web-app.conf

# Example: pin a small web app at a specific upstream commit and run it
# under the launcher in default mode.
#
# The workload repo must contain a bash script at the fixed path
# './tee-launch.sh' (or at REPO_SUBDIR/tee-launch.sh if REPO_SUBDIR is set).
# The launcher checks out the pinned commit, then runs the script with
# 'bash tee-launch.sh' — no executable bit on the file is required.
# All install/build/run logic lives in that script, so its bytes are covered
# by source provenance of the pinned commit and no install/run command is
# trust-bearing in this config file.
#
# Replace COMMIT_SHA with the full SHA you want this launcher to bind to.
# The launcher refuses to start unless COMMIT_SHA is a full 40-hex SHA-1 or
# 64-hex SHA-256. Branches, tags, and short SHAs are rejected.
#
# A verifier checks:
#
#   image digest     -> launcher repo at commit L
#                       (via the Sigstore build-provenance attestation
#                        on the published image digest)
#   attested config  -> REPO_URL + COMMIT_SHA
#                       (via dstack compose-hash, or a derived image digest)
#   upstream repo    -> workload bytes at COMMIT_SHA, including tee-launch.sh
#
# Together these pin exactly which workload code runs inside the dstack TEE.

REPO_URL=https://github.com/example-org/example-web-app.git
COMMIT_SHA=0000000000000000000000000000000000000000
WORK_DIR=/var/lib/trusted-workload-launcher/example-web-app

# Optional: cd into a subdirectory of the upstream repo before exec'ing
# tee-launch.sh. Useful if the workload lives in a monorepo subpath.
# Absolute paths and paths containing '..' are rejected.
# REPO_SUBDIR=apps/web

# Optional: a second env file whose KEY=VALUE lines are exported into the
# environment of tee-launch.sh. Use this for runtime configuration (listen
# address, secrets, etc.) — keeping it separate from the pin config means
# config-only edits do not perturb the trust-bearing fields above.
# CHILD_ENV_FILE=/etc/trusted-workload-launcher/web-app.env

# Advanced mode (use only if the workload repo cannot host its own
# tee-launch.sh — e.g. you are pinning a third-party repo unchanged):
# RUN_CMD="node server.js"
# INSTALL_CMD="npm ci --omit=dev"   # optional; only valid with RUN_CMD