build script update

ci/prod/compose/chain_gateway.dockerfile

@@ -35,7 +35,9 @@ RUN apk add --no-cache ca-certificates tzdata wget
 WORKDIR /app
 COPY api/chain/gateway/config.yml /app/config.yml
 COPY api/chain/gateway/env /app/env
+COPY api/chain/gateway/entrypoint.sh /app/entrypoint.sh
 COPY --from=build /out/chain-gateway /app/chain-gateway
+RUN chmod +x /app/entrypoint.sh
 EXPOSE 50070 9403
-ENTRYPOINT ["/app/chain-gateway"]
-CMD ["--config.file", "/app/config.yml"]
+ENTRYPOINT ["/app/entrypoint.sh"]
+CMD ["/app/chain-gateway","--config.file","/app/config.yml"]

ci/prod/compose/chain_gateway.yml

@@ -5,6 +5,14 @@ x-common-env: &common-env
     - ../env/.env.runtime
     - ../env/.env.version
 
+volumes:
+  chain-gateway-vault-run:
+    driver: local
+    driver_opts:
+      type: tmpfs
+      device: tmpfs
+      o: size=8m,uid=0,gid=0,mode=0700
+
 networks:
   sendico-net:
     external: true
@@ -33,11 +41,16 @@ services:
       CHAIN_GATEWAY_ARBITRUM_RPC_URL: ${CHAIN_GATEWAY_ARBITRUM_RPC_URL}
       CHAIN_GATEWAY_SERVICE_WALLET_KEY: ${CHAIN_GATEWAY_SERVICE_WALLET_KEY}
       CHAIN_GATEWAY_SERVICE_WALLET_ADDRESS: ${CHAIN_GATEWAY_SERVICE_WALLET_ADDRESS}
-      CHAIN_GATEWAY_VAULT_TOKEN: ${CHAIN_GATEWAY_VAULT_TOKEN}
+      VAULT_TOKEN_FILE: /run/vault/token
     command: ["--config.file", "/app/config.yml"]
     ports:
       - "0.0.0.0:${CHAIN_GATEWAY_GRPC_PORT}:50070"
       - "0.0.0.0:${CHAIN_GATEWAY_METRICS_PORT}:9403"
+    volumes:
+      - chain-gateway-vault-run:/run/vault:ro
+    depends_on:
+      sendico_chain_gateway_vault_agent:
+        condition: service_healthy
     healthcheck:
       test: ["CMD-SHELL","wget -qO- http://localhost:9403/health | grep -q '\"status\":\"ok\"'"]
       interval: 30s
@@ -46,3 +59,32 @@ services:
       start_period: 60s
     networks:
       - sendico-net
+
+  sendico_chain_gateway_vault_agent:
+    <<: *common-env
+    container_name: sendico-chain-gateway-vault-agent
+    restart: unless-stopped
+    image: hashicorp/vault:latest
+    pull_policy: always
+    cap_add: ["IPC_LOCK"]
+    environment:
+      VAULT_ADDR: ${VAULT_ADDR}
+      CHAIN_GATEWAY_VAULT_ROLE_ID: ${CHAIN_GATEWAY_VAULT_ROLE_ID}
+      CHAIN_GATEWAY_VAULT_SECRET_ID: ${CHAIN_GATEWAY_VAULT_SECRET_ID}
+    command: >
+      sh -lc 'set -euo pipefail; umask 077;
+              : "${CHAIN_GATEWAY_VAULT_ROLE_ID:?}"; : "${CHAIN_GATEWAY_VAULT_SECRET_ID:?}";
+              printf "%s" "$CHAIN_GATEWAY_VAULT_ROLE_ID"   > /run/vault/role_id;
+              printf "%s" "$CHAIN_GATEWAY_VAULT_SECRET_ID" > /run/vault/secret_id;
+              unset CHAIN_GATEWAY_VAULT_ROLE_ID CHAIN_GATEWAY_VAULT_SECRET_ID;
+              exec vault agent -config=/etc/vault/agent/chain-gateway.hcl'
+    volumes:
+      - ./vault-agent/chain-gateway.hcl:/etc/vault/agent/chain-gateway.hcl:ro
+      - chain-gateway-vault-run:/run/vault
+    healthcheck:
+      test: ["CMD","test","-s","/run/vault/token"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+    networks:
+      - sendico-net

ci/prod/compose/vault-agent/chain-gateway.hcl

@@ -0,0 +1,20 @@
+vault {
+  address = "https://vault.sendico.io"
+}
+
+auto_auth {
+  method "approle" {
+    mount_path = "auth/approle"
+    config = {
+      role_id_file_path    = "/run/vault/role_id"
+      secret_id_file_path  = "/run/vault/secret_id"
+    }
+  }
+
+  sink "file" {
+    config = {
+      path = "/run/vault/token"
+      mode = 0600
+    }
+  }
+}

ci/prod/scripts/deploy/chain_gateway.sh

@@ -21,7 +21,8 @@ REQUIRED_SECRETS=(
   CHAIN_GATEWAY_ARBITRUM_RPC_URL
   CHAIN_GATEWAY_SERVICE_WALLET_KEY
   CHAIN_GATEWAY_SERVICE_WALLET_ADDRESS
-  CHAIN_GATEWAY_VAULT_TOKEN
+  CHAIN_GATEWAY_VAULT_ROLE_ID
+  CHAIN_GATEWAY_VAULT_SECRET_ID
   NATS_USER
   NATS_PASSWORD
   NATS_URL
@@ -48,7 +49,8 @@ CHAIN_GATEWAY_MONGO_PASSWORD_B64="$(b64enc "${CHAIN_GATEWAY_MONGO_PASSWORD}")"
 CHAIN_GATEWAY_ARBITRUM_RPC_URL_B64="$(b64enc "${CHAIN_GATEWAY_ARBITRUM_RPC_URL}")"
 CHAIN_GATEWAY_SERVICE_WALLET_KEY_B64="$(b64enc "${CHAIN_GATEWAY_SERVICE_WALLET_KEY}")"
 CHAIN_GATEWAY_SERVICE_WALLET_ADDRESS_B64="$(b64enc "${CHAIN_GATEWAY_SERVICE_WALLET_ADDRESS}")"
-CHAIN_GATEWAY_VAULT_TOKEN_B64="$(b64enc "${CHAIN_GATEWAY_VAULT_TOKEN}")"
+CHAIN_GATEWAY_VAULT_ROLE_ID_B64="$(b64enc "${CHAIN_GATEWAY_VAULT_ROLE_ID}")"
+CHAIN_GATEWAY_VAULT_SECRET_ID_B64="$(b64enc "${CHAIN_GATEWAY_VAULT_SECRET_ID}")"
 NATS_USER_B64="$(b64enc "${NATS_USER}")"
 NATS_PASSWORD_B64="$(b64enc "${NATS_PASSWORD}")"
 NATS_URL_B64="$(b64enc "${NATS_URL}")"
@@ -67,7 +69,7 @@ fi
 RSYNC_FLAGS=(-az --delete)
 [[ "${DEBUG_DEPLOY:-0}" = "1" ]] && RSYNC_FLAGS=(-avz --delete)
 
-ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
+ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/compose/secrets ${REMOTE_DIR}/env"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
@@ -85,7 +87,8 @@ ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" \
   CHAIN_GATEWAY_ARBITRUM_RPC_URL_B64="$CHAIN_GATEWAY_ARBITRUM_RPC_URL_B64" \
   CHAIN_GATEWAY_SERVICE_WALLET_KEY_B64="$CHAIN_GATEWAY_SERVICE_WALLET_KEY_B64" \
   CHAIN_GATEWAY_SERVICE_WALLET_ADDRESS_B64="$CHAIN_GATEWAY_SERVICE_WALLET_ADDRESS_B64" \
-  CHAIN_GATEWAY_VAULT_TOKEN_B64="$CHAIN_GATEWAY_VAULT_TOKEN_B64" \
+  CHAIN_GATEWAY_VAULT_ROLE_ID_B64="$CHAIN_GATEWAY_VAULT_ROLE_ID_B64" \
+  CHAIN_GATEWAY_VAULT_SECRET_ID_B64="$CHAIN_GATEWAY_VAULT_SECRET_ID_B64" \
   NATS_USER_B64="$NATS_USER_B64" \
   NATS_PASSWORD_B64="$NATS_PASSWORD_B64" \
   NATS_URL_B64="$NATS_URL_B64" \
@@ -135,7 +138,8 @@ CHAIN_GATEWAY_MONGO_PASSWORD="$(decode_b64 "$CHAIN_GATEWAY_MONGO_PASSWORD_B64")"
 CHAIN_GATEWAY_ARBITRUM_RPC_URL="$(decode_b64 "$CHAIN_GATEWAY_ARBITRUM_RPC_URL_B64")"
 CHAIN_GATEWAY_SERVICE_WALLET_KEY="$(decode_b64 "$CHAIN_GATEWAY_SERVICE_WALLET_KEY_B64")"
 CHAIN_GATEWAY_SERVICE_WALLET_ADDRESS="$(decode_b64 "$CHAIN_GATEWAY_SERVICE_WALLET_ADDRESS_B64")"
-CHAIN_GATEWAY_VAULT_TOKEN="$(decode_b64 "$CHAIN_GATEWAY_VAULT_TOKEN_B64")"
+CHAIN_GATEWAY_VAULT_ROLE_ID="$(decode_b64 "$CHAIN_GATEWAY_VAULT_ROLE_ID_B64")"
+CHAIN_GATEWAY_VAULT_SECRET_ID="$(decode_b64 "$CHAIN_GATEWAY_VAULT_SECRET_ID_B64")"
 NATS_USER="$(decode_b64 "$NATS_USER_B64")"
 NATS_PASSWORD="$(decode_b64 "$NATS_PASSWORD_B64")"
 NATS_URL="$(decode_b64 "$NATS_URL_B64")"
@@ -143,8 +147,9 @@ NATS_URL="$(decode_b64 "$NATS_URL_B64")"
 export CHAIN_GATEWAY_MONGO_USER CHAIN_GATEWAY_MONGO_PASSWORD
 export CHAIN_GATEWAY_ARBITRUM_RPC_URL
 export CHAIN_GATEWAY_SERVICE_WALLET_KEY CHAIN_GATEWAY_SERVICE_WALLET_ADDRESS
-export CHAIN_GATEWAY_VAULT_TOKEN
+export CHAIN_GATEWAY_VAULT_ROLE_ID CHAIN_GATEWAY_VAULT_SECRET_ID
 export NATS_USER NATS_PASSWORD NATS_URL
+
 COMPOSE_PROJECT_NAME="$COMPOSE_PROJECT"
 export COMPOSE_PROJECT_NAME
 read -r -a SERVICES <<<"${SERVICES_LINE}"