feat(kms): enhance onboard page with site name, chain info, and k256 pubkey

Leechael · Leechael · commit b67c92959e2d · 2026-03-18T21:46:28.000+08:00
Add configurable site_name, eth_rpc_url, and kms_contract_address to the
onboard config, displayed on the onboard page for operator visibility.
Return k256_pubkey in OnboardResponse so it can be compared with the
on-chain kmsInfo.k256Pubkey after onboarding.
diff --git a/kms/kms.toml b/kms/kms.toml
@@ -46,5 +46,8 @@ gateway_app_id = "any"
 enabled = true
 auto_bootstrap_domain = ""
 quote_enabled = true
+site_name = ""
+eth_rpc_url = ""
+kms_contract_address = ""
 address = "0.0.0.0"
 port = 8000
diff --git a/kms/rpc/proto/kms_rpc.proto b/kms/rpc/proto/kms_rpc.proto
@@ -131,6 +131,8 @@ message OnboardRequest {
 }
 
 message OnboardResponse {
+  // k256 public key (secp256k1) inherited from source KMS
+  bytes k256_pubkey = 1;
 }
 
 // Attestation info needed for on-chain KMS authorization.
@@ -143,6 +145,12 @@ message AttestationInfoResponse {
   bytes os_image_hash = 3;
   // Attestation mode (e.g. "dstack-tdx", "dstack-gcp-tdx")
   string attestation_mode = 4;
+  // Custom site name for display
+  string site_name = 5;
+  // Ethereum RPC URL from auth API
+  string eth_rpc_url = 6;
+  // KMS contract address from auth API
+  string kms_contract_address = 7;
 }
 
 // The Onboard RPC service.
diff --git a/kms/src/config.rs b/kms/src/config.rs
@@ -120,4 +120,10 @@ pub(crate) struct OnboardConfig {
     pub enabled: bool,
     pub quote_enabled: bool,
     pub auto_bootstrap_domain: String,
+    #[serde(default)]
+    pub site_name: String,
+    #[serde(default)]
+    pub eth_rpc_url: String,
+    #[serde(default)]
+    pub kms_contract_address: String,
 }
diff --git a/kms/src/onboard_service.rs b/kms/src/onboard_service.rs
@@ -92,9 +92,10 @@ impl OnboardRpc for OnboardHandler {
         )
         .await
         .context("Failed to onboard")?;
+        let k256_pubkey = keys.k256_key.verifying_key().to_sec1_bytes().to_vec();
         keys.store(&self.state.config)
             .context("Failed to store keys")?;
-        Ok(OnboardResponse {})
+        Ok(OnboardResponse { k256_pubkey })
     }
 
     async fn get_attestation_info(self) -> Result<AttestationInfoResponse> {
@@ -135,6 +136,9 @@ impl OnboardRpc for OnboardHandler {
             mr_aggregated: app_info.mr_aggregated.to_vec(),
             os_image_hash: app_info.os_image_hash,
             attestation_mode,
+            site_name: self.state.config.onboard.site_name.clone(),
+            eth_rpc_url: self.state.config.onboard.eth_rpc_url.clone(),
+            kms_contract_address: self.state.config.onboard.kms_contract_address.clone(),
         })
     }
 
diff --git a/kms/src/www/onboard.html b/kms/src/www/onboard.html
@@ -154,7 +154,7 @@
 
 <body>
     <div id="app" class="container">
-        <h1>dstack KMS Setup</h1>
+        <h1>{{ siteName || 'dstack KMS Setup' }}</h1>
 
         <div v-if="attestationLoading" class="loading">Loading attestation info...</div>
         <div v-else-if="attestationError" class="error">Attestation info: {{ attestationError }}</div>
@@ -176,6 +176,14 @@ <h3>Attestation Info (for on-chain registration)</h3>
                 <span class="info-label">OS Image Hash:</span>
                 <span class="info-value">0x{{ attestationInfo.os_image_hash }}</span>
             </div>
+            <div v-if="attestationInfo.eth_rpc_url" class="info-row">
+                <span class="info-label">ETH RPC URL:</span>
+                <span class="info-value">{{ attestationInfo.eth_rpc_url }}</span>
+            </div>
+            <div v-if="attestationInfo.kms_contract_address" class="info-row">
+                <span class="info-label">KMS Contract:</span>
+                <span class="info-value">{{ attestationInfo.kms_contract_address }}</span>
+            </div>
         </div>
 
         <div v-if="!setupFinished">
@@ -261,7 +269,8 @@ <h2>Onboard from an Existing KMS Instance</h2>
                     setupFinished: false,
                     attestationInfo: null,
                     attestationLoading: true,
-                    attestationError: ''
+                    attestationError: '',
+                    siteName: ''
                 }
             },
             async mounted() {
@@ -271,6 +280,9 @@ <h2>Onboard from an Existing KMS Instance</h2>
                         this.attestationError = data.error;
                     } else {
                         this.attestationInfo = data;
+                        if (data.site_name) {
+                            this.siteName = data.site_name;
+                        }
                     }
                 } catch (err) {
                     this.attestationError = err.message;
@@ -310,6 +322,9 @@ <h2>Onboard from an Existing KMS Instance</h2>
                         if (data.error) throw new Error(data.error);
 
                         this.success = 'Onboarding successful!';
+                        this.result = JSON.stringify({
+                            k256Pubkey: '0x' + data.k256_pubkey,
+                        }, null, 2);
                         this.error = '';
                     } catch (err) {
                         this.error = err.message;

Original file line number	Diff line number	Diff line change
`@@ -131,6 +131,8 @@ message OnboardRequest {`
`131`	`131`	`}`
`132`	`132`
`133`	`133`	`message OnboardResponse {`
	`134`	`+ // k256 public key (secp256k1) inherited from source KMS`
	`135`	`+ bytes k256_pubkey = 1;`
`134`	`136`	`}`
`135`	`137`
`136`	`138`	`// Attestation info needed for on-chain KMS authorization.`
`@@ -143,6 +145,12 @@ message AttestationInfoResponse {`
`143`	`145`	`bytes os_image_hash = 3;`
`144`	`146`	`// Attestation mode (e.g. "dstack-tdx", "dstack-gcp-tdx")`
`145`	`147`	`string attestation_mode = 4;`
	`148`	`+ // Custom site name for display`
	`149`	`+ string site_name = 5;`
	`150`	`+ // Ethereum RPC URL from auth API`
	`151`	`+ string eth_rpc_url = 6;`
	`152`	`+ // KMS contract address from auth API`
	`153`	`+ string kms_contract_address = 7;`
`146`	`154`	`}`
`147`	`155`
`148`	`156`	`// The Onboard RPC service.`
Original file line number	Diff line number	Diff line change
`@@ -92,9 +92,10 @@ impl OnboardRpc for OnboardHandler {`
`92`	`92`	`)`
`93`	`93`	`.await`
`94`	`94`	`.context("Failed to onboard")?;`
	`95`	`+ let k256_pubkey = keys.k256_key.verifying_key().to_sec1_bytes().to_vec();`
`95`	`96`	`keys.store(&self.state.config)`
`96`	`97`	`.context("Failed to store keys")?;`
`97`		`- Ok(OnboardResponse {})`
	`98`	`+ Ok(OnboardResponse { k256_pubkey })`
`98`	`99`	`}`
`99`	`100`
`100`	`101`	`async fn get_attestation_info(self) -> Result<AttestationInfoResponse> {`
`@@ -135,6 +136,9 @@ impl OnboardRpc for OnboardHandler {`
`135`	`136`	`mr_aggregated: app_info.mr_aggregated.to_vec(),`
`136`	`137`	`os_image_hash: app_info.os_image_hash,`
`137`	`138`	`attestation_mode,`
	`139`	`+ site_name: self.state.config.onboard.site_name.clone(),`
	`140`	`+ eth_rpc_url: self.state.config.onboard.eth_rpc_url.clone(),`
	`141`	`+ kms_contract_address: self.state.config.onboard.kms_contract_address.clone(),`
`138`	`142`	`})`
`139`	`143`	`}`
`140`	`144`