dstack-examples/tor-hidden-service/docker-compose.yml at 14686aa4eaa5a54593e12ecd4adf46fefce3d49a · Dstack-TEE/dstack-examples · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
services:
  tor:
    build:
      context: .
      dockerfile_inline: |
        FROM debian:bullseye-slim@sha256:779034981fec838da124ff6ab9211499ba5d4e769dabdfd6c42c6ae2553b9a3b
        RUN apt-get update && apt-get install -y tor && apt-get clean && rm -rf /var/lib/apt/lists/*
        RUN mkdir -p /var/lib/tor/hidden_service && chown -R debian-tor:debian-tor /var/lib/tor/hidden_service/ && \
            chmod 700 /var/lib/tor/hidden_service/ && echo "HiddenServiceDir /var/lib/tor/hidden_service/" > /etc/tor/torrc && \
            echo "HiddenServicePort 80 nginx:80" >> /etc/tor/torrc
        USER debian-tor
        CMD tor -f /etc/tor/torrc
    volumes:
      - tor_data:/var/lib/tor/hidden_service
    restart: unless-stopped
    networks:
      - net

  nginx:
    depends_on: [tor]
    image: nginx:alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
    volumes:
      - /var/run/tappd.sock:/var/run/tappd.sock
      - tor_data:/tor_data:ro
    command: sh -c "apk add --no-cache curl && /start.sh"
    configs:
      - source: nginx_script
        target: /start.sh
        mode: 0755
    restart: unless-stopped
    networks:
      - net

networks:
  net:

volumes:
  tor_data:

configs:
  nginx_script:
    content: |
      #!/bin/sh
      echo '<html><body><h1>Dstack TEE Tor Onion Service</h1>' > /usr/share/nginx/html/index.html
      while [ ! -f /tor_data/hostname ]; do sleep 1; done
      addr=$$(cat /tor_data/hostname)
      echo "<p>$$addr</p>" >> /usr/share/nginx/html/index.html
      hash=$$(echo -n "$$addr" | sha256sum)
      payload="{\"report_data\":\"$$(echo -n $$hash | od -A n -t x1 | tr -d ' \n')\"}"
      attest=$$(curl -sX POST --unix-socket /var/run/tappd.sock -d "$$payload" http://localhost/prpc/Tappd.TdxQuote?json)
      echo "<pre style='white-space: pre-wrap;'>$$attest</pre></body></html>" >> /usr/share/nginx/html/index.html
      echo "Serving at $$addr"
      exec nginx -g 'daemon off;'