mirror of
https://github.com/matter-labs/teepot.git
synced 2025-07-21 15:13:56 +02:00
760ff7eff1
- Replaced hardcoded metadata-fetching logic with shared metadata service. - Removed custom pre-start scripts and refactored environment handling. - Updated Vector configuration to include custom field transformations. - Streamlined container startup process and ensured proper cleanup. Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
40 lines
1.1 KiB
Nix
40 lines
1.1 KiB
Nix
{ lib
|
|
, modulesPath
|
|
, pkgs
|
|
, ...
|
|
}: {
|
|
virtualisation.docker.enable = true;
|
|
|
|
systemd.services.docker_start_container = {
|
|
description = "The main application container";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network-online.target" "docker.service" "vector.service" "chronyd.service" "metadata.service" ];
|
|
requires = [ "network-online.target" "docker.service" "vector.service" "metadata.service" ];
|
|
serviceConfig = {
|
|
Type = "exec";
|
|
User = "root";
|
|
EnvironmentFile = "-/run/env/env";
|
|
};
|
|
path = [ pkgs.docker pkgs.teepot.teepot.tdx_extend ];
|
|
script = ''
|
|
set -eu -o pipefail
|
|
|
|
DIGEST=''${CONTAINER_DIGEST#sha256:}
|
|
echo "Measuring $DIGEST" >&2
|
|
test -c /dev/tdx_guest && tdx-extend --digest "$DIGEST" --rtmr 3
|
|
|
|
docker run -d --rm \
|
|
--name tdx_container \
|
|
--env "GOOGLE_METADATA=1" \
|
|
--network=host \
|
|
--init \
|
|
--privileged \
|
|
"sha256:$DIGEST"
|
|
exec docker wait tdx_container
|
|
'';
|
|
|
|
postStop = lib.mkDefault ''
|
|
shutdown --reboot +5
|
|
'';
|
|
};
|
|
}
|