mirror of
https://github.com/matter-labs/teepot.git
synced 2025-07-21 07:03:56 +02:00
feat(tdx): add nix build for TDX google VMs
Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
This commit is contained in:
Harald Hoyer
parent
8270c389e4
commit
dc1e756ec6
GPG key ID:
F519A1143B3FBE32
11 changed files with 638 additions and 16 deletions
180
packages/tdx_google/configuration.nix
Normal file
180
packages/tdx_google/configuration.nix
Normal file
|
|
@ -0,0 +1,180 @@
|
|||
{ lib
|
||||
, modulesPath
|
||||
, pkgs
|
||||
, ...
|
||||
}: {
|
||||
imports = [
|
||||
"${toString modulesPath}/profiles/minimal.nix"
|
||||
"${toString modulesPath}/profiles/qemu-guest.nix"
|
||||
];
|
||||
|
||||
/*
|
||||
# SSH login for debugging
|
||||
services.sshd.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
services.openssh.settings.PermitRootLogin = lib.mkOverride 999 "yes";
|
||||
users.users.root.openssh.authorizedKeys.keys = [
|
||||
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDsb/Tr69YN5MQLweWPuJaRGm+h2kOyxfD6sqKEDTIwoAAAABHNzaDo="
|
||||
"sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBACLgT81iB1iWWVuXq6PdQ5GAAGhaZhSKnveQCvcNnAOZ5WKH80bZShKHyAYzrzbp8IGwLWJcZQ7TqRK+qZdfagAAAAEc3NoOg=="
|
||||
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAYbUTKpy4QR3s944/hjJ1UK05asFEs/SmWeUbtS0cdA660sT4xHnRfals73FicOoz+uIucJCwn/SCM804j+wtM="
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNsmP15vH8BVKo7bdvIiiEjiQboPGcRPqJK0+bH4jKD"
|
||||
];
|
||||
*/
|
||||
|
||||
# the container might want to listen on ports
|
||||
networking.firewall.enable = true;
|
||||
networking.firewall.allowedTCPPortRanges = [{ from = 1024; to = 65535; }];
|
||||
networking.firewall.allowedUDPPortRanges = [{ from = 1024; to = 65535; }];
|
||||
|
||||
networking.useNetworkd = lib.mkDefault true;
|
||||
|
||||
# don't fill up the logs
|
||||
networking.firewall.logRefusedConnections = false;
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
systemd.services.docker_start_container = {
|
||||
description = "The main application container";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network-online.target" "docker.service" ];
|
||||
requires = [ "network-online.target" "docker.service" ];
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
User = "root";
|
||||
};
|
||||
path = [ pkgs.curl pkgs.docker pkgs.teepot.teepot.tdx_extend pkgs.coreutils ];
|
||||
script = ''
|
||||
set -eu -o pipefail
|
||||
: "''${CONTAINER_IMAGE:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_image" -H "Metadata-Flavor: Google")}"
|
||||
: "''${CONTAINER_HUB:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_hub" -H "Metadata-Flavor: Google")}"
|
||||
: "''${CONTAINER_USER:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_user" -H "Metadata-Flavor: Google")}"
|
||||
: "''${CONTAINER_TOKEN:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_token" -H "Metadata-Flavor: Google")}"
|
||||
|
||||
: "''${CONTAINER_IMAGE:?Error: Missing CONTAINER_IMAGE}"
|
||||
: "''${CONTAINER_HUB:?Error: Missing CONTAINER_HUB}"
|
||||
|
||||
if [[ $CONTAINER_USER ]] && [[ $CONTAINER_TOKEN ]]; then
|
||||
docker login -u "$CONTAINER_USER" -p "$CONTAINER_TOKEN" "$CONTAINER_HUB"
|
||||
fi
|
||||
|
||||
docker pull "''${CONTAINER_HUB}/''${CONTAINER_IMAGE}"
|
||||
DIGEST=$(docker inspect --format '{{.Id}}' "''${CONTAINER_HUB}/''${CONTAINER_IMAGE}")
|
||||
DIGEST=''${DIGEST#sha256:}
|
||||
echo "Measuring $DIGEST" >&2
|
||||
test -c /dev/tdx_guest && tdx-extend --digest "$DIGEST" --rtmr 3
|
||||
exec docker run --init --privileged "sha256:$DIGEST"
|
||||
'';
|
||||
|
||||
postStop = lib.mkDefault ''
|
||||
shutdown --reboot +5
|
||||
'';
|
||||
};
|
||||
|
||||
services.prometheus.exporters.node = {
|
||||
enable = true;
|
||||
port = 9100;
|
||||
enabledCollectors = [
|
||||
"logind"
|
||||
"systemd"
|
||||
];
|
||||
disabledCollectors = [
|
||||
"textfile"
|
||||
];
|
||||
#openFirewall = true;
|
||||
#firewallFilter = "-i br0 -p tcp -m tcp --dport 9100";
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
teepot.teepot
|
||||
];
|
||||
|
||||
# /var is on tmpfs anyway
|
||||
services.journald.storage = "volatile";
|
||||
|
||||
# we can't rely on/trust the hypervisor
|
||||
services.timesyncd.enable = false;
|
||||
services.chrony = {
|
||||
enable = true;
|
||||
enableNTS = true;
|
||||
servers = [
|
||||
"time.cloudflare.com"
|
||||
"ntppool1.time.nl"
|
||||
"ntppool2.time.nl"
|
||||
];
|
||||
};
|
||||
systemd.services."chronyd".after = [ "network-online.target" ];
|
||||
|
||||
boot.kernelPackages = lib.mkForce pkgs.linuxPackages_6_12;
|
||||
boot.kernelPatches = [
|
||||
{
|
||||
name = "tdx-rtmr";
|
||||
patch = pkgs.fetchurl {
|
||||
url = "https://github.com/haraldh/linux/commit/12d08008a5c94175e7a7dfcee40dff33431d9033.patch";
|
||||
hash = "sha256-sVDhvC3qnXpL5FRxWiQotH7Nl/oqRBQGjJGyhsKeBTA=";
|
||||
};
|
||||
}
|
||||
];
|
||||
|
||||
boot.kernelParams = [
|
||||
"console=ttyS0,115200n8"
|
||||
"random.trust_cpu=on"
|
||||
];
|
||||
|
||||
boot.consoleLogLevel = 7;
|
||||
|
||||
boot.initrd.includeDefaultModules = false;
|
||||
boot.initrd.availableKernelModules = [
|
||||
"tdx_guest"
|
||||
"nvme"
|
||||
"sd_mod"
|
||||
"dm_mod"
|
||||
"ata_piix"
|
||||
];
|
||||
|
||||
boot.initrd.systemd.enable = lib.mkDefault true;
|
||||
|
||||
services.logind.extraConfig = ''
|
||||
NAutoVTs=0
|
||||
ReserveVT=0
|
||||
'';
|
||||
|
||||
services.dbus.implementation = "broker";
|
||||
|
||||
boot.initrd.systemd.tpm2.enable = lib.mkForce false;
|
||||
systemd.tpm2.enable = lib.mkForce false;
|
||||
|
||||
nix.enable = false; # it's a read-only nix store anyway
|
||||
|
||||
security.pam.services.su.forwardXAuth = lib.mkForce false;
|
||||
|
||||
users.mutableUsers = false;
|
||||
users.allowNoPasswordLogin = true;
|
||||
|
||||
system.stateVersion = lib.version;
|
||||
system.switch.enable = lib.mkForce false;
|
||||
|
||||
documentation.info.enable = lib.mkForce false;
|
||||
documentation.nixos.enable = lib.mkForce false;
|
||||
documentation.man.enable = lib.mkForce false;
|
||||
documentation.enable = lib.mkForce false;
|
||||
|
||||
services.udisks2.enable = false; # udisks has become too bloated to have in a headless system
|
||||
|
||||
# Get rid of the perl ecosystem to minimize the TCB and disk size
|
||||
|
||||
# Remove perl from activation
|
||||
system.etc.overlay.enable = lib.mkDefault true;
|
||||
services.userborn.enable = lib.mkDefault true;
|
||||
|
||||
# Random perl remnants
|
||||
system.disableInstallerTools = lib.mkForce true;
|
||||
programs.less.lessopen = lib.mkDefault null;
|
||||
programs.command-not-found.enable = lib.mkDefault false;
|
||||
boot.enableContainers = lib.mkForce false;
|
||||
boot.loader.grub.enable = lib.mkDefault false;
|
||||
environment.defaultPackages = lib.mkDefault [ ];
|
||||
|
||||
# Check that the system does not contain a Nix store path that contains the
|
||||
# string "perl".
|
||||
system.forbiddenDependenciesRegexes = [ "perl" ];
|
||||
}
|
||||
15
packages/tdx_google/default.nix
Normal file
15
packages/tdx_google/default.nix
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
# SPDX-License-Identifier: Apache-2.0
|
||||
# Copyright (c) 2024 Matter Labs
|
||||
{ lib
|
||||
, pkgs
|
||||
, system
|
||||
, ...
|
||||
}: lib.teepot.nixosGenerate {
|
||||
inherit (lib) nixosSystem;
|
||||
inherit system pkgs;
|
||||
modules = [
|
||||
./configuration.nix
|
||||
./google.nix
|
||||
];
|
||||
formatModule = ./verity.nix;
|
||||
}
|
||||
33
packages/tdx_google/google.nix
Normal file
33
packages/tdx_google/google.nix
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
{ lib
|
||||
, pkgs
|
||||
, modulesPath
|
||||
, ...
|
||||
}: {
|
||||
imports = [
|
||||
"${toString modulesPath}/profiles/headless.nix"
|
||||
];
|
||||
|
||||
system.image.id = "tdx_base";
|
||||
|
||||
boot.initrd.kernelModules = [ "virtio_scsi" ];
|
||||
boot.kernelModules = [ "virtio_pci" "virtio_net" ];
|
||||
|
||||
# Force getting the hostname from Google Compute.
|
||||
networking.hostName = lib.mkForce "";
|
||||
|
||||
# Configure default metadata hostnames
|
||||
networking.extraHosts = ''
|
||||
169.254.169.254 metadata.google.internal metadata
|
||||
'';
|
||||
|
||||
networking.timeServers = [ "metadata.google.internal" ];
|
||||
|
||||
environment.etc."sysctl.d/60-gce-network-security.conf".source = "${pkgs.google-guest-configs}/etc/sysctl.d/60-gce-network-security.conf";
|
||||
|
||||
networking.usePredictableInterfaceNames = false;
|
||||
|
||||
# GC has 1460 MTU
|
||||
networking.interfaces.eth0.mtu = 1460;
|
||||
|
||||
boot.extraModprobeConfig = lib.readFile "${pkgs.google-guest-configs}/etc/modprobe.d/gce-blacklist.conf";
|
||||
}
|
||||
127
packages/tdx_google/verity.nix
Normal file
127
packages/tdx_google/verity.nix
Normal file
|
|
@ -0,0 +1,127 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, modulesPath
|
||||
, ...
|
||||
}:
|
||||
let
|
||||
inherit (config.image.repart.verityStore) partitionIds;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
"${toString modulesPath}/image/repart.nix"
|
||||
];
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
fsType = "tmpfs";
|
||||
options = [ "mode=0755" "noexec" ];
|
||||
};
|
||||
|
||||
"/dev/shm" = {
|
||||
fsType = "tmpfs";
|
||||
options = [ "defaults" "nosuid" "noexec" "nodev" "size=2G" ];
|
||||
};
|
||||
|
||||
"/run" = {
|
||||
fsType = "tmpfs";
|
||||
options = [ "defaults" "mode=0755" "nosuid" "noexec" "nodev" "size=512M" ];
|
||||
};
|
||||
|
||||
"/usr" = {
|
||||
device = "/dev/mapper/usr";
|
||||
# explicitly mount it read-only otherwise systemd-remount-fs will fail
|
||||
options = [ "ro" ];
|
||||
fsType = config.image.repart.partitions.${partitionIds.store}.repartConfig.Format;
|
||||
};
|
||||
|
||||
# bind-mount the store
|
||||
"/nix/store" = {
|
||||
device = "/usr/nix/store";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
};
|
||||
|
||||
image.repart = {
|
||||
verityStore = {
|
||||
enable = true;
|
||||
ukiPath = "/EFI/BOOT/BOOTx64.EFI";
|
||||
};
|
||||
|
||||
partitions = {
|
||||
${partitionIds.esp} = {
|
||||
# the UKI is injected into this partition by the verityStore module
|
||||
repartConfig = {
|
||||
Type = "esp";
|
||||
Format = "vfat";
|
||||
SizeMinBytes = "64M";
|
||||
};
|
||||
};
|
||||
${partitionIds.store-verity}.repartConfig = {
|
||||
Minimize = "best";
|
||||
};
|
||||
${partitionIds.store}.repartConfig = {
|
||||
Minimize = "best";
|
||||
Format = "squashfs";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
boot = {
|
||||
loader.grub.enable = false;
|
||||
initrd.systemd.enable = true;
|
||||
};
|
||||
|
||||
system.image = {
|
||||
id = lib.mkDefault "nixos-appliance";
|
||||
version = "1";
|
||||
};
|
||||
|
||||
# don't create /usr/bin/env
|
||||
# this would require some extra work on read-only /usr
|
||||
# and it is not a strict necessity
|
||||
system.activationScripts.usrbinenv = lib.mkForce "";
|
||||
|
||||
boot.kernelParams = [
|
||||
"systemd.verity_usr_options=panic-on-corruption"
|
||||
"panic=30"
|
||||
"boot.panic_on_fail" # reboot the machine upon fatal boot issues
|
||||
"lockdown=1"
|
||||
];
|
||||
|
||||
system.build.vmdk_verity =
|
||||
config.system.build.finalImage.overrideAttrs
|
||||
(
|
||||
finalAttrs: previousAttrs:
|
||||
let
|
||||
kernel = config.boot.uki.settings.UKI.Linux;
|
||||
ukifile = "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
|
||||
in
|
||||
{
|
||||
nativeBuildInputs =
|
||||
previousAttrs.nativeBuildInputs
|
||||
++ [
|
||||
pkgs.qemu
|
||||
pkgs.teepot.teepot.rtmr_calc
|
||||
];
|
||||
|
||||
postInstall = ''
|
||||
qemu-img convert -f raw -O vmdk \
|
||||
$out/${config.image.repart.imageFileBasename}.raw \
|
||||
$out/${config.image.repart.imageFileBasename}.vmdk
|
||||
qemu-img info \
|
||||
$out/${config.image.repart.imageFileBasename}.vmdk
|
||||
echo "kernel: ${kernel}"
|
||||
echo "uki: ${ukifile}"
|
||||
rtmr-calc \
|
||||
--image $out/${config.image.repart.imageFileBasename}.raw \
|
||||
--bootefi "${ukifile}" \
|
||||
--kernel "${kernel}" | tee $out/${config.image.repart.imageFileBasename}_rtmr.json
|
||||
rm -vf $out/${config.image.repart.imageFileBasename}.raw
|
||||
'';
|
||||
}
|
||||
);
|
||||
|
||||
formatAttr = lib.mkForce "vmdk_verity";
|
||||
fileExtension = lib.mkForce ".raw";
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue