harald/teepot
1
0
Fork 0
mirror of https://github.com/matter-labs/teepot.git synced 2025-07-21 23:23:57 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: use nixsgx nix function to create containers

Browse source 
It refactors the way the SGX containers are built.
This removes all `Dockerfile` and gramine manifest files.
It also enables a single recipe for azure and non-azure variants.

Additionally the `teepot-crate.nix` is now the inherited recipe to
build the rust `teepot` crate.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
This commit is contained in:
Harald Hoyer 2024-06-03 16:46:21 +02:00
parent 93e3e73d56
commit d0c5950c0e
Signed by: harald
GPG key ID: F519A1143B3FBE32
30 changed files with 337 additions and 897 deletions
Download patch file Download diff file Expand all files Collapse all files

93
packages/container-vault-unseal-sgx-azure/default.nix
View file

@ -1,52 +1,59 @@
# SPDX-License-Identifier: Apache-2.0
# Copyright (c) 2024 Matter Labs
{ pkgs
, vat
, nixsgx
, curl
{ lib
, pkgs
, inputs
, teepot
, bash
, coreutils
, openssl
, nixsgx
, vat
, container-name ? "teepot-vault-unseal-sgx-azure"
, tag ? "latest"
, isAzure ? true
}:
let manifest = ./tee-vault-unseal.manifest.toml;
in pkgs.dockerTools.buildLayeredImage {
name = "teepot-vault-unseal-sgx-azure";
tag = "base";
pkgs.callPackage inputs.nixsgx-flake.lib.mkSGXContainer {
name = container-name;
inherit tag;
config.Entrypoint = [ "/bin/sh" "-c" ];
packages = [
vat.vault-auth-tee.sha
teepot.teepot.tee_vault_unseal
];
entrypoint = "${teepot.teepot.tee_vault_unseal}/bin/tee-vault-unseal";
contents = pkgs.buildEnv {
name = "image-root";
isAzure = true;
paths = with pkgs.dockerTools; with nixsgx;[
bash
coreutils
openssl.out
azure-dcap-client
curl.out
vat.vault-auth-tee.sha
teepot.teepot.tee_vault_unseal
gramine
restart-aesmd
sgx-dcap.quote_verify
sgx-psw
usrBinEnv
binSh
caCertificates
fakeNss
];
pathsToLink = [ "/bin" "/lib" "/etc" "/share" "/app" ];
postBuild = ''
mkdir -p $out/{app,etc}
cp ${manifest} $out/app/tee-vault-unseal.manifest.toml
mkdir -p $out/var/run
mkdir -p $out/${nixsgx.sgx-psw.out}/aesm/
touch $out/etc/sgx_default_qcnl.conf
mkdir -p $out/opt/vault/.cache $out/opt/vault/tls
ln -s ${curl.out}/lib/libcurl.so $out/${nixsgx.sgx-psw.out}/aesm/
ln -s ${nixsgx.azure-dcap-client.out}/lib/libdcap_quoteprov.so $out/${nixsgx.sgx-psw.out}/aesm/libdcap_quoteprov.so.1
printf "precedence ::ffff:0:0/96 100\n" > $out/etc/gai.conf
'';
manifest = {
loader = {
log_level = "error";
env = {
### Admin Config ###
PORT.passthrough = true;
### VAULT attestation ###
VAULT_ADDR.passthrough = true;
VAULT_SGX_MRENCLAVE.passthrough = true;
VAULT_SGX_MRSIGNER.passthrough = true;
VAULT_SGX_ALLOWED_TCB_LEVELS.passthrough = true;
### DEBUG ###
RUST_BACKTRACE = "1";
RUST_LOG = "info,tee_vault_unseal=trace,teepot=trace,vault_tee_client=trace,tee_client=trace,awc=debug";
### Enclave security ###
ALLOWED_TCB_LEVELS = "SwHardeningNeeded";
VAULT_AUTH_TEE_SHA256 = "${vat.vault-auth-tee.sha}/share/vault-auth-tee.sha256";
};
};
sgx = {
edmm_enable = false;
enclave_size = "2G";
max_threads = 64;
};
# possible tweak option, if problems with mio
# currently mio is compiled with `mio_unsupported_force_waker_pipe`
# sys.insecure__allow_eventfd = true
};
}