vault app_role secrets pass

ci/prod/compose/db.yml

@@ -8,12 +8,14 @@ volumes:
   mongo1_data: {}
   mongo2_data: {}
   mongo3_data: {}
+  # In-memory store for secrets/material rendered by Vault Agent (no host persistence)
   vault_secrets:
     driver: local
     driver_opts:
       type: tmpfs
       device: tmpfs
       o: size=32m,uid=999,gid=999,mode=0750
+  # In-memory config for PBM (renders from templates, no host persistence)
   pbm_cfg:
     driver: local
     driver_opts:
@@ -28,16 +30,24 @@ services:
     container_name: vault-agent-sendico
     restart: unless-stopped
     cap_add: ["IPC_LOCK"]
+    # Only static env here. AppRole creds are injected via CI at runtime.
     environment:
       VAULT_ADDR: ${VAULT_ADDR}
+      VAULT_ROLE_ID: ${VAULT_ROLE_ID}       # provided only during `docker compose up`
+      VAULT_SECRET_ID: ${VAULT_SECRET_ID}   # provided only during `docker compose up`
     volumes:
       - ./vault/agent.hcl:/etc/vault/agent.hcl:ro
       - ./vault/templates:/etc/vault/templates:ro
-      - /opt/sendico/vault/sendico-db/role_id:/vault/role_id:ro
-      - /opt/sendico/vault/sendico-db/secret_id:/vault/secret_id:ro
       - vault_secrets:/vault/secrets:rw
       - pbm_cfg:/etc/backup:rw
-    command: sh -lc 'vault agent -config=/etc/vault/agent.hcl'
+    # Write AppRole creds to tmpfs, drop them from env, then exec agent
+    command: >
+      sh -lc 'set -euo pipefail; umask 077;
+              : "${VAULT_ROLE_ID:?}"; : "${VAULT_SECRET_ID:?}";
+              printf "%s" "$VAULT_ROLE_ID"   > /vault/secrets/role_id;
+              printf "%s" "$VAULT_SECRET_ID" > /vault/secrets/secret_id;
+              unset VAULT_ROLE_ID VAULT_SECRET_ID;
+              exec vault agent -config=/etc/vault/agent.hcl'
     healthcheck:
       test: ["CMD-SHELL","test -s /vault/secrets/MONGO_INITDB_ROOT_USERNAME -a -s /vault/secrets/MONGO_INITDB_ROOT_PASSWORD -a -s /vault/secrets/mongo.kf -a -s /etc/backup/pbm.env -a -s /etc/backup/.u -a -s /etc/backup/.p"]
       interval: 5s
@@ -120,6 +130,7 @@ services:
       - vault_secrets:/vault/secrets:ro
     entrypoint: |
       bash -c '
+        set -euo pipefail
         u=$(cat /vault/secrets/MONGO_INITDB_ROOT_USERNAME)
         p=$(cat /vault/secrets/MONGO_INITDB_ROOT_PASSWORD)
         until mongosh --quiet --host sendico_db1 --port ${MONGO_PORT} --eval "db.adminCommand({ ping: 1 })"; do
@@ -152,6 +163,7 @@ services:
       - pbm_cfg:/etc/backup:ro
     command: |
       sh -lc '
+        set -euo pipefail
         . /etc/backup/pbm.env
         U=$$(cat /etc/backup/.u) ; P=$$(cat /etc/backup/.p)
         export AWS_EC2_METADATA_DISABLED=true
@@ -171,6 +183,7 @@ services:
       - pbm_cfg:/etc/backup:ro
     command: |
       sh -lc '
+        set -euo pipefail
         . /etc/backup/pbm.env
         U=$$(cat /etc/backup/.u) ; P=$$(cat /etc/backup/.p)
         export AWS_EC2_METADATA_DISABLED=true
@@ -190,6 +203,7 @@ services:
       - pbm_cfg:/etc/backup:ro
     command: |
       sh -lc '
+        set -euo pipefail
         . /etc/backup/pbm.env
         U=$$(cat /etc/backup/.u) ; P=$$(cat /etc/backup/.p)
         export AWS_EC2_METADATA_DISABLED=true