|
| 1 | +--- |
| 2 | +description: Deploy a trustless Eliza AI agent on Oasis using ROFL enclaves, |
| 3 | + with enclave-managed keys and on-chain verification on Sapphire. |
| 4 | +tags: [ROFL, AI, appd, secrets] |
| 5 | +--- |
| 6 | + |
| 7 | +import Tabs from '@theme/Tabs'; |
| 8 | +import TabItem from '@theme/TabItem'; |
| 9 | + |
| 10 | +# Trustless AI Agent |
| 11 | + |
| 12 | +Learn how to deploy a trustless Eliza agent on Oasis using ROFL enclaves. |
| 13 | + |
| 14 | +## What You’ll Build |
| 15 | + |
| 16 | +By the end you will have a working Eliza agent running inside a ROFL Trusted |
| 17 | +Execution Environment (TEE), registered and validated as a trustless agent in |
| 18 | +the [ERC-8004] registry. The agent's code can be fully audited and proved that |
| 19 | +the deployed instance really originates from it and cannot be silently altered. |
| 20 | + |
| 21 | +[ERC-8004]: https://eips.ethereum.org/EIPS/eip-8004 |
| 22 | + |
| 23 | +## Prerequisites |
| 24 | + |
| 25 | +You will need: |
| 26 | +- **Docker** (or Podman) with credentials on docker.io, ghcr.io or other |
| 27 | + public OCI registry |
| 28 | +- **Oasis CLI** and at least **120 TEST** tokens in your wallet |
| 29 | + (use [Oasis Testnet faucet]). |
| 30 | +- **Node.js 22+** (for Eliza and helper scripts) |
| 31 | +- **OpenAI** API key |
| 32 | +- **RPC URL** for accessing the ERC-8004 registry (e.g. Infura) |
| 33 | +- **Pinata JWT** for storing agent information to IPFS |
| 34 | + |
| 35 | +Check [Quickstart Prerequisites] for setup details. |
| 36 | + |
| 37 | +[Quickstart Prerequisites]: ../rofl/quickstart#prerequisites |
| 38 | +[Oasis Testnet faucet]: https://faucet.testnet.oasis.io |
| 39 | + |
| 40 | +## Create an Eliza Agent |
| 41 | + |
| 42 | +Initialize a project using the ElizaOS CLI and prepare it for ROFL. |
| 43 | + |
| 44 | +```shell |
| 45 | +# Install bun and ElizaOS CLI |
| 46 | +bun --version || curl -fsSL https://bun.sh/install | bash |
| 47 | +bun install -g @elizaos/cli |
| 48 | + |
| 49 | +# Create and configure the agent |
| 50 | +elizaos create -t project rofl-eliza |
| 51 | +# 1) Select Pqlite database |
| 52 | +# 2) Select the OpenAI model and enter your OpenAI key |
| 53 | + |
| 54 | +# Test the agent locally |
| 55 | +cd rofl-eliza |
| 56 | +elizaos start |
| 57 | +# Visiting http://localhost:3000 with your browser should open Eliza UI |
| 58 | +``` |
| 59 | + |
| 60 | +## Containerize the App and the ERC-8004 wrapper |
| 61 | + |
| 62 | +The Eliza agent startup wizard already generated the `Dockerfile` that packs |
| 63 | +your agent into a container. |
| 64 | + |
| 65 | +Next, we'll make sure that the Eliza agent is registered as a trustless agent in |
| 66 | +the ERC-8004 registry. A helper image called [`rofl-8004`] will do the |
| 67 | +registration for us. Create the following `compose.yaml` file: |
| 68 | + |
| 69 | +```yaml title="compose.yaml" |
| 70 | +services: |
| 71 | + rofl-eliza: |
| 72 | + build: . |
| 73 | + image: docker.io/YOUR_USERNAME/rofl-eliza:latest |
| 74 | + platform: linux/amd64 |
| 75 | + environment: |
| 76 | + - OPENAI_API_KEY=${OPENAI_API_KEY} |
| 77 | + ports: |
| 78 | + - "3000:3000" |
| 79 | + volumes: |
| 80 | + - eliza-storage:/root/.eliza |
| 81 | + |
| 82 | + rofl-8004: |
| 83 | + image: ghcr.io/oasisprotocol/rofl-8004@sha256:2226a17a56420c271362ca7874d243efb63ddafb608b661f488c10e54bc24f63 |
| 84 | + platform: linux/amd64 |
| 85 | + environment: |
| 86 | + - RPC_URL=${RPC_URL} |
| 87 | + - PINATA_JWT=${PINATA_JWT} |
| 88 | + volumes: |
| 89 | + - /run/rofl-appd.sock:/run/rofl-appd.sock |
| 90 | + |
| 91 | +volumes: |
| 92 | + eliza-storage: |
| 93 | +``` |
| 94 | +
|
| 95 | +Build and push: |
| 96 | +
|
| 97 | +```shell |
| 98 | +docker compose build |
| 99 | +docker compose push |
| 100 | +``` |
| 101 | + |
| 102 | +For extra security and verifiability pin the digest and use |
| 103 | +`image: ...@sha256:...` in `compose.yaml`. |
| 104 | + |
| 105 | +[`rofl-8004`]: https://github.com/oasisprotocol/erc-8004 |
| 106 | + |
| 107 | +## Init ROFL and Create App |
| 108 | + |
| 109 | +The agent will run in a container inside a TEE. ROFL will handle the startup |
| 110 | +attestation of the container and the secrets in form of environment variables. |
| 111 | +This way TEE will be completely transparent to the agent app. |
| 112 | + |
| 113 | +```shell |
| 114 | +oasis rofl init |
| 115 | +oasis rofl create --network testnet |
| 116 | +``` |
| 117 | + |
| 118 | +Inspect on-chain activity and app details in the [Oasis Explorer]. |
| 119 | + |
| 120 | +## Build ROFL bundle |
| 121 | + |
| 122 | +Eliza requires at least 2 GiB of memory and 5 GB of storage. Update the |
| 123 | +`resources` section in `rofl.yaml` accordingly: |
| 124 | + |
| 125 | +```yaml title="rofl.yaml" |
| 126 | +resources: |
| 127 | + memory: 2048 |
| 128 | + cpus: 1 |
| 129 | + storage: |
| 130 | + kind: disk-persistent |
| 131 | + size: 5000 |
| 132 | +``` |
| 133 | +
|
| 134 | +Then, build the ROFL bundle by invoking: |
| 135 | +
|
| 136 | +<Tabs> |
| 137 | + <TabItem value="Native Linux"> |
| 138 | + ```shell |
| 139 | + oasis rofl build |
| 140 | + ``` |
| 141 | + </TabItem> |
| 142 | + <TabItem value="Docker (Mac/Windows/Linux)"> |
| 143 | + ```shell |
| 144 | + docker run --platform linux/amd64 --volume .:/src \ |
| 145 | + -it ghcr.io/oasisprotocol/rofl-dev:main oasis rofl build |
| 146 | + ``` |
| 147 | + </TabItem> |
| 148 | +</Tabs> |
| 149 | + |
| 150 | +## Secrets |
| 151 | + |
| 152 | +Let's end-to-end encrypt `OPENAI_API_KEY` and store it on-chain. Also, provide |
| 153 | +the `RPC_URL` and `PINATA_JWT` values for ERC-8004 registration. |
| 154 | + |
| 155 | +```shell |
| 156 | +echo -n "<your-openai-key-here>" | oasis rofl secret set OPENAI_API_KEY - |
| 157 | +echo -n "https://sepolia.infura.io/v3/<YOUR_KEY>" | oasis rofl secret set RPC_URL - |
| 158 | +echo -n "<your-pinata-key-here>" | oasis rofl secret set PINATA_JWT - |
| 159 | +``` |
| 160 | + |
| 161 | +Then store enclave identities and secrets on-chain: |
| 162 | + |
| 163 | +```shell |
| 164 | +oasis rofl update |
| 165 | +``` |
| 166 | + |
| 167 | +## Deploy |
| 168 | + |
| 169 | +Deploy your Eliza agent to a ROLF provider by invoking: |
| 170 | + |
| 171 | +```shell |
| 172 | +oasis rofl deploy |
| 173 | +``` |
| 174 | + |
| 175 | +By default, the Oasis-maintained provider is selected on Testnet that lends |
| 176 | +you a node for 1 hour. You can extend the rental, for example by 4 hours by |
| 177 | +invoking `oasis rofl machine top-up --term hour --term-count 4` |
| 178 | +[command][deploy]. |
| 179 | + |
| 180 | +[deploy]: https://github.com/oasisprotocol/cli/blob/master/docs/rofl.md#deploy |
| 181 | + |
| 182 | +## Trying it out |
| 183 | + |
| 184 | +After deploying the agent, use the CLI to check, if the agent is running: |
| 185 | + |
| 186 | +```shell |
| 187 | +# Show machine details (state, proxy URLs, expiration). |
| 188 | +oasis rofl machine show |
| 189 | +``` |
| 190 | + |
| 191 | +If the agent successfully booted up, the `Proxy:` section contains the |
| 192 | +URL where your agent is accessible on, for example: |
| 193 | + |
| 194 | +``` |
| 195 | +Proxy: |
| 196 | + Domain: m1058.opf-testnet-rofl-25.rofl.app |
| 197 | + Ports from compose file: |
| 198 | + 3000 (rofl-eliza): https://p3000.m1058.opf-testnet-rofl-25.rofl.app |
| 199 | +``` |
| 200 | + |
| 201 | +In the example above, our app is accessible at |
| 202 | +https://p3000.m1058.opf-testnet-rofl-25.rofl.app. |
| 203 | + |
| 204 | +## ERC-8004 Registration and Validation |
| 205 | + |
| 206 | +When spinning up the agent for the first time, the `rofl-8004` service will |
| 207 | +derive the ethereum address for registering the agent. You will need to |
| 208 | +fund that account with a small amount of ether to pay for the fees. |
| 209 | + |
| 210 | +Fetch your app logs: |
| 211 | + |
| 212 | +```shell |
| 213 | +oasis rofl machine logs |
| 214 | +``` |
| 215 | + |
| 216 | +Then look for `Please top it up` line which contains the derived address. |
| 217 | +After funding it, your agent will automatically be registered and validated. |
| 218 | + |
| 219 | +:::warning |
| 220 | + |
| 221 | +Logs are accessible to the app admin and are stored **unencrypted on the ROFL |
| 222 | +node**. Avoid printing secrets! |
| 223 | + |
| 224 | +::: |
| 225 | + |
| 226 | +:::example Trustless Agent Demo |
| 227 | + |
| 228 | +You can fetch a complete example shown in this chapter from |
| 229 | +https://github.com/oasisprotocol/demo-trustless-agent. |
| 230 | + |
| 231 | +::: |
| 232 | + |
| 233 | +[machine-logs]: https://github.com/oasisprotocol/cli/blob/master/docs/rofl.md#machine-logs |
| 234 | +[sdk-deploy-logs]: https://github.com/oasisprotocol/oasis-sdk/blob/main/docs/rofl/workflow/deploy.md#check-that-the-app-is-running |
| 235 | +[Oasis Explorer]: https://explorer.oasis.io/testnet/sapphire |
0 commit comments