feature/SP-7750, vm measuruments support

[Villain88]

Summary by CodeRabbit

• New Features

  • Added a new PKI VM measurements service to the system image.
  • Added automatic periodic health checks for the service.

• Bug Fixes

  • The service now restarts automatically if health checks fail.
  • Updated network rules to allow the service’s health check port.

• Chores

  • Included the required runtime tools and component installation steps for the new service.

[coderabbitai]

Walkthrough

Adds a new pki-vm-measurements systemd service with a curl-based healthcheck service and timer, wires their installation and activation into the Dockerfile and install_pki_components.sh (via a new version build arg), opens firewall port 9180, and adds curl as a runtime dependency.

Changes

PKI VM Measurements Service

Layer / File(s)	Summary
New systemd units src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements.service, .../pki-vm-measurements-healthcheck.service, .../pki-vm-measurements-healthcheck.timer	Defines the main service (runs on network-online.target, auto-restarts), a healthcheck service that curls localhost:9180/healthcheck and restarts the main service on failure, and a timer that runs the healthcheck every 30 seconds.
Install and enable in build src/rootfs/files/scripts/install_pki_components.sh, src/Dockerfile	Adds a $3 version parameter to install @super-protocol/pki-vm-measurements, adds a PKI_VM_MEASUREMENTS_VERSION build arg, and copies/symlinks the new unit files into multi-user.target.wants and timers.target.wants.
Firewall and runtime dependencies src/rootfs/files/configs/usr/local/bin/hardening-vm.sh, src/rootfs/files/scripts/setup_runtime_tools.sh	Opens TCP port 9180 for the new service and adds curl to the runtime package installation list.

Estimated code review effort: 2 (Simple) | ~12 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Timer as pki-vm-measurements-healthcheck.timer
  participant Healthcheck as pki-vm-measurements-healthcheck.service
  participant Service as pki-vm-measurements.service
  Timer->>Healthcheck: trigger every 30s
  Healthcheck->>Service: curl http://localhost:9180/healthcheck
  Service-->>Healthcheck: response or failure
  Healthcheck->>Service: restart on curl failure

Loading

Poem

A little rabbit hops with glee,
New services humming, wild and free,
Port 9180 now swings the gate,
Curl checks the pulse, never too late,
With curl installed, my burrow's complete! 🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: adding VM measurements support and related systemd/runtime setup.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/SP-7750

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

src/Dockerfile (1)

226-232: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Prefer COPY over ADD for local files.

Hadolint flags the new ADD instructions (DL3020) for these local unit/script files. ADD is best reserved for remote URLs or auto-extracting archives; plain local file copies should use COPY.

♻️ Example fix

-ADD rootfs/files/configs/pki-service/systemd/pki-vm-measurements.service "${OUTPUTDIR}/etc/systemd/system"
-ADD rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.service "${OUTPUTDIR}/etc/systemd/system"
-ADD rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.timer "${OUTPUTDIR}/etc/systemd/system"
+COPY rootfs/files/configs/pki-service/systemd/pki-vm-measurements.service "${OUTPUTDIR}/etc/systemd/system"
+COPY rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.service "${OUTPUTDIR}/etc/systemd/system"
+COPY rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.timer "${OUTPUTDIR}/etc/systemd/system"

Also applies to: 353-353

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/Dockerfile` around lines 226 - 232, The Dockerfile uses ADD for local
files in the pki-service setup, which triggers the lint rule and should be
replaced with plain file copies. Update the affected instructions in the block
adding the systemd units and super config files to use COPY instead of ADD,
keeping the same source and destination paths. Make the same change anywhere
else in the Dockerfile where local files are added similarly, such as the other
referenced ADD occurrence.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/Dockerfile`:
- Around line 226-232: The Dockerfile uses ADD for local files in the
pki-service setup, which triggers the lint rule and should be replaced with
plain file copies. Update the affected instructions in the block adding the
systemd units and super config files to use COPY instead of ADD, keeping the
same source and destination paths. Make the same change anywhere else in the
Dockerfile where local files are added similarly, such as the other referenced
ADD occurrence.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c6d0e916-a82f-4200-a08f-e28874707de3

📥 Commits

Reviewing files that changed from the base of the PR and between 5bc74a4 and 52b97a7.

📒 Files selected for processing (7)

• src/Dockerfile
• src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.service
• src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements-healthcheck.timer
• src/rootfs/files/configs/pki-service/systemd/pki-vm-measurements.service
• src/rootfs/files/configs/usr/local/bin/hardening-vm.sh
• src/rootfs/files/scripts/install_pki_components.sh
• src/rootfs/files/scripts/setup_runtime_tools.sh