mirror of
https://github.com/matter-labs/teepot.git
synced 2025-07-21 07:03:56 +02:00
91f1612e0f
* create containers with nix * updated README.md * added SPDX license headers Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
53 lines
1.3 KiB
Nix
53 lines
1.3 KiB
Nix
# SPDX-License-Identifier: Apache-2.0
|
|
# Copyright (c) 2024 Matter Labs
|
|
{ pkgs
|
|
, vat
|
|
, nixsgx
|
|
, curl
|
|
, teepot
|
|
, bash
|
|
, coreutils
|
|
, openssl
|
|
, vault
|
|
}:
|
|
let manifest = ./vault.manifest.toml;
|
|
in pkgs.dockerTools.buildLayeredImage {
|
|
name = "teepot-vault-sgx-azure";
|
|
tag = "base";
|
|
|
|
config.Entrypoint = [ "/bin/sh" "-c" ];
|
|
|
|
contents = pkgs.buildEnv {
|
|
name = "image-root";
|
|
|
|
paths = with pkgs.dockerTools; with nixsgx;[
|
|
bash
|
|
coreutils
|
|
teepot.teepot.tee_ratls_preexec
|
|
vault
|
|
azure-dcap-client
|
|
curl
|
|
vat.vault-auth-tee
|
|
gramine
|
|
restart-aesmd
|
|
sgx-dcap.quote_verify
|
|
sgx-psw
|
|
usrBinEnv
|
|
binSh
|
|
caCertificates
|
|
fakeNss
|
|
teepot.container-vault-start-config
|
|
];
|
|
pathsToLink = [ "/bin" "/lib" "/etc" "/opt/vault" ];
|
|
postBuild = ''
|
|
mkdir -p $out/var/run
|
|
mkdir -p $out/${nixsgx.sgx-psw.out}/aesm/
|
|
mkdir -p $out/opt/vault/data $out/opt/vault/.cache $out/opt/vault/tls
|
|
ln -s ${curl.out}/lib/libcurl.so $out/${nixsgx.sgx-psw.out}/aesm/
|
|
ln -s ${nixsgx.azure-dcap-client.out}/lib/libdcap_quoteprov.so $out/${nixsgx.sgx-psw.out}/aesm/libdcap_quoteprov.so.1
|
|
mkdir -p $out/opt/vault/plugins
|
|
ln -s ${vat.vault-auth-tee}/bin/vault-auth-tee $out/opt/vault/plugins
|
|
cp ${manifest} $out/opt/vault/vault.manifest.toml
|
|
'';
|
|
};
|
|
}
|