Skip to content

Add attested-tls-proxy to buildernet/mkosi recipe #367

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
canercidam merged 2 commits into from
Feb 13, 2026
Merged

Add attested-tls-proxy to buildernet/mkosi recipe #367

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
04d3256
add attested-tls-proxy to buildernet/mkosi recipe
canercidam Feb 12, 2026
931c9f0
feat: improve atls proxy config and point it to other proxy that adds…
fkondej Feb 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions custom-recipes/buildernet/mkosi/playground.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,30 @@ description: Deploy the stack with the BuilderNet mkosi image (QEMU)
recipe:
builder-vm:
services:
attested-tls-proxy:
image: ghcr.io/flashbots/attested-tls-proxy
tag: "1.0.1"
args:
- server
- --listen-addr
- 0.0.0.0:7000
- --server-attestation-type
Copy link
Contributor

@claude claude bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both --server-attestation-type none and --allowed-remote-attestation-type none disable attestation verification. This is expected for local dev, but worth a comment in the YAML for clarity so future readers understand this is intentional and must not be used in production.

- none
- --allowed-remote-attestation-type
- none
- --tls-private-key-path
- /server.key
- --tls-certificate-path
- /server.crt
- builder-hub-proxy:8888
ports:
http: 7000
depends_on:
- builder-hub-proxy:healthy
files:
"/server.key": "server.key"
"/server.crt": "server.crt"

builder:
lifecycle_hooks: true
init:
Expand Down
19 changes: 19 additions & 0 deletions custom-recipes/buildernet/mkosi/server.crt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
-----BEGIN CERTIFICATE-----
MIIDCTCCAfGgAwIBAgIUJiyepwRfje5+tjuPhiA9uWQj4WgwDQYJKoZIhvcNAQEL
BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDIxMjAwMzMyOVoXDTI3MDIx
MjAwMzMyOVowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAlLiVis9jbau8jlwE2uwnphidIuanbWdPJP4KQyrXsq7/
DnF02qnghl9nT4bHSMUYCciOS2PNp9DH2ZWUJwX3tEO1nsT4V0msdYglz5x/1sYn
3hqI8U7GEh3NAA0qkvzEdupyR3FhioRQSrAO6CMOoK84CtwcbCg8+sl1VXJgH7s6
D2daEF3HyxaX4EQKj+vpZQ/TsOSRq2FFeJWtvOCHAczPk2A/3/kLqN2wlxmlJ6Dt
hMoXg8ZwYZKdDIW0qkvtAfvaee0AB4M2OwRQ8Hxgqb+kqMAn7Goo2WxZyIjQ6Mvi
Fl6Ljhp7f4G4RLb0ramVLCbGw3LHEEmQwhbb6i3Z2wIDAQABo1MwUTAdBgNVHQ4E
FgQULJFWsw3onq6iTBFmznbdp1CNoI4wHwYDVR0jBBgwFoAULJFWsw3onq6iTBFm
znbdp1CNoI4wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAjZor
0q0GiMU5D5puCVPEBexXzSeaATSxnQj88wjKYhYnsljniMS78TSNwGqHZQF5y4/M
50S65+eNySfb5KP+3yKMQbVZwM+LCZkifQGaLKat6MqWS5blTMNJuGZAxTM8ba3K
RmidXHhio8VuR+gItOaB3tyYYEGKmDlzajFne68dwGTe9hwzmgqLVzDIE3GFxJ/H
lScxoqF0hiqtkhf8DxrFgC7IOLdItYaZAQluLKnGWS/0tmSYP/pxkaGL3m7M1G35
egYidvH/Z0IJ42S+7Y6a/yhZaqMFqnMHd3rqobMUeUnCJd3MSJp1BRCf03u1JuIe
917M8ZdcpnSZwd78FA==
-----END CERTIFICATE-----
28 changes: 28 additions & 0 deletions custom-recipes/buildernet/mkosi/server.key
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----
Copy link
Contributor

@claude claude bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security concern: Private key committed to repository.

Even if this is a self-signed key for local development/testing, committing private keys to a public repository is a bad practice:

  1. Credential hygiene - It normalizes committing secrets to version control. Anyone cloning this repo gets this key, and it could be mistakenly used beyond local dev.
  2. Key rotation - If this key ever needs to be rotated, it remains in git history forever.

Consider:

  • Generating the key/cert pair at runtime (e.g., in an init step or as an artifact) instead of checking them in. The attested-tls-proxy or a simple openssl command in an init script could generate ephemeral certs.
  • If they must be static files, add a clear comment in the YAML or a README explaining they are intentionally throwaway dev-only credentials.

MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCUuJWKz2Ntq7yO
XATa7CemGJ0i5qdtZ08k/gpDKteyrv8OcXTaqeCGX2dPhsdIxRgJyI5LY82n0MfZ
lZQnBfe0Q7WexPhXSax1iCXPnH/WxifeGojxTsYSHc0ADSqS/MR26nJHcWGKhFBK
sA7oIw6grzgK3BxsKDz6yXVVcmAfuzoPZ1oQXcfLFpfgRAqP6+llD9Ow5JGrYUV4
la284IcBzM+TYD/f+Quo3bCXGaUnoO2EyheDxnBhkp0MhbSqS+0B+9p57QAHgzY7
BFDwfGCpv6SowCfsaijZbFnIiNDoy+IWXouOGnt/gbhEtvStqZUsJsbDcscQSZDC
FtvqLdnbAgMBAAECggEANUB013vT++CbBxR+7o7R0aENnwIdIEj2J2ZJcWyFSKdt
j5Pjhip+yU6e9PRrJizgoxwri2YkrPrOnKP5JRH3dJYsEbowvDyWoo0KEPFWOya/
/sDcmR8eQD1oeqS8Ql580KG5Isi/5vPitiOdatSmt7WV6RmQmc+8qgX53As0zRdW
+HSIRcEgDpBKqsSs/TSHJcKjGIpVaJkfimY/p6xTmQ/SPOQ+Zw8zo3OigQU6dD3P
fVHq5avab1+uZ8dby3HPZ7xwzETeNIVP7OhGLBK4hz2Nyp7HIuDH/zydeQ90p1/H
eXLFJbcw6uZUTMEwTqEbQ0qDiFkMRgo+3J4X1ju05QKBgQDHuq4HAYI1kGBecaLt
r2ADLQBrjqmFSvEoUO4VeCP8ttuL/lUZTZadWIzyzzPJ0agq+1UFJDbU0p4/BHim
0PRHz9QWF5W8HuLFoBLH1ZCc7lR9jvZPacoDbIW5VrXMI+CbZ44t/cgJUVqBevOJ
VU9NvQo1k+WRjMXtPqmdyPKkdwKBgQC+nvomUmXBFm34bHthcUtqs8XCsx8dsLfZ
31LfpIC450Qo1KIf+VKAWbG9nZK+3Px0ohX1M4HLpL/zf5c9Xxk5hDc9zQfeXgwf
9lgCjZrRQ+3215XdwBrnKT8XpEkR4ka+5NrzqF+CH3/dfX9bOS4+z7sn18aKdP5w
WG3BhCqCvQKBgQCntVMnwtaJD6A77YN3vYkLYaA2sGYb7J+u0LX6BRWCwDB9zqO6
SXIs0QwZXm8ICioBXWU4mf4ImooSNDjzKgXUvuhBXLB4dB7K/uyGLAfwHheIDqE4
cYYVdeybgfnJXl7dXwj+CVkMqekrTAhuytl6Vz/ZWUStAN25pqJaQT+tZQKBgECM
NMilPi+UGMj2cxEb/B21olG7td2n6ZmtNbLlUXFLXpk053FMS9OKi9VZdkeLLTGR
cT4Gov0CXL1nhx8RBMmlK8+RjgiOcCyijkrPCI20IvBjMCxW0MVWAjdPOi8EIFCj
zkCT00OMxw+JX4bUZgR+8zEar/BSjZYdW40b5AlBAoGBAIZC+HhJpdJxNoUnndqj
x0nvWM5ZrnPa/6QXyMNn52vbqG7ZMyYCHwDXWJfBfxM9wdsMJKoH8pES9BF9Qr4o
Vv7hb/t9kbB0mg2QgxRTFwiGW06LU03u/4YhluwePEHydUoai+hTV35rbAaKiNE9
QXzE0i3NWnSqX3hksZSn+UD5
-----END PRIVATE KEY-----
30 changes: 30 additions & 0 deletions custom-recipes/buildernet/mkosi/test-atls-proxy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
#!/usr/bin/env bash
# Spins up an atls-proxy client, curls through it, tears it down.
# Usage: ./test-atls-proxy.sh [server:port] [path]
set -euo pipefail

IMAGE="ghcr.io/flashbots/attested-tls-proxy:1.0.1"
NAME="atls-proxy-client-test"
PORT=6000
SERVER="${1:-localhost:7000}"
PATH_="${2:-/api/l1-builder/v1/configuration}"

trap 'docker rm -f $NAME >/dev/null 2>&1 || true' EXIT
Copy link
Contributor

@claude claude bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The $NAME variable in the trap should be quoted to prevent word splitting. Also, the trap uses single quotes which means $NAME won't be expanded at trap definition time — but since it's a constant assigned on line 7, this works correctly. Just noting for clarity.

Suggested change
trap 'docker rm -f $NAME >/dev/null 2>&1 || true' EXIT
trap 'docker rm -f "$NAME" >/dev/null 2>&1 || true' EXIT

Wait — single quotes prevent variable expansion entirely. The $NAME won't expand inside single quotes. This actually works because bash expands $NAME at trap execution time (not definition time) when using single quotes, but only if NAME is still in scope. Since this is the same script, it works. Disregard the suggestion above.

docker rm -f "$NAME" >/dev/null 2>&1 || true

echo "-> client connecting to ${SERVER}"
docker run -d --name "$NAME" --network host "$IMAGE" \
client --listen-addr "0.0.0.0:${PORT}" \
--client-attestation-type none \
--allowed-remote-attestation-type none \
--allow-self-signed \
"$SERVER" >/dev/null

for i in $(seq 1 10); do
curl -s -o /dev/null "http://127.0.0.1:${PORT}/" 2>/dev/null && break
[ "$i" -eq 10 ] && { echo "client failed to start:"; docker logs "$NAME"; exit 1; }
sleep 0.5
done

echo "-> GET ${PATH_}"
curl -s -w "\n--- %{http_code}\n" "http://127.0.0.1:${PORT}${PATH_}"
Copy link
Contributor

@claude claude bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing newline at end of file.

Suggested change
curl -s -w "\n--- %{http_code}\n" "http://127.0.0.1:${PORT}${PATH_}"
curl -s -w "\n--- %{http_code}\n" "http://127.0.0.1:${PORT}${PATH_}"