mirror of
https://github.com/matter-labs/teepot.git
synced 2025-07-21 23:23:57 +02:00
de06acbef9
leave it to the github workflow on push to main Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
53 lines
1.3 KiB
Nix
53 lines
1.3 KiB
Nix
# SPDX-License-Identifier: Apache-2.0
|
|
# Copyright (c) 2024 Matter Labs
|
|
{ lib
|
|
, pkgs
|
|
, inputs
|
|
, teepot
|
|
, nixsgx
|
|
, container-name ? "teepot-vault-admin-sgx-azure"
|
|
, tag ? null
|
|
, isAzure ? null
|
|
}:
|
|
pkgs.callPackage inputs.nixsgx-flake.lib.mkSGXContainer {
|
|
name = container-name;
|
|
inherit tag;
|
|
|
|
packages = [ teepot.teepot.tee_vault_admin ];
|
|
entrypoint = "${teepot.teepot.tee_vault_admin}/bin/tee-vault-admin";
|
|
|
|
isAzure = true;
|
|
|
|
manifest = {
|
|
loader = {
|
|
log_level = "error";
|
|
env = {
|
|
### Admin Config ###
|
|
PORT.passthrough = true;
|
|
|
|
### VAULT attestation ###
|
|
VAULT_ADDR.passthrough = true;
|
|
VAULT_SGX_MRENCLAVE.passthrough = true;
|
|
VAULT_SGX_MRSIGNER.passthrough = true;
|
|
VAULT_SGX_ALLOWED_TCB_LEVELS.passthrough = true;
|
|
|
|
### DEBUG ###
|
|
RUST_BACKTRACE = "1";
|
|
RUST_LOG = "info,tee_vault_admin=trace,teepot=trace,vault_tee_client=trace,tee_client=trace,awc=debug";
|
|
|
|
### Enclave security ###
|
|
ALLOWED_TCB_LEVELS = "SwHardeningNeeded";
|
|
};
|
|
};
|
|
|
|
sgx = {
|
|
edmm_enable = false;
|
|
enclave_size = "2G";
|
|
max_threads = 64;
|
|
};
|
|
|
|
# possible tweak option, if problems with mio
|
|
# currently mio is compiled with `mio_unsupported_force_waker_pipe`
|
|
# sys.insecure__allow_eventfd = true
|
|
};
|
|
}
|