nginx.manifest.template

# Nginx manifest example

loader.entrypoint = "file:{{ gramine.libos }}"
# MARBLERUN: entrypoint must be premain-libos
libos.entrypoint = "premain-libos"

loader.log_level = "{{ log_level }}"

loader.env.LD_LIBRARY_PATH = "/lib:{{ arch_libdir }}:/usr/{{ arch_libdir }}"

# MARBLERUN: argv0 must be the path to the actual application
loader.argv = [ "{{ install_dir }}/sbin/nginx" ]

# Gramine by default reports the root user (uid = 0) to applications. This default behavior forces
# Nginx to attempt to drop privileges and assume some non-privileged user ID via setuid(), which is
# meaningless in Gramine. Instead, we set up a dummy user (uid = 1000); this is irrelevant for
# consequent Nginx execution anyway.
loader.uid = 1000
loader.gid = 1000

sys.enable_sigterm_injection = true

fs.mounts = [
  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
  { path = "/etc", uri = "file:/etc" },
  { path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
  { path = "/usr{{ arch_libdir }}", uri = "file:/usr{{ arch_libdir }}" },
  { path = "{{ install_dir_abspath }}", uri = "file:{{ install_dir }}" },
  { type = "encrypted", path = "/install/secrets/", uri = "file:secrets/" },
]

sgx.debug = true
sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}
# MARBLERUN: enclave must have enough memory for Go runtime of premain
sgx.enclave_size = "1024M"
# MARBLERUN: enclave must have enough threads for Go runtime of premain
sgx.max_threads = 16

sgx.trusted_files = [
  "file:{{ gramine.libos }}",
  "file:{{ install_dir }}/sbin/nginx",
  "file:{{ install_dir }}/conf/",
  "file:{{ install_dir }}/html/",
  "file:{{ gramine.runtimedir() }}/",
  "file:{{ arch_libdir }}/",
  "file:/usr/{{ arch_libdir }}/",
  "file:premain-libos",
]

sgx.allowed_files = [
  "file:{{ install_dir }}/logs",
  "file:/etc/hosts",
  "file:/etc/host.conf",
  "file:/etc/gai.conf",
  "file:/etc/resolv.conf",
  "file:/etc/localtime",
  "file:/etc/nsswitch.conf",
  "file:uuid",
]

# MARBLERUN: Forward EDG environment variables, used by MarbleRun
loader.env.EDG_MARBLE_TYPE = { passthrough = true }
loader.env.EDG_MARBLE_COORDINATOR_ADDR = { passthrough = true }
loader.env.EDG_MARBLE_UUID_FILE = { passthrough = true }
loader.env.EDG_MARBLE_DNS_NAMES = { passthrough = true }

# MARBLERUN: enable DCAP
sgx.remote_attestation = "dcap"