Step 4: Deploy KMS into CVM

Deploy KMS into CVM

The dstack-vmm is running now. Open another terminal and go to the kms/dstack-app/ directory:

cd dstack/kms/dstack-app/
./deploy-to-vmm.sh

Configure Environment Variables

Edit the .env file with required variables:

# .env
VMM_RPC=unix:../../vmm-data/vmm.sock
KMS_CONTRACT_ADDR=0xFE6C45aE66344CAEF5E5D7e2cbD476286D651875
KMS_RPC_ADDR=0.0.0.0:9201
GUEST_AGENT_ADDR=127.0.0.1:9205
ETH_RPC_URL=https://rpc.phala.network
GIT_REV=HEAD
OS_IMAGE=dstack-0.5.2
IMAGE_DOWNLOAD_URL=https://files.kvin.wang/images/mr_{OS_IMAGE_HASH}.tar.gz

Important: Set the KMS_CONTRACT_ADDR to the address from the previous step and ensure IMAGE_DOWNLOAD_URL points to the correct dstack OS image for hash verification.

Run deployment script again:

After configuring the .env file, run the script again to deploy:

App compose file created at: .app-compose.json
Compose hash: ec3d427f62bd60afd520fce0be3b368aba4516434f2ff761f74775f871f5b6e3
Deploying KMS to dstack-vmm…
App ID: ec3d427f62bd60afd520fce0be3b368aba451643
Created VM with ID: f5299298-bf4f-43c0-839c-88c755391f3c

Monitor KMS Deployment

Check KMS CVM Status:

cd ../../vmm-data/
tail -f run/vm/f5299298-bf4f-43c0-839c-88c755391f3c/serial.log

Wait for KMS Ready Signal:

br-1df48b1c448a: port 2(veth36ab5cb) entered forwarding state
app-compose.sh[882]:  Container dstack-kms-1  Started
app-compose.sh[688]: Pruning unused images
app-compose.sh[8347]: Total reclaimed space: 0B
app-compose.sh[688]: Pruning unused volumes
app-compose.sh[8356]: Total reclaimed space: 0B
[  OK  ] Finished App Compose Service.
[  OK  ] Reached target Multi-User System.
Starting Record Runlevel Change in UTMP…
[  OK  ] Finished Record Runlevel Change in UTMP.

KMS Bootstrap Process

Access KMS Interface

Open your browser and navigate to:

http://127.0.0.1:9201/

1. Click the Bootstrap button
2. Fill in the domain serving the KMS (e.g., kms.test2.dstack.phala.network)
3. Click [Bootstrap] → [Finish setup]

Bootstrap Result

After successful bootstrap, you’ll see the public key and corresponding TDX quote:

Next Step: Set the KMS info in the kms-auth-contract using the displayed values.

Configure the KMS info in the auth contract interface

Success! The KMS instance is now ready to use.