Introducing Nitrogen: Deploy Web Servers and Databases to AWS Nitro Enclaves
Tags: docker, aws, nitroenclaves, security
Published: 2022-10-28 18:21:16

_TL;DR: [Nitrogen](https://github.com/capeprivacy/nitrogen) is a tool for deploying web servers, databases, and other services to AWS Nitro Enclaves. Given a Dockerfile, Nitrogen will spin up an EC2 instance, configure external networking, and build and deploy your web service. What you get back is a hostname and port that's ready to use. Nitrogen is [fully open source](https://github.com/capeprivacy/nitrogen) and comes with **pre-built scripts for popular services like Redis, and Nginx**._

For example, to deploy Nginx, first install Nitrogen:
```bash
curl -fsSL https://raw.githubusercontent.com/capeprivacy/nitrogen/main/install.sh | sh
```

Clone the examples:
```bash
git clone git@github.com:capeprivacy/nitrogen.git
cd nitrogen
```

_Note: An AWS account is required. If you have AWS cli configured you can [retrieve your credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html#cli-configure-files-where) with `cat ~/.aws/credentials`. See [troubleshooting](https://github.com/capeprivacy/nitrogen#troubleshooting) if your AWS account uses MFA_

```bash
export AWS_ACCESS_KEY_ID=<YOUR ACCESS KEY>
export AWS_SECRET_ACCESS_KEY=<YOUR SECRET>
```

And then setup, build, and deploy:
```bash
nitrogen setup my-nginx-enclave ~/.ssh/id_rsa.pub
nitrogen build ./examples/nginx
nitrogen deploy my-nginx-enclave ~/.ssh/id_rsa
```

And that's it! **You have a Nitro Enclave running Nginx**:
```bash
curl http://ec2-34-56-789-0.compute-1.amazonaws.com:5000
# Hello World!
```

## How Nitrogen Works

A Nitro Enclave can run _almost_ anything that a regular EC2 instance can, but typically you need do a lot of work. A Nitro Enclave is an isolated VM carved out of an EC2 instance by the Nitro Hypervisor. By default, it has no network, no disk, and no shell access. (Even a root user has no access!) These constraints are core security features, but you need to open things up a little in order to run your application. (A complete blackbox would have no effect on the outside world!) To understand this complexity, see [Running an HTTP Server with AWS Nitro Enclaves](https://dev.to/bendecoste/running-an-http-server-with-aws-nitro-enclaves-elo) by @bendecoste.

**Nitrogen makes working with Nitro Enclaves super easy**. Let's walk through the example of deploying Nginx with Nitrogen in more detail...

### Launch a Nitro Enclave Capable EC2 Instance

```bash
# nitrogen setup <name> <public_key>
nitrogen setup my-nginx-enclave ~/.ssh/id_rsa.pub
```

`nitrogen setup` uses CloudFormation to spawn an EC2 instance, and configure networking like SSH. You can now SSH into the EC2 instance if you want, but you don't need to. Nitrogen defaults to `m5a.xlarge` EC2 instance type but you can also specify `--instance-type <any-enclave-enabled-instance-type>`.

### Build an Enclave Image File (EIF) from a Dockerfile

```bash
# nitrogen build <dockerfile-directory>
nitrogen build ./examples/nginx
```

`nitrogen build` will first build a docker image from the Dockerfile you specify, and then convert it to an Enclave Image File and save it locally.

### Deploy an EIF to a Nitro Enclave

```bash
# nitrogen deploy <name> <private_key>
nitrogen deploy my-nginx-enclave ~/.ssh/id_rsa
# Listening: ec2-34-56-789-0.compute-1.amazonaws.com:5000
```

`nitrogen deploy` will upload the EIF to the EC2 instance and launch it into the Nitro Enclave.

And that's it! Nginx is now setup and running on an AWS Nitro Enclave and we can `curl` the server.

```bash
curl https://ec2-34-56-789-0.compute-1.amazonaws.com:5000
# Hello World!
```

## What's Next for Nitrogen?

In a follow up post we'll walkthrough how Nitrogen works under the hood. And we'll share more details about the roadmap.

For now, you can `curl -fsSL https://raw.githubusercontent.com/capeprivacy/nitrogen/main/install.sh | sh` and start using it. We'd love to hear what you think in the comments below. [Please star Nitrogen on GitHub](https://github.com/capeprivacy/nitrogen/), and come chat on [Discord](https://discord.gg/nQW7YxUYjh). Thanks!