Skip to main content

Deploy the services

Launch the Confidential Space VMs. Wait for our confirmation of the registry grant first.

Apply

tofu -chdir=deploy/gcp/tf/backend init
tofu -chdir=deploy/gcp/tf/backend apply -var-file=../global.tfvars

This reads the outputs of both bootstrap modules and launches the VMs on the Confidential Space hardened OS. The services address one another by internal DNS name. With enable_policy_svc = false you get two: duo-server and auth-svc.

If you applied before the grant landed, the VMs are stopped. Start them once we confirm:

gcloud compute instances start PREFIX-duo-server PREFIX-auth-svc \
  --zone=VM_ZONE \
  --project=BACKEND_PROJECT_ID

With the policy engine enabled, add PREFIX-policy-svc to that list.

Monitoring

With debug_mode = true, each container writes its logs to both Cloud Logging and the serial console.

Cloud Logging

Logs land under the confidential-space-launcher log name:

gcloud logging read \
  'logName="projects/BACKEND_PROJECT_ID/logs/confidential-space-launcher"' \
  --project=BACKEND_PROJECT_ID \
  --limit=50 \
  --freshness=1h \
  --format='value(jsonPayload.MESSAGE)'

A healthy startup looks like this:

INFO sigpair_node: Creating SimpleStorage
INFO sigpair_node: Party VK <CLOUD_VERIFYING_KEY_HEX>
INFO sigpair_node: Using HTTPTransport for auth hooks
INFO auth_svc::config: Initialized 3 auth hooks
INFO sigpair_node: listening on 0.0.0.0:8080
[INFO] daphne.server: Listening on TCP address 0.0.0.0:9090

Party VK is the cloud node's public verifying key. For the value to enter in the mobile app, use the key printed by generate-secrets-backend.sh. See Generate secrets.

Serial console

debug_mode also enables serial-port access, which shows the OS boot and launcher output from before the container starts:

gcloud compute connect-to-serial-port PREFIX-duo-server \
  --zone=VM_ZONE \
  --project=BACKEND_PROJECT_ID

To leave the console, hit enter and type ~.

Use Cloud Logging for service output, and the serial console when a VM fails before the container starts.

Next

The backend is ready. Either test it with the mobile app, or first enable the policy engine.