Skip to content

Commit 9a25b98

Browse files
h4x3rotabh4x3rotab
authored
Merge pull request #119 from Dstack-TEE/fix/dstack-ingress-x25519mlkem768
feat(ingress): enable X25519MLKEM768 TLS
2 parents 7b29492 + 8e4e731 commit 9a25b98

5 files changed

Lines changed: 208 additions & 154 deletions

File tree

‎custom-domain/dstack-ingress/Dockerfile‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM haproxy@sha256:49a0a0d6f0b8b7e59c233b06eefab1564f2c8d64f673554d368fd7d2ab4b2c2d
1+
FROM haproxy@sha256:f8095d0b91414340dbcd53bbe89585e17f333ec1f2a0f60456cb53a90486ece2
22

33
# haproxy image runs as non-root (uid 99) by default; we need root for
44
# certbot, DNS management, and writing to /etc/haproxy/certs.
@@ -7,8 +7,8 @@ USER root
77
RUN --mount=type=bind,source=pinned-packages.txt,target=/tmp/pinned-packages.txt,ro \
88
set -e; \
99
# Create a sources.list file pointing to a specific snapshot
10-
echo 'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian/20250411T024939Z bookworm main' > /etc/apt/sources.list && \
11-
echo 'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian-security/20250411T024939Z bookworm-security main' >> /etc/apt/sources.list && \
10+
echo 'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian/20260824T000000Z trixie main' > /etc/apt/sources.list && \
11+
echo 'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian-security/20260824T000000Z trixie-security main' >> /etc/apt/sources.list && \
1212
echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/10no-check-valid-until && \
1313
# Create preferences file to pin all packages
1414
rm -rf /etc/apt/sources.list.d/debian.sources && \
@@ -26,8 +26,8 @@ RUN --mount=type=bind,source=pinned-packages.txt,target=/tmp/pinned-packages.txt
2626
bash \
2727
python3-pip \
2828
python3-requests \
29-
python3.11 \
30-
python3.11-venv \
29+
python3 \
30+
python3-venv \
3131
curl \
3232
jq \
3333
coreutils \

‎custom-domain/dstack-ingress/pinned-packages.txt‎

Lines changed: 136 additions & 144 deletions
Original file line numberDiff line numberDiff line change
@@ -1,144 +1,136 @@
1-
adduser=3.134
2-
apt=2.6.1
3-
base-files=12.4+deb12u11
4-
base-passwd=3.6.1
5-
bash=5.2.15-2+b8
6-
bsdutils=1:2.38.1-5+deb12u3
7-
ca-certificates=20230311+deb12u1
8-
coreutils=9.1-1
9-
curl=7.88.1-10+deb12u12
10-
dash=0.5.12-2
11-
debconf=1.5.82
12-
debian-archive-keyring=2023.3+deb12u2
13-
debianutils=5.7-0.5~deb12u1
14-
diffutils=1:3.8-4
15-
dpkg=1.21.22
16-
e2fsprogs=1.47.0-2
17-
findutils=4.9.0-4
18-
gcc-12-base:amd64=12.2.0-14+deb12u1
19-
gpgv=2.2.40-1.1
20-
grep=3.8-5
21-
gzip=1.12-1
22-
hostname=3.23+nmu1
23-
init-system-helpers=1.65.2
24-
jq=1.6-2.1
25-
libacl1:amd64=2.3.1-3
26-
libapt-pkg6.0:amd64=2.6.1
27-
libattr1:amd64=1:2.5.1-4
28-
libaudit-common=1:3.0.9-1
29-
libaudit1:amd64=1:3.0.9-1
30-
libblkid1:amd64=2.38.1-5+deb12u3
31-
libbrotli1:amd64=1.0.9-2+b6
32-
libbz2-1.0:amd64=1.0.8-5+b1
33-
libc-bin=2.36-9+deb12u10
34-
libc6:amd64=2.36-9+deb12u10
35-
libcap-ng0:amd64=0.8.3-1+b3
36-
libcap2:amd64=1:2.66-4+deb12u1
37-
libcom-err2:amd64=1.47.0-2
38-
libcrypt1:amd64=1:4.4.33-2
39-
libcurl4:amd64=7.88.1-10+deb12u12
40-
libdb5.3:amd64=5.3.28+dfsg2-1
41-
libdebconfclient0:amd64=0.270
42-
libexpat1:amd64=2.5.0-1+deb12u1
43-
libext2fs2:amd64=1.47.0-2
44-
libffi8:amd64=3.4.4-1
45-
libgcc-s1:amd64=12.2.0-14+deb12u1
46-
libgcrypt20:amd64=1.10.1-3
47-
libgmp10:amd64=2:6.2.1+dfsg1-1.1
48-
libgnutls30:amd64=3.7.9-2+deb12u5
49-
libgpg-error0:amd64=1.46-1
50-
libgssapi-krb5-2:amd64=1.20.1-2+deb12u2
51-
libhogweed6:amd64=3.8.1-2
52-
libidn2-0:amd64=2.3.3-1+b1
53-
libjq1:amd64=1.6-2.1
54-
libk5crypto3:amd64=1.20.1-2+deb12u2
55-
libkeyutils1:amd64=1.6.3-2
56-
libkrb5-3:amd64=1.20.1-2+deb12u2
57-
libkrb5support0:amd64=1.20.1-2+deb12u2
58-
libldap-2.5-0:amd64=2.5.13+dfsg-5
59-
liblua5.4-0:amd64=5.4.4-3+deb12u1
60-
liblz4-1:amd64=1.9.4-1
61-
liblzma5:amd64=5.4.1-1
62-
libmd0:amd64=1.0.4-2
63-
libmount1:amd64=2.38.1-5+deb12u3
64-
libncursesw6:amd64=6.4-4
65-
libnettle8:amd64=3.8.1-2
66-
libnghttp2-14:amd64=1.52.0-1+deb12u2
67-
libnsl2:amd64=1.3.0-2
68-
libonig5:amd64=6.9.8-1
69-
libp11-kit0:amd64=0.24.1-2
70-
libpam-modules-bin=1.5.2-6+deb12u1
71-
libpam-modules:amd64=1.5.2-6+deb12u1
72-
libpam-runtime=1.5.2-6+deb12u1
73-
libpam0g:amd64=1.5.2-6+deb12u1
74-
libpcre2-8-0:amd64=10.42-1
75-
libpsl5:amd64=0.21.2-1
76-
libpython3-stdlib:amd64=3.11.2-1+b1
77-
libpython3.11-minimal:amd64=3.11.2-6+deb12u5
78-
libpython3.11-stdlib:amd64=3.11.2-6+deb12u5
79-
libreadline8:amd64=8.2-1.3
80-
librtmp1:amd64=2.4+20151223.gitfa8646d.1-2+b2
81-
libsasl2-2:amd64=2.1.28+dfsg-10
82-
libsasl2-modules-db:amd64=2.1.28+dfsg-10
83-
libseccomp2:amd64=2.5.4-1+deb12u1
84-
libselinux1:amd64=3.4-1+b6
85-
libsemanage-common=3.4-1
86-
libsemanage2:amd64=3.4-1+b5
87-
libsepol2:amd64=3.4-2.1
88-
libsmartcols1:amd64=2.38.1-5+deb12u3
89-
libsqlite3-0:amd64=3.40.1-2+deb12u1
90-
libss2:amd64=1.47.0-2
91-
libssh2-1:amd64=1.10.0-3+b1
92-
libssl3:amd64=3.0.17-1~deb12u2
93-
libstdc++6:amd64=12.2.0-14+deb12u1
94-
libsystemd0:amd64=252.38-1~deb12u1
95-
libtasn1-6:amd64=4.19.0-2+deb12u1
96-
libtinfo6:amd64=6.4-4
97-
libtirpc-common=1.3.3+ds-1
98-
libtirpc3:amd64=1.3.3+ds-1
99-
libudev1:amd64=252.38-1~deb12u1
100-
libunistring2:amd64=1.0-2
101-
libuuid1:amd64=2.38.1-5+deb12u3
102-
libxxhash0:amd64=0.8.1-1
103-
libzstd1:amd64=1.5.4+dfsg2-5
104-
login=1:4.13+dfsg1-1+deb12u1
105-
logsave=1.47.0-2
106-
mawk=1.3.4.20200120-3.1
107-
lsb-base=11.6
108-
media-types=10.0.0
109-
mini-httpd=1.30-3
110-
mount=2.38.1-5+deb12u3
111-
ncurses-base=6.4-4
112-
ncurses-bin=6.4-4
113-
openssl=3.0.17-1~deb12u2
114-
passwd=1:4.13+dfsg1-1+deb12u1
115-
perl-base=5.36.0-7+deb12u2
116-
python3-certifi=2022.9.24-1
117-
python3-chardet=5.1.0+dfsg-2
118-
python3-charset-normalizer=3.0.1-2
119-
python3-distutils=3.11.2-3
120-
python3-idna=3.3-1+deb12u1
121-
python3-lib2to3=3.11.2-3
122-
python3-minimal=3.11.2-1+b1
123-
python3-pip-whl=23.0.1+dfsg-1
124-
python3-pip=23.0.1+dfsg-1
125-
python3-pkg-resources=66.1.1-1+deb12u1
126-
python3-requests=2.28.1+dfsg-1
127-
python3-setuptools-whl=66.1.1-1+deb12u1
128-
python3-setuptools=66.1.1-1+deb12u1
129-
python3-six=1.16.0-4
130-
python3-urllib3=1.26.12-1+deb12u1
131-
python3-wheel=0.38.4-2
132-
python3.11-minimal=3.11.2-6+deb12u5
133-
python3.11-venv=3.11.2-6+deb12u5
134-
python3.11=3.11.2-6+deb12u5
135-
python3=3.11.2-1+b1
136-
readline-common=8.2-1.3
137-
sed=4.9-1
138-
sysvinit-utils=3.06-4
139-
tar=1.34+dfsg-1.2+deb12u1
140-
tzdata=2025b-0+deb12u1
141-
usr-is-merged=37~deb12u1
142-
util-linux-extra=2.38.1-5+deb12u3
143-
util-linux=2.38.1-5+deb12u3
144-
zlib1g:amd64=1:1.2.13.dfsg-1
1+
apt=3.0.3
2+
base-files=13.8+deb13u6
3+
base-passwd=3.6.7
4+
bash=5.2.37-2+b9
5+
bsdutils=1:2.41.5-0+deb13u1
6+
ca-certificates=20250419
7+
coreutils=9.7-3
8+
curl=8.14.1-2+deb13u4
9+
dash=0.5.12-12
10+
debconf=1.5.91
11+
debian-archive-keyring=2025.1
12+
debianutils=5.23.2
13+
diffutils=1:3.10-4
14+
dpkg=1.22.22
15+
findutils=4.10.0-3
16+
gcc-14-base:amd64=14.2.0-19
17+
grep=3.11-4
18+
gzip=1.13-1
19+
hostname=3.25
20+
init-system-helpers=1.69~deb13u1
21+
jq=1.7.1-6+deb13u3
22+
libacl1:amd64=2.3.2-2+b1
23+
libapt-pkg7.0:amd64=3.0.3
24+
libattr1:amd64=1:2.5.2-3
25+
libaudit-common=1:4.0.2-2
26+
libaudit1:amd64=1:4.0.2-2+b2
27+
libblkid1:amd64=2.41.5-0+deb13u1
28+
libbrotli1:amd64=1.1.0-2+b7
29+
libbsd0:amd64=0.12.2-2
30+
libbz2-1.0:amd64=1.0.8-6
31+
libc-bin=2.41-12+deb13u3
32+
libc6:amd64=2.41-12+deb13u3
33+
libcap-ng0:amd64=0.8.5-4+b1
34+
libcap2:amd64=1:2.75-10+deb13u1+b1
35+
libcom-err2:amd64=1.47.2-3+b11
36+
libcrypt1:amd64=1:4.4.38-1
37+
libcurl4t64:amd64=8.14.1-2+deb13u4
38+
libdb5.3t64:amd64=5.3.28+dfsg2-9
39+
libdebconfclient0:amd64=0.280
40+
libexpat1:amd64=2.8.3-1~deb13u1
41+
libffi8:amd64=3.4.8-2
42+
libgcc-s1:amd64=14.2.0-19
43+
libgmp10:amd64=2:6.3.0+dfsg-3
44+
libgnutls30t64:amd64=3.8.9-3+deb13u4
45+
libgssapi-krb5-2:amd64=1.21.3-5+deb13u1
46+
libhogweed6t64:amd64=3.10.1-1
47+
libidn2-0:amd64=2.3.8-2
48+
libjq1:amd64=1.7.1-6+deb13u3
49+
libk5crypto3:amd64=1.21.3-5+deb13u1
50+
libkeyutils1:amd64=1.6.3-6
51+
libkrb5-3:amd64=1.21.3-5+deb13u1
52+
libkrb5support0:amd64=1.21.3-5+deb13u1
53+
liblastlog2-2:amd64=2.41.5-0+deb13u1
54+
libldap2:amd64=2.6.10+dfsg-1
55+
liblua5.4-0:amd64=5.4.7-1+b2
56+
liblz4-1:amd64=1.10.0-4
57+
liblzma5:amd64=5.8.1-1+deb13u1
58+
libmd0:amd64=1.1.0-2+b1
59+
libmount1:amd64=2.41.5-0+deb13u1
60+
libncursesw6:amd64=6.5+20250216-2
61+
libnettle8t64:amd64=3.10.1-1
62+
libnghttp2-14:amd64=1.64.0-1.1+deb13u1
63+
libnghttp3-9:amd64=1.8.0-1
64+
libonig5:amd64=6.9.9-1+b1
65+
libp11-kit0:amd64=0.25.5-3
66+
libpam-modules-bin=1.7.0-5
67+
libpam-modules:amd64=1.7.0-5
68+
libpam-runtime=1.7.0-5
69+
libpam0g:amd64=1.7.0-5
70+
libpcre2-8-0:amd64=10.46-1~deb13u1
71+
libpsl5t64:amd64=0.21.2-1.1+b1
72+
libpython3-stdlib:amd64=3.13.5-1
73+
libpython3.13-minimal:amd64=3.13.5-2+deb13u3
74+
libpython3.13-stdlib:amd64=3.13.5-2+deb13u3
75+
libreadline8t64:amd64=8.2-6
76+
librtmp1:amd64=2.4+20151223.gitfa8646d.1-2+b5
77+
libsasl2-2:amd64=2.1.28+dfsg1-9
78+
libsasl2-modules-db:amd64=2.1.28+dfsg1-9
79+
libseccomp2:amd64=2.6.0-2
80+
libselinux1:amd64=3.8.1-1
81+
libsemanage-common=3.8.1-1
82+
libsemanage2:amd64=3.8.1-1
83+
libsepol2:amd64=3.8.1-1
84+
libsmartcols1:amd64=2.41.5-0+deb13u1
85+
libsqlite3-0:amd64=3.46.1-7+deb13u1
86+
libssh2-1t64:amd64=1.11.1-1+deb13u1
87+
libssl3t64:amd64=3.5.7-1~deb13u2
88+
libstdc++6:amd64=14.2.0-19
89+
libsystemd0:amd64=257.13-1~deb13u1
90+
libtasn1-6:amd64=4.20.0-2+deb13u1
91+
libtinfo6:amd64=6.5+20250216-2
92+
libudev1:amd64=257.13-1~deb13u1
93+
libunistring5:amd64=1.3-2
94+
libuuid1:amd64=2.41.5-0+deb13u1
95+
libwrap0:amd64=7.6.q-36
96+
libxxhash0:amd64=0.8.3-2
97+
libzstd1:amd64=1.5.7+dfsg-1
98+
login.defs=1:4.17.4-2
99+
login=1:4.16.0-2+really2.41.5-0+deb13u1
100+
mawk=1.3.4.20250131-1
101+
media-types=13.0.0
102+
mini-httpd=1.30-13
103+
mount=2.41.5-0+deb13u1
104+
ncurses-base=6.5+20250216-2
105+
ncurses-bin=6.5+20250216-2
106+
netbase=6.5
107+
openssl-provider-legacy=3.5.7-1~deb13u2
108+
openssl=3.5.7-1~deb13u2
109+
passwd=1:4.17.4-2
110+
perl-base=5.40.1-6
111+
python3-certifi=2025.1.31+ds-1
112+
python3-chardet=5.2.0+dfsg-2
113+
python3-charset-normalizer=3.4.2-1
114+
python3-idna=3.10-1+deb13u1
115+
python3-minimal=3.13.5-1
116+
python3-packaging=25.0-1
117+
python3-pip-whl=25.1.1+dfsg-1
118+
python3-pip=25.1.1+dfsg-1
119+
python3-requests=2.32.3+dfsg-5+deb13u1
120+
python3-setuptools-whl=78.1.1-0.1
121+
python3-urllib3=2.3.0-3+deb13u2
122+
python3-venv=3.13.5-1
123+
python3-wheel=0.46.1-2
124+
python3.13-minimal=3.13.5-2+deb13u3
125+
python3.13-venv=3.13.5-2+deb13u3
126+
python3.13=3.13.5-2+deb13u3
127+
python3=3.13.5-1
128+
readline-common=8.2-6
129+
sed=4.9-2+deb13u1
130+
socat=1.8.0.3-1
131+
sqv=1.3.0-3+b2
132+
sysvinit-utils=3.14-4
133+
tar=1.35+dfsg-3.1
134+
tzdata=2026b-0+deb13u1
135+
util-linux=2.41.5-0+deb13u1
136+
zlib1g:amd64=1:1.3.dfsg+really1.3.1-1+b1

‎custom-domain/dstack-ingress/requirements.txt‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,12 @@ certifi==2026.7.22 \
2525
--hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775
2626
cffi==2.1.1 \
2727
--hash=sha256:c1453022f490d2459a11819d83ad1d586e9ff65a12ac3e705ffebd46d3685dcf \
28-
--hash=sha256:34e261f78cb6ceaaa36f42f2613f4380d94d9c759a9c73c769ee6e0247364632
28+
--hash=sha256:34e261f78cb6ceaaa36f42f2613f4380d94d9c759a9c73c769ee6e0247364632 \
29+
--hash=sha256:a931079504ecc49efed7744c476a5c343a92fabf66dec2db95edb1b2fdc770e2
2930
charset-normalizer==3.5.1 \
3031
--hash=sha256:b9af956078716df40d985fb0dfeb2c2120c5ca92ba4ff4b388acfd01cdc14d08 \
31-
--hash=sha256:c7b742bf31c88566b4bb6335a7f393bb322e580b6bb98df7bd0c25e6e3519ce8
32+
--hash=sha256:c7b742bf31c88566b4bb6335a7f393bb322e580b6bb98df7bd0c25e6e3519ce8 \
33+
--hash=sha256:62b55f6722735a6c472f88361cde6640608773d9443cebdbb51abf436a1fcdd3
3234
cloudflare==2.19.4 \
3335
--hash=sha256:3b6000a01a237c23bccfdf6d20256ea5111ec74a826ae9e74f9f0e5bb5b2383f
3436
ConfigArgParse==1.7.5 \
@@ -69,7 +71,8 @@ python-dateutil==2.9.0.post0 \
6971
--hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427
7072
PyYAML==6.0.3 \
7173
--hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
72-
--hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d
74+
--hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \
75+
--hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6
7376
requests==2.32.3 \
7477
--hash=sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6
7578
requests-file==3.0.1 \
@@ -92,4 +95,5 @@ urllib3==2.7.0 \
9295
--hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
9396
zope.interface==8.6 \
9497
--hash=sha256:9217b1123f6aeec9ddf1789bffd83da3123546d551c164a99f862a5d1f5ac0f8 \
95-
--hash=sha256:a43e669d68fd8c10fe315812f7e1d262c6c00e9667f29f799a3771f9a3b5b41d
98+
--hash=sha256:a43e669d68fd8c10fe315812f7e1d262c6c00e9667f29f799a3771f9a3b5b41d \
99+
--hash=sha256:09522cdc6a77376bc36988b531db3b568c8cb0b6ca7286d8316aab283888770f

‎custom-domain/dstack-ingress/scripts/haproxy-lib.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ global
3131
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
3232
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
3333
ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
34-
ssl-default-bind-curves secp384r1
34+
ssl-default-bind-curves X25519MLKEM768:secp384r1
3535
3636
defaults
3737
log global

0 commit comments

Comments
 (0)