callbacks service draft

ci/prod/compose/callbacks.dockerfile

@@ -0,0 +1,42 @@
+# syntax=docker/dockerfile:1.7
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+
+FROM golang:alpine AS build
+ARG APP_VERSION=dev
+ARG GIT_REV=unknown
+ARG BUILD_BRANCH=unknown
+ARG BUILD_DATE=unknown
+ARG BUILD_USER=ci
+ENV GO111MODULE=on
+ENV PATH="/go/bin:${PATH}"
+WORKDIR /src
+COPY . .
+RUN apk add --no-cache bash git build-base protoc protobuf-dev \
+ && go install google.golang.org/protobuf/cmd/protoc-gen-go@latest \
+ && go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest \
+ && bash ci/scripts/proto/generate.sh
+WORKDIR /src/api/edge/callbacks
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
+    go build -trimpath -ldflags "\
+      -s -w \
+      -X github.com/tech/sendico/edge/callbacks/internal/appversion.Version=${APP_VERSION} \
+      -X github.com/tech/sendico/edge/callbacks/internal/appversion.Revision=${GIT_REV} \
+      -X github.com/tech/sendico/edge/callbacks/internal/appversion.Branch=${BUILD_BRANCH} \
+      -X github.com/tech/sendico/edge/callbacks/internal/appversion.BuildUser=${BUILD_USER} \
+      -X github.com/tech/sendico/edge/callbacks/internal/appversion.BuildDate=${BUILD_DATE}" \
+    -o /out/callbacks .
+
+FROM alpine:latest AS runtime
+RUN apk add --no-cache ca-certificates tzdata wget
+WORKDIR /app
+COPY api/edge/callbacks/config.yml /app/config.yml
+COPY api/edge/callbacks/entrypoint.sh /app/entrypoint.sh
+COPY --from=build /out/callbacks /app/callbacks
+RUN chmod +x /app/entrypoint.sh
+EXPOSE 9420
+ENTRYPOINT ["/app/entrypoint.sh"]
+CMD ["/app/callbacks","--config.file","/app/config.yml"]

ci/prod/compose/callbacks.yml

@@ -0,0 +1,88 @@
+# Compose v2 - Edge Callbacks
+
+x-common-env: &common-env
+  env_file:
+    - ../env/.env.runtime
+    - ../env/.env.version
+
+volumes:
+  callbacks-vault-run:
+    driver: local
+    driver_opts:
+      type: tmpfs
+      device: tmpfs
+      o: size=8m,uid=0,gid=0,mode=0700
+
+networks:
+  sendico-net:
+    external: true
+    name: sendico-net
+
+services:
+  sendico_callbacks:
+    <<: *common-env
+    container_name: sendico-callbacks
+    restart: unless-stopped
+    image: ${REGISTRY_URL}/edge/callbacks:${APP_V}
+    pull_policy: always
+    environment:
+      CALLBACKS_MONGO_HOST: ${CALLBACKS_MONGO_HOST}
+      CALLBACKS_MONGO_PORT: ${CALLBACKS_MONGO_PORT}
+      CALLBACKS_MONGO_DATABASE: ${CALLBACKS_MONGO_DATABASE}
+      CALLBACKS_MONGO_USER: ${CALLBACKS_MONGO_USER}
+      CALLBACKS_MONGO_PASSWORD: ${CALLBACKS_MONGO_PASSWORD}
+      CALLBACKS_MONGO_AUTH_SOURCE: ${CALLBACKS_MONGO_AUTH_SOURCE}
+      CALLBACKS_MONGO_REPLICA_SET: ${CALLBACKS_MONGO_REPLICA_SET}
+      NATS_URL: ${NATS_URL}
+      NATS_HOST: ${NATS_HOST}
+      NATS_PORT: ${NATS_PORT}
+      NATS_USER: ${NATS_USER}
+      NATS_PASSWORD: ${NATS_PASSWORD}
+      CALLBACKS_METRICS_PORT: ${CALLBACKS_METRICS_PORT}
+      VAULT_ADDR: ${VAULT_ADDR}
+      VAULT_TOKEN_FILE: /run/vault/token
+    command: ["--config.file", "/app/config.yml"]
+    ports:
+      - "0.0.0.0:${CALLBACKS_METRICS_PORT}:${CALLBACKS_METRICS_PORT}"
+    volumes:
+      - callbacks-vault-run:/run/vault:ro
+    depends_on:
+      sendico_callbacks_vault_agent:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL","wget -qO- http://localhost:${CALLBACKS_METRICS_PORT}/health | grep -q '\"status\":\"ok\"'"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+    networks:
+      - sendico-net
+
+  sendico_callbacks_vault_agent:
+    <<: *common-env
+    container_name: sendico-callbacks-vault-agent
+    restart: unless-stopped
+    image: hashicorp/vault:latest
+    pull_policy: always
+    cap_add: ["IPC_LOCK"]
+    environment:
+      VAULT_ADDR: ${VAULT_ADDR}
+      CALLBACKS_VAULT_ROLE_ID: ${CALLBACKS_VAULT_ROLE_ID}
+      CALLBACKS_VAULT_SECRET_ID: ${CALLBACKS_VAULT_SECRET_ID}
+    command: >
+      sh -lc 'set -euo pipefail; umask 077;
+              : "${CALLBACKS_VAULT_ROLE_ID:?}"; : "${CALLBACKS_VAULT_SECRET_ID:?}";
+              printf "%s" "$CALLBACKS_VAULT_ROLE_ID"   > /run/vault/role_id;
+              printf "%s" "$CALLBACKS_VAULT_SECRET_ID" > /run/vault/secret_id;
+              unset CALLBACKS_VAULT_ROLE_ID CALLBACKS_VAULT_SECRET_ID;
+              exec vault agent -config=/etc/vault/agent/callbacks.hcl'
+    volumes:
+      - ./vault-agent/callbacks.hcl:/etc/vault/agent/callbacks.hcl:ro
+      - callbacks-vault-run:/run/vault
+    healthcheck:
+      test: ["CMD","test","-s","/run/vault/token"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+    networks:
+      - sendico-net

ci/prod/compose/vault-agent/callbacks.hcl

@@ -0,0 +1,20 @@
+vault {
+  address = "https://vault.sendico.io"
+}
+
+auto_auth {
+  method "approle" {
+    mount_path = "auth/approle"
+    config = {
+      role_id_file_path    = "/run/vault/role_id"
+      secret_id_file_path  = "/run/vault/secret_id"
+    }
+  }
+
+  sink "file" {
+    config = {
+      path = "/run/vault/token"
+      mode = 0600
+    }
+  }
+}