trustmee/docker-compose.yml at main · elasticproject-eu/trustmee · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
services:
  kbs:
    build:
      context: .
      dockerfile: kbs/docker/coco-as-grpc/Dockerfile
    image: ghcr.io/confidential-containers/staged-images/kbs-grpc-as:latest
    environment:
      - RUST_LOG
    command: [
        "/usr/local/bin/kbs",
        "--config-file",
        "/opt/confidential-containers/kbs/user-keys/docker-compose/kbs-config.toml",
      ]
    restart: always # keep the server running
    ports:
      - "8080:8080"
    volumes:
      - ./kbs/data/kbs-storage:/opt/confidential-containers/kbs/repository:rw
      - ./kbs/data/nebula-ca:/opt/confidential-containers/kbs/nebula-ca:rw
      - ./kbs/config:/opt/confidential-containers/kbs/user-keys
    depends_on:
      as:
        condition: service_started
      setup:
        condition: service_completed_successfully

  as:
    build:
      context: .
      dockerfile: attestation-service/docker/as-grpc/Dockerfile
    image: ghcr.io/confidential-containers/staged-images/coco-as-grpc:latest
    environment:
      - RUST_LOG
    ports:
    - "50004:50004"
    restart: always
    volumes:
    - ./kbs/data/attestation-service:/opt/confidential-containers/attestation-service:rw
    - ./kbs/config/as-config.json:/etc/as-config.json:rw
    - ./kbs/config/sgx_default_qcnl.conf:/etc/sgx_default_qcnl.conf:rw
    - ./kbs/config:/opt/confidential-containers/kbs/user-keys
    command: [
      "grpc-as",
      "--socket",
      "0.0.0.0:50004",
      "--config-file",
      "/etc/as-config.json"
    ]
    depends_on:
    - rvps

  rvps:
    build:
      context: .
      dockerfile: rvps/docker/Dockerfile
    image: ghcr.io/confidential-containers/staged-images/rvps:latest
    environment:
      - RUST_LOG
    restart: always # keep the server running
    ports:
      - "50003:50003"
    volumes:
      - ./kbs/data/reference-values:/opt/confidential-containers/attestation-service/reference_values:rw
      - ./kbs/config/rvps.json:/etc/rvps.json:rw
    command: [
      "rvps",
      "--address",
      "0.0.0.0:50003"
    ]

  keyprovider:
    image: ghcr.io/confidential-containers/coco-keyprovider:latest
    environment:
      - RUST_LOG
    restart: always
    ports:
      - "50000:50000"
    volumes:
      - ./kbs/config:/opt/confidential-containers/kbs/user-keys
    command: [
      "coco_keyprovider",
      "--socket",
      "0.0.0.0:50000",
      "--kbs",
      "http://kbs:8080",
      "--auth-private-key",
      "/opt/confidential-containers/kbs/user-keys/private.key"
    ]
    depends_on:
      kbs:
        condition: service_started
      setup:
        condition: service_completed_successfully

  setup:
    image: alpine/openssl
    environment:
      - RUST_LOG
    entrypoint: /bin/ash
    command: >
        -c "
          if [ ! -s /opt/confidential-containers/kbs/user-keys/private.key ]; then
            /usr/bin/openssl genpkey -algorithm ed25519 > /opt/confidential-containers/kbs/user-keys/private.key &&
            /usr/bin/openssl pkey -in /opt/confidential-containers/kbs/user-keys/private.key -pubout -out /opt/confidential-containers/kbs/user-keys/public.pub;
          fi
          cd /opt/confidential-containers/kbs/user-keys
          if [ ! -s token.key ]; then
            openssl genrsa -traditional -out ca.key 2048
            openssl req -new -key ca.key -out ca-req.csr -subj \"/O=CNCF/OU=CoCo/CN=KBS-compose-root\"
            openssl req -x509 -days 3650 -key ca.key -in ca-req.csr -out ca-cert.pem
            openssl ecparam -name prime256v1 -genkey -noout -out token.key
            openssl req -new -key token.key -out token-req.csr -subj \"/O=CNCF/OU=CoCo/CN=CoCo-AS\"
            openssl x509 -req -in token-req.csr -CA ca-cert.pem -CAkey ca.key -CAcreateserial -out token-cert.pem -extensions req_ext
            cat token-cert.pem ca-cert.pem > token-cert-chain.pem;
          fi"

    volumes:
      - ./kbs/config:/opt/confidential-containers/kbs/user-keys