URLS:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/kafka_urls" -H "Metadata-Flavor: Google")}"
+      : "''${KAFKA_TOPIC:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/kafka_topic" -H "Metadata-Flavor: Google")}"
+
+      KAFKA_TOPIC="''${KAFKA_TOPIC:-tdx-google}"
+
+      mkdir -p /run/vector
+      cat >/run/vector/env <<EOF
+      KAFKA_URLS="''${KAFKA_URLS}"
+      KAFKA_TOPIC="''${KAFKA_TOPIC}"
+      EOF
+    ''
+  );
+
   # the container might want to listen on ports
   networking.firewall.enable = true;
   networking.firewall.allowedTCPPortRanges = [{ from = 1024; to = 65535; }];
@@ -56,7 +111,7 @@
       DIGEST=''${DIGEST#sha256:}
       echo "Measuring $DIGEST" >&2
       test -c /dev/tdx_guest && tdx-extend --digest "$DIGEST" --rtmr 3
-      exec docker run --init --privileged "sha256:$DIGEST"
+      exec docker run --network=host --init --privileged "sha256:$DIGEST"
     '';
 
     postStop = lib.mkDefault ''

systems/x86_64-linux/tdxtest/default.nix

@@ -34,6 +34,11 @@
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNsmP15vH8BVKo7bdvIiiEjiQboPGcRPqJK0+bH4jKD"
   ];
 
+  environment.systemPackages = with pkgs; [
+    strace
+    tcpdump
+  ];
+
 
   fileSystems = {
     "/" = {