feat(dstackup): generate and enable a VMM API token on install

Author: kvinwang

dstack/crates/dstack-cli-core/src/config.rs

@@ -9,7 +9,8 @@
 //!   false` + a set `auto_bootstrap_domain`, the combination validated to make
 //!   bootstrap hands-off).
 //! * `auth-allowlist.json` — read by the host-side Rust auth webhook.
-//! * `vmm.toml` — the host VMM config (gateway + auth-token gating off).
+//! * `vmm.toml` — the host VMM config (gateway off; management-API auth token
+//!   set by `dstackup install`).
 
 use crate::host::Platform;
 use anyhow::{Context, Result};
@@ -278,6 +279,11 @@ pub struct VmmRender {
     pub kms_urls: Vec<String>,
     /// confidential-computing platform (selects qemu/share-mode for the CVMs).
     pub platform: Platform,
+    /// gate the management API behind a bearer/Basic token (`[auth] enabled`).
+    pub auth_enabled: bool,
+    /// the token accepted by the management API when `auth_enabled` is set.
+    /// Empty renders `tokens = []`.
+    pub auth_token: String,
 }
 
 impl Default for VmmRender {
@@ -296,13 +302,16 @@ impl Default for VmmRender {
             key_provider_port: 3443,
             kms_urls: Vec::new(),
             platform: Platform::Tdx,
+            auth_enabled: false,
+            auth_token: String::new(),
         }
     }
 }
 
-/// render the host `vmm.toml`. Gateway and auth-token gating are off
-/// (single-node direct-port access); CVMs use user-mode networking with host
-/// port mapping.
+/// render the host `vmm.toml`. Gateway is off (single-node direct-port
+/// access); management-API auth is gated by `r.auth_enabled`/`r.auth_token`
+/// (`dstackup install` generates a token and enables it). CVMs use user-mode
+/// networking with host port mapping.
 pub fn vmm_toml(r: &VmmRender) -> String {
     format!(
         r#"# generated by `dstackup install`
@@ -376,9 +385,12 @@ base_domain = "localhost"
 port = 8082
 agent_port = 8090
 
+# management API auth. `dstackup install` generates a token and enables this
+# so the VMM control surface (create/stop VM, UI, pRPC) is not exposed
+# unauthenticated. Clients send `Authorization: Bearer <token>`.
 [auth]
-enabled = false
-tokens = []
+enabled = {auth_enabled}
+tokens = [{auth_tokens}]
 
 [supervisor]
 exe = "{supervisor_exe}"
@@ -423,6 +435,12 @@ port = {kp_port}
         host_api_port = r.host_api_port,
         kp_addr = r.key_provider_addr,
         kp_port = r.key_provider_port,
+        auth_enabled = r.auth_enabled,
+        auth_tokens = if r.auth_token.is_empty() {
+            String::new()
+        } else {
+            format!("\"{}\"", r.auth_token)
+        },
     )
 }
 
@@ -436,15 +454,28 @@ mod tests {
             dashboard_addr: "tcp:127.0.0.1:19080".into(),
             cid_start: 2000,
             host_api_port: 10001,
+            auth_enabled: true,
+            auth_token: "deadbeef".into(),
             ..Default::default()
         };
         let rendered = vmm_toml(&r);
         assert!(rendered.contains(r#"address = "tcp:127.0.0.1:19080""#));
         assert!(rendered.contains("cid_start = 2000"));
         assert!(rendered.contains("port = 10001"));
+        assert!(rendered.contains("enabled = true"));
+        assert!(rendered.contains(r#"tokens = ["deadbeef"]"#));
         toml::from_str::<toml::Value>(&rendered).expect("vmm.toml must be valid TOML");
     }
 
+    #[test]
+    fn vmm_toml_auth_disabled_renders_empty_tokens() {
+        let rendered = vmm_toml(&VmmRender::default());
+        // default (no token) must still be valid TOML with an empty token list.
+        assert!(rendered.contains("tokens = []"));
+        let v: toml::Value = toml::from_str(&rendered).expect("vmm.toml must be valid TOML");
+        assert_eq!(v["auth"]["enabled"].as_bool(), Some(false));
+    }
+
     #[test]
     fn kms_toml_has_single_node_invariants() {
         let cfg = HostConfig {

dstack/crates/dstackup/src/destroy.rs

@@ -4,6 +4,7 @@
 
 //! `dstackup destroy` — tear down what `install` started.
 
+use crate::install::read_token_file;
 use crate::state::{read_state, state_path};
 use crate::systemd::{remove_unit, systemctl, tool};
 use anyhow::{Context, Result};
@@ -26,7 +27,8 @@ pub(crate) async fn cmd_destroy(prefix: Option<&str>, purge: bool) -> Result<()>
             // and the CVM qemu via the unit's cgroup. Look it up by recorded id
             // AND by name, so an install that died before persisting kms_vm_id
             // (or a torn state file) doesn't leave the CVM orphaned.
-            if let Ok(vmm) = Vmm::connect(&st.client_url) {
+            let token = read_token_file(Path::new(&st.client_token_path));
+            if let Ok(vmm) = Vmm::connect_with_token(&st.client_url, token.as_deref()) {
                 let mut target = st.kms_vm_id.clone();
                 if target.is_none() {
                     if let Ok(s) = vmm.status().await {

dstack/crates/dstackup/src/install.rs

@@ -29,16 +29,16 @@ const DAEMON_BINARIES: &[(&str, &str)] = &[
 ];
 
 pub(crate) async fn cmd_install(mut o: InstallOpts) -> Result<()> {
-    // --expose is not safe yet: the rendered vmm.toml binds the VM-control
-    // plane with neither TLS nor an auth token (the management RPCs are not
-    // behind an auth guard), so exposing it would hand deploy/destroy to anyone
-    // who can reach the IP. Refuse until the TLS+token transport lands; the
-    // supported path is localhost + an SSH tunnel.
+    // --expose is not safe yet: the rendered vmm.toml now gates the management
+    // API behind a generated token, but the transport is still plain HTTP, so
+    // exposing it would send that bearer token in cleartext to anyone on-path.
+    // Refuse until the TLS transport lands; the supported path is localhost + an
+    // SSH tunnel.
     if let Some(ip) = &o.expose {
         bail!(
             "--expose {ip} is not yet safe: it would bind the VM-control plane on \
-             {ip}:{port} with no TLS and no auth. reach the dashboard over an SSH \
-             tunnel instead: ssh -L {port}:127.0.0.1:{port} <host>",
+             {ip}:{port} over plain HTTP, leaking the API token in cleartext. reach \
+             the dashboard over an SSH tunnel instead: ssh -L {port}:127.0.0.1:{port} <host>",
             port = o.dashboard_port
         );
     }
@@ -81,10 +81,24 @@ pub(crate) async fn cmd_install(mut o: InstallOpts) -> Result<()> {
     let client_url = format!("http://{bind}:{}", o.dashboard_port);
     let kms_port = resolve_kms_port(&o, &st)?;
 
+    // management-API token: reuse the one a prior install wrote (so re-runs and
+    // an already-running VMM keep matching credentials), else mint a fresh one
+    // below once the config dir exists. The existing token authenticates the
+    // preflight probe against an already-running, auth-enabled VMM.
+    let token_path = layout.config_dir.join("vmm-auth-token");
+    let existing_token = read_token_file(&token_path);
+
     // 4. preflight - fail BEFORE any side effect (image download, key provider,
     //    dirs, units), so a CID/port clash can't half-install the host.
     let cid_start = pick_cid_start(o.cid_start, &host::occupied_cid_ranges())?;
-    let kms_owned = kms_port_owned(&st, &client_url, kms_port, o.no_kms).await;
+    let kms_owned = kms_port_owned(
+        &st,
+        &client_url,
+        existing_token.as_deref(),
+        kms_port,
+        o.no_kms,
+    )
+    .await;
     let port_plan = tcp_port_plan(&o, &st, platform, &bind, &client_url, kms_port, kms_owned);
     preflight_ports(&port_plan)?;
 
@@ -117,6 +131,15 @@ pub(crate) async fn cmd_install(mut o: InstallOpts) -> Result<()> {
         fs::create_dir_all(&dir).with_context(|| format!("creating {}", dir.display()))?;
     }
 
+    // ensure a management-API token exists on disk (0600) before rendering the
+    // config that references it. The local `dstack` CLI reads this path from the
+    // install state, so it authenticates automatically.
+    let vmm_token = match existing_token {
+        Some(t) => t,
+        None => generate_vmm_token()?,
+    };
+    write_token_file(&token_path, &vmm_token)?;
+
     // 8. resolve the key provider - run our own unless told to use an existing
     //    one (TDX only; SNP has no SGX local provider).
     let (kp_addr, kp_port, kp_own_project) =
@@ -144,6 +167,8 @@ pub(crate) async fn cmd_install(mut o: InstallOpts) -> Result<()> {
         key_provider_port: kp_port as u32,
         kms_urls: kms_urls.clone(),
         platform,
+        auth_enabled: true,
+        auth_token: vmm_token.clone(),
         ..Default::default()
     });
     // the KMS-in-CVM reaches the host auth webhook at 10.0.2.2:<auth_port>.
@@ -191,6 +216,7 @@ pub(crate) async fn cmd_install(mut o: InstallOpts) -> Result<()> {
     st.run_dir = layout.run_dir.display().to_string();
     st.allowlist_path = allow_path.display().to_string();
     st.client_url = client_url.clone();
+    st.client_token_path = token_path.display().to_string();
     st.auth_port = o.auth_port;
     st.platform = platform.vmm_str().to_string();
     st.image = o.image.clone();
@@ -215,7 +241,7 @@ pub(crate) async fn cmd_install(mut o: InstallOpts) -> Result<()> {
     st.auth_unit = auth_unit.clone();
 
     // 11. VMM systemd unit (idempotent).
-    if vmm_reachable(&client_url).await {
+    if vmm_reachable(&client_url, Some(&vmm_token)).await {
         println!("  [ok] VMM already serving at {client_url}");
     } else {
         install_unit(
@@ -225,7 +251,7 @@ pub(crate) async fn cmd_install(mut o: InstallOpts) -> Result<()> {
         .context("installing the VMM unit")?;
         println!("  [ok] started {vmm_unit}.service");
         print!("  [..] waiting for VMM at {client_url} ");
-        if wait_ready(&client_url, Duration::from_secs(25)).await {
+        if wait_ready(&client_url, Some(&vmm_token), Duration::from_secs(25)).await {
             println!("=> ready");
         } else {
             println!("=> not ready within timeout (journalctl -u {vmm_unit})");
@@ -241,7 +267,7 @@ pub(crate) async fn cmd_install(mut o: InstallOpts) -> Result<()> {
     if o.no_kms {
         println!("  (--no-kms: skipping KMS deploy)");
     } else {
-        let vmm = Vmm::connect(&client_url)?;
+        let vmm = Vmm::connect_with_token(&client_url, Some(&vmm_token))?;
         let existing = match &st.kms_vm_id {
             Some(id) if vmm.has_vm(id).await => Some(id.clone()),
             _ => None,
@@ -1007,7 +1033,13 @@ fn tcp_port_plan(
     ports
 }
 
-async fn kms_port_owned(st: &State, client_url: &str, kms_port: u16, no_kms: bool) -> bool {
+async fn kms_port_owned(
+    st: &State,
+    client_url: &str,
+    token: Option<&str>,
+    kms_port: u16,
+    no_kms: bool,
+) -> bool {
     if no_kms
         || st.client_url != client_url
         || state_kms_port(st) != Some(kms_port)
@@ -1019,7 +1051,7 @@ async fn kms_port_owned(st: &State, client_url: &str, kms_port: u16, no_kms: boo
     let Some(kms_vm_id) = &st.kms_vm_id else {
         return false;
     };
-    match Vmm::connect(client_url) {
+    match Vmm::connect_with_token(client_url, token) {
         Ok(vmm) => vmm.has_vm(kms_vm_id).await,
         Err(_) => false,
     }
@@ -1158,18 +1190,18 @@ fn kms_vm_boot_state(
 }
 
 /// one-shot liveness probe of the VMM.
-async fn vmm_reachable(client_url: &str) -> bool {
-    match Vmm::connect(client_url) {
+async fn vmm_reachable(client_url: &str, token: Option<&str>) -> bool {
+    match Vmm::connect_with_token(client_url, token) {
         Ok(vmm) => vmm.status().await.is_ok(),
         Err(_) => false,
     }
 }
 
 /// poll the VMM `Status` RPC until it succeeds or the deadline passes.
-async fn wait_ready(client_url: &str, timeout: Duration) -> bool {
+async fn wait_ready(client_url: &str, token: Option<&str>, timeout: Duration) -> bool {
     let deadline = tokio::time::Instant::now() + timeout;
     loop {
-        if let Ok(vmm) = Vmm::connect(client_url) {
+        if let Ok(vmm) = Vmm::connect_with_token(client_url, token) {
             if vmm.status().await.is_ok() {
                 return true;
             }
@@ -1181,6 +1213,33 @@ async fn wait_ready(client_url: &str, timeout: Duration) -> bool {
     }
 }
 
+/// mint a 256-bit management-API token, hex-encoded, from the OS RNG.
+fn generate_vmm_token() -> Result<String> {
+    let mut buf = [0u8; 32];
+    let mut f = fs::File::open("/dev/urandom").context("opening /dev/urandom")?;
+    std::io::Read::read_exact(&mut f, &mut buf).context("reading /dev/urandom")?;
+    Ok(hex::encode(buf))
+}
+
+/// read a previously written management-API token, if the file exists and is
+/// non-empty.
+pub(crate) fn read_token_file(path: &Path) -> Option<String> {
+    let token = fs::read_to_string(path).ok()?;
+    let token = token.trim();
+    (!token.is_empty()).then(|| token.to_string())
+}
+
+/// write the management-API token atomically with owner-only (0600)
+/// permissions — it is a bearer credential.
+fn write_token_file(path: &Path, token: &str) -> Result<()> {
+    use std::os::unix::fs::PermissionsExt;
+    dstack_cli_core::fsutil::write_atomic(path, token)
+        .with_context(|| format!("writing {}", path.display()))?;
+    fs::set_permissions(path, fs::Permissions::from_mode(0o600))
+        .with_context(|| format!("setting 0600 on {}", path.display()))?;
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

dstack/crates/dstackup/src/state.rs

@@ -30,6 +30,10 @@ pub(crate) struct State {
     #[serde(default)]
     pub(crate) platform: String,
     pub(crate) client_url: String,
+    /// path to the management-API bearer token file the local `dstack` CLI
+    /// reads to authenticate against the VMM.
+    #[serde(default)]
+    pub(crate) client_token_path: String,
     pub(crate) auth_port: u16,
     /// systemd unit names (without the `.service` suffix).
     #[serde(default)]