cvm: Add periodic gateway refresh every 3 minutes

Cargo.toml

@@ -89,6 +89,7 @@ size-parser = { path = "size-parser" }
 
 # Core dependencies
 anyhow = { version = "1.0.97", default-features = false }
+errify = { version = "0.3.0", features = ["anyhow"] }
 or-panic = { version = "1.0", default-features = false }
 chrono = "0.4.40"
 clap = { version = "4.5.32", features = ["derive", "string"] }
@@ -124,6 +125,7 @@ serde = { version = "1.0.228", features = ["derive"], default-features = false }
 serde-human-bytes = "0.1.2"
 serde_json = { version = "1.0.140", default-features = false }
 serde_ini = "0.2.0"
+rmp-serde = "1.3.1"
 toml = "0.8.20"
 toml_edit = { version = "0.22.24", features = ["serde"] }
 yasna = "0.5.2"

basefiles/wg-checker.service

@@ -8,7 +8,7 @@ Type=simple
 ExecStart=/bin/wg-checker.sh
 Restart=always
 RestartSec=10
-StandardOutput=journal+console
+StandardOutput=journal
 StandardError=journal+console
 
 [Install]

basefiles/wg-checker.sh

@@ -5,6 +5,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 HANDSHAKE_TIMEOUT=180
+REFRESH_INTERVAL=180
 LAST_REFRESH=0
 STALE_SINCE=0
 DSTACK_WORK_DIR=${DSTACK_WORK_DIR:-/dstack}
@@ -14,61 +15,69 @@ get_latest_handshake() {
     wg show $IFNAME latest-handshakes 2>/dev/null | awk 'BEGIN { max = 0 } NF >= 2 { if ($2 > max) max = $2 } END { print max }'
 }
 
-maybe_refresh() {
+do_refresh() {
     now=$1
-
-    if [ "$LAST_REFRESH" -ne 0 ] && [ $((now - LAST_REFRESH)) -lt $HANDSHAKE_TIMEOUT ]; then
-        return
-    fi
+    reason=$2
+    force=$3
 
     if ! command -v dstack-util >/dev/null 2>&1; then
         printf 'dstack-util not found; cannot refresh gateway.\n' >&2
         LAST_REFRESH=$now
         return
     fi
 
-    printf 'WireGuard handshake stale; refreshing dstack gateway...\n'
-    if dstack-util gateway-refresh --work-dir "$DSTACK_WORK_DIR"; then
+    printf '%s; refreshing dstack gateway...\n' "$reason"
+    if [ "$force" = "1" ]; then
+        cmd="dstack-util gateway-refresh --work-dir $DSTACK_WORK_DIR --force"
+    else
+        cmd="dstack-util gateway-refresh --work-dir $DSTACK_WORK_DIR"
+    fi
+    if $cmd; then
         printf 'dstack gateway refresh succeeded.\n'
     else
         printf 'dstack gateway refresh failed.\n' >&2
     fi
 
     LAST_REFRESH=$now
-    STALE_SINCE=$now
+    STALE_SINCE=0
 }
 
-check_handshake() {
+check_and_refresh() {
     if ! command -v wg >/dev/null 2>&1; then
         return
     fi
 
     now=$(date +%s)
-    latest=$(get_latest_handshake)
 
+    # Periodic refresh every REFRESH_INTERVAL seconds (not forced)
+    if [ "$LAST_REFRESH" -eq 0 ] || [ $((now - LAST_REFRESH)) -ge $REFRESH_INTERVAL ]; then
+        do_refresh "$now" "Periodic refresh" 0
+        return
+    fi
+
+    # Check handshake staleness (forced refresh)
+    latest=$(get_latest_handshake)
     if [ -z "$latest" ]; then
         latest=0
     fi
 
     if [ "$latest" -gt 0 ]; then
         if [ $((now - latest)) -ge $HANDSHAKE_TIMEOUT ]; then
-            maybe_refresh "$now"
-        else
-            STALE_SINCE=0
+            do_refresh "$now" "WireGuard handshake stale" 1 >&2
         fi
     else
         if [ "$STALE_SINCE" -eq 0 ]; then
             STALE_SINCE=$now
         fi
         if [ $((now - STALE_SINCE)) -ge $HANDSHAKE_TIMEOUT ]; then
-            maybe_refresh "$now"
+            do_refresh "$now" "WireGuard handshake stale" 1 >&2
         fi
     fi
 }
 
 while true; do
     if [ -f /etc/wireguard/$IFNAME.conf ]; then
-        check_handshake
+        check_and_refresh
     else
         STALE_SINCE=0
     fi

dstack-attest/Cargo.toml

@@ -27,6 +27,7 @@ sha2.workspace = true
 sha3.workspace = true
 tdx-attest.workspace = true
 insta.workspace = true
+errify.workspace = true
 
 [features]
 quote = []

dstack-attest/src/attestation.rs

@@ -260,6 +260,13 @@ impl VersionedAttestation {
         }
     }
 
+    /// Get app info
+    pub fn decode_app_info(&self, boottime_mr: bool) -> Result<AppInfo> {
+        match self {
+            Self::V0 { attestation } => attestation.decode_app_info(boottime_mr),
+        }
+    }
+
     /// Strip data for certificate embedding (e.g. keep RTMR3 event logs only).
     pub fn into_stripped(mut self) -> Self {
         let VersionedAttestation::V0 { attestation } = &mut self;
@@ -444,6 +451,7 @@ impl<T: GetDeviceId> Attestation<T> {
         self.decode_app_info_ex(boottime_mr, "")
     }
 
+    #[errify::errify("decode app info")]
     pub fn decode_app_info_ex(&self, boottime_mr: bool, vm_config: &str) -> Result<AppInfo> {
         let key_provider_info = if boottime_mr {
             vec![]
@@ -739,7 +747,7 @@ pub fn validate_tcb(report: &TdxVerifiedReport) -> Result<()> {
 }
 
 /// Information about the app extracted from event log
-#[derive(Debug, Clone, Serialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AppInfo {
     /// App ID
     #[serde(with = "hex_bytes")]

dstack-util/Cargo.toml

@@ -55,6 +55,7 @@ scopeguard.workspace = true
 tempfile.workspace = true
 ez-hash.workspace = true
 cc-eventlog.workspace = true
+safe-write.workspace = true
 
 [dev-dependencies]
 rand.workspace = true