callbacks service draft

docker-compose.dev.yml

@@ -29,6 +29,12 @@ volumes:
       type: tmpfs
       device: tmpfs
       o: size=8m,uid=0,gid=0,mode=0700
+  dev-callbacks-vault-run:
+    driver: local
+    driver_opts:
+      type: tmpfs
+      device: tmpfs
+      o: size=8m,uid=0,gid=0,mode=0700
 
 # ============================================================================
 # INFRASTRUCTURE SERVICES
@@ -843,6 +849,80 @@ services:
       MONGO_AUTH_SOURCE: admin
       MONGO_REPLICA_SET: dev-rs
 
+  # --------------------------------------------------------------------------
+  # Callbacks Vault Agent (sidecar for AppRole authentication)
+  # --------------------------------------------------------------------------
+  dev-callbacks-vault-agent:
+    <<: *common-env
+    image: hashicorp/vault:latest
+    container_name: dev-callbacks-vault-agent
+    restart: unless-stopped
+    cap_add: ["IPC_LOCK"]
+    environment:
+      VAULT_ADDR: ${VAULT_ADDR}
+      CALLBACKS_VAULT_ROLE_ID: ${CALLBACKS_VAULT_ROLE_ID}
+      CALLBACKS_VAULT_SECRET_ID: ${CALLBACKS_VAULT_SECRET_ID}
+    command: >
+      sh -c 'set -eu; umask 077;
+             : "$$CALLBACKS_VAULT_ROLE_ID"; : "$$CALLBACKS_VAULT_SECRET_ID";
+             echo "$$CALLBACKS_VAULT_ROLE_ID" > /run/vault/role_id;
+             echo "$$CALLBACKS_VAULT_SECRET_ID" > /run/vault/secret_id;
+             unset CALLBACKS_VAULT_ROLE_ID CALLBACKS_VAULT_SECRET_ID;
+             exec vault agent -config=/etc/vault/agent/callbacks.hcl'
+    volumes:
+      - ./ci/dev/vault-agent/callbacks.hcl:/etc/vault/agent/callbacks.hcl:ro
+      - dev-callbacks-vault-run:/run/vault
+    depends_on:
+      dev-vault: { condition: service_healthy }
+    healthcheck:
+      test: ["CMD", "test", "-s", "/run/vault/token"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+    networks:
+      - sendico-dev
+
+  # --------------------------------------------------------------------------
+  # Callbacks Service
+  # --------------------------------------------------------------------------
+  dev-callbacks:
+    <<: *common-env
+    build:
+      context: .
+      dockerfile: ci/dev/callbacks.dockerfile
+    image: sendico-dev/callbacks:latest
+    container_name: dev-callbacks
+    restart: unless-stopped
+    depends_on:
+      dev-mongo-init: { condition: service_completed_successfully }
+      dev-nats: { condition: service_started }
+      dev-vault: { condition: service_healthy }
+      dev-callbacks-vault-agent: { condition: service_healthy }
+    volumes:
+      - ./api/edge/callbacks:/src/api/edge/callbacks
+      - ./api/edge/callbacks/config.dev.yml:/app/config.yml:ro
+      - dev-callbacks-vault-run:/run/vault:ro
+    ports:
+      - "9420:9420"
+    networks:
+      - sendico-dev
+    environment:
+      CALLBACKS_MONGO_HOST: dev-mongo-1
+      CALLBACKS_MONGO_PORT: 27017
+      CALLBACKS_MONGO_DATABASE: callbacks
+      CALLBACKS_MONGO_USER: ${MONGO_USER}
+      CALLBACKS_MONGO_PASSWORD: ${MONGO_PASSWORD}
+      CALLBACKS_MONGO_AUTH_SOURCE: admin
+      CALLBACKS_MONGO_REPLICA_SET: dev-rs
+      NATS_HOST: dev-nats
+      NATS_PORT: 4222
+      NATS_USER: ${NATS_USER}
+      NATS_PASSWORD: ${NATS_PASSWORD}
+      NATS_URL: nats://${NATS_USER}:${NATS_PASSWORD}@dev-nats:4222
+      CALLBACKS_METRICS_PORT: 9420
+      VAULT_ADDR: ${VAULT_ADDR}
+      VAULT_TOKEN_FILE: /run/vault/token
+
   # --------------------------------------------------------------------------
   # BFF (Backend for Frontend / Server) Service
   # --------------------------------------------------------------------------