TEE Deployment Pattern

Documentation Index

Fetch the complete documentation index at: https://docs.memwal.ai/llms.txt

Use this file to discover all available pages before exploring further.

​

What This Provides

​

Architecture Flow

1. Client sends plaintext to the TEE relayer.
2. The relayer validates delegate-key auth and generates embeddings inside the enclave.
3. The sidecar SEAL-encrypts the plaintext inside the enclave.
4. The sidecar uploads only SEAL ciphertext to Walrus.
5. PostgreSQL stores owner, namespace, blob_id, blob size, and pgvector embeddings.

1. Client sends a plaintext query to the TEE relayer.
2. The relayer embeds the query and searches pgvector by owner + namespace.
3. The sidecar downloads matching ciphertext blobs from Walrus and SEAL-decrypts inside the enclave.
4. The relayer returns plaintext matches to the authenticated client.

​

Reference Template

cp services/server/deploy/nautilus/nautilus.toml.example .nautilus.toml
cp services/server/deploy/nautilus/runtime.env.example .env.nautilus

make -C services/server/deploy/nautilus build

make -C services/server/deploy/nautilus run-local ENV_FILE=.env.nautilus
make -C services/server/deploy/nautilus smoke RELAYER_URL=http://127.0.0.1:8000

​

Required Runtime Variables

​

External Endpoints

• PostgreSQL
• Redis
• Sui RPC
• Walrus publisher
• Walrus aggregator
• Walrus upload relay, if configured
• SEAL key servers or committee aggregators. On testnet, the built-in default is Mysten’s initial committee aggregator. Mainnet uses the legacy independent key server default until an official committee aggregator is available.
• OpenAI-compatible embedding and LLM provider

​

Nautilus Completion Checklist

1. Generate or adapt the Nautilus manifest using nautilus.toml.example as the MemWal-specific input.
2. Build the enclave artifact with the installed Nautilus toolchain or CI workflow.
3. Deploy the enclave artifact to the target TEE host or Nautilus provider.
4. Record the enclave measurement, PCRs, or attestation identity produced by that build.
5. Register or publish the expected identity through the Nautilus/Sui verification path used by the deployment.
6. Require clients, gateway policy, or Move-side verification to check that identity before trusting the endpoint as a Nautilus deployment.

​

Secrets Handling

• Inject secrets at runtime through Nautilus/CI secrets, not through Docker build args.
• Keep SERVER_SUI_PRIVATE_KEY, SERVER_SUI_PRIVATE_KEYS, SIDECAR_AUTH_TOKEN, DATABASE_URL, REDIS_URL, OPENAI_API_KEY, ENOKI_API_KEY, and SEAL API keys out of git.
• Restrict host access to the runtime env file and any Nautilus secret store.
• Disable debug consoles and broad shell access on production enclave hosts.
• Rotate the server wallet keys if the host-side secret delivery path is exposed.

​

Operational Verification

curl "$TEE_RELAYER_URL/health"

curl "$TEE_RELAYER_URL/metrics"

TEE_RELAYER_URL=https://tee-relayer.example.com \
MEMWAL_DELEGATE_KEY=... \
MEMWAL_ACCOUNT_ID=0x... \
pnpm dlx tsx <<'TS'
import { MemWal } from "@mysten-incubation/memwal";

const namespace = `tee-smoke-${Date.now()}`;
const memwal = MemWal.create({
  key: process.env.MEMWAL_DELEGATE_KEY!,
  accountId: process.env.MEMWAL_ACCOUNT_ID!,
  serverUrl: process.env.TEE_RELAYER_URL!,
  namespace,
});

await memwal.health();
const memory = `TEE smoke memory ${new Date().toISOString()}`;
const job = await memwal.remember(memory);
await memwal.waitForRememberJob(job.job_id);
const recall = await memwal.recall("What smoke memory was stored?", 5);

if (!recall.results.some((item) => item.text.includes("TEE smoke memory"))) {
  throw new Error("TEE remember/recall smoke test failed");
}

console.log({ namespace, job_id: job.job_id, recalled: recall.results.length });
TS

• Rust relayer startup: sidecar readiness, PostgreSQL connection, Redis connection, Walrus endpoints, and WalrusSealEngine.
• TypeScript sidecar startup and /health.
• SEAL encrypt/decrypt errors.
• Walrus upload/download errors.
• Sui RPC or account-resolution errors.
• Rate-limit fallback logs, which indicate Redis trouble.

​

Failure Modes

​

Security Considerations

• Plaintext exists inside the enclave while handling remember, recall, analyze, ask, and restore.
• SEAL encryption begins inside the sidecar before Walrus upload. Walrus should only receive encrypted bytes.
• Treat the enclave as tamper-resistant, not magically tamper-proof. Attestation and measurement pinning are what let clients distinguish the intended TEE image from a normal host process.
• PostgreSQL stores vectors and metadata, not production plaintext. Do not enable BENCHMARK_MODE.
• External embedding and LLM providers may see plaintext unless you run those services inside the enclave or switch to a provider/trust model you accept.
• TLS should terminate inside the enclave or use an equivalent enclave-protected channel. If a host load balancer terminates TLS before forwarding to the enclave, the host can observe plaintext.
• The host still controls availability, traffic routing, and endpoint allowlists. TEE protects confidentiality and integrity of code/data inside the enclave, not uptime.
• Client-side, gateway, or onchain attestation verification is required for the strongest story. Publish the expected Nautilus image measurement and require that verification path to check it. Without verification, users still trust that the advertised endpoint is the enclave deployment.
• Keep structured logs, metrics labels, traces, and error bodies free of plaintext and secrets.

​

Read Next

• Self-Hosting
• Environment Variables
• Trust & Security Model
• Sui Nautilus docs