bff for callbacks

ci/dev/README.md

@@ -65,7 +65,7 @@ Examples:
 
 Infrastructure (MongoDB, NATS) uses plain `.env.dev` credentials.
 
-Callbacks, Chain, and TRON run Vault Agent sidecars with AppRole.
+Callbacks, BFF, Chain, and TRON run Vault Agent sidecars with AppRole.
 Set the corresponding `*_VAULT_ROLE_ID` and `*_VAULT_SECRET_ID` values in `.env.dev`.
 
 ## Network

ci/dev/vault-agent/bff.hcl

@@ -0,0 +1,21 @@
+vault {
+  address = "http://dev-vault:8200"
+}
+
+auto_auth {
+  method "approle" {
+    mount_path = "auth/approle"
+    config = {
+      role_id_file_path    = "/run/vault/role_id"
+      secret_id_file_path  = "/run/vault/secret_id"
+    }
+  }
+
+  sink "file" {
+    config = {
+      path = "/run/vault/token"
+      mode = 0600
+    }
+  }
+}
+

ci/prod/.env.runtime

@@ -181,6 +181,7 @@ BFF_DIR=bff
 BFF_COMPOSE_PROJECT=sendico-bff
 BFF_SERVICE_NAME=sendico_bff
 BFF_HTTP_PORT=8080
+BFF_VAULT_SECRET_PATH=sendico/edge/bff/vault
 
 # Callbacks service
 CALLBACKS_DIR=callbacks

ci/prod/compose/bff.yml

@@ -5,6 +5,14 @@ x-common-env: &common-env
     - ../env/.env.runtime
     - ../env/.env.version
 
+volumes:
+  bff-vault-run:
+    driver: local
+    driver_opts:
+      type: tmpfs
+      device: tmpfs
+      o: size=8m,uid=0,gid=0,mode=0700
+
 networks:
   sendico-net:
     external: true
@@ -51,8 +59,15 @@ services:
       PERMISSION_COLLECTION: ${PERMISSION_COLLECTION}
       PERMISSION_TIMEOUT: ${PERMISSION_TIMEOUT}
       PERMISSION_IS_FILTERED: ${PERMISSION_IS_FILTERED}
+      VAULT_ADDR: ${VAULT_ADDR}
+      VAULT_TOKEN_FILE: /run/vault/token
     ports:
       - "0.0.0.0:${BFF_HTTP_PORT}:8081"
+    volumes:
+      - bff-vault-run:/run/vault:ro
+    depends_on:
+      sendico_bff_vault_agent:
+        condition: service_healthy
     healthcheck:
       test: ["CMD-SHELL","wget -qO- http://localhost:8081/api/v1/health | grep -q '\"status\":\"ok\"'"]
       interval: 30s
@@ -61,3 +76,32 @@ services:
       start_period: 60s
     networks:
       - sendico-net
+
+  sendico_bff_vault_agent:
+    <<: *common-env
+    container_name: sendico-bff-vault-agent
+    restart: unless-stopped
+    image: hashicorp/vault:latest
+    pull_policy: always
+    cap_add: ["IPC_LOCK"]
+    environment:
+      VAULT_ADDR: ${VAULT_ADDR}
+      BFF_VAULT_ROLE_ID: ${BFF_VAULT_ROLE_ID}
+      BFF_VAULT_SECRET_ID: ${BFF_VAULT_SECRET_ID}
+    command: >
+      sh -lc 'set -euo pipefail; umask 077;
+              : "${BFF_VAULT_ROLE_ID:?}"; : "${BFF_VAULT_SECRET_ID:?}";
+              printf "%s" "$BFF_VAULT_ROLE_ID"   > /run/vault/role_id;
+              printf "%s" "$BFF_VAULT_SECRET_ID" > /run/vault/secret_id;
+              unset BFF_VAULT_ROLE_ID BFF_VAULT_SECRET_ID;
+              exec vault agent -config=/etc/vault/agent/bff.hcl'
+    volumes:
+      - ./vault-agent/bff.hcl:/etc/vault/agent/bff.hcl:ro
+      - bff-vault-run:/run/vault
+    healthcheck:
+      test: ["CMD","test","-s","/run/vault/token"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+    networks:
+      - sendico-net

ci/prod/compose/vault-agent/bff.hcl

@@ -0,0 +1,21 @@
+vault {
+  address = "https://vault.sendico.io"
+}
+
+auto_auth {
+  method "approle" {
+    mount_path = "auth/approle"
+    config = {
+      role_id_file_path    = "/run/vault/role_id"
+      secret_id_file_path  = "/run/vault/secret_id"
+    }
+  }
+
+  sink "file" {
+    config = {
+      path = "/run/vault/token"
+      mode = 0600
+    }
+  }
+}
+

ci/prod/scripts/deploy/bff.sh

@@ -19,6 +19,8 @@ REQUIRED_SECRETS=(
   MONGO_USER
   MONGO_PASSWORD
   API_ENDPOINT_SECRET
+  BFF_VAULT_ROLE_ID
+  BFF_VAULT_SECRET_ID
   NATS_USER
   NATS_PASSWORD
   NATS_URL
@@ -43,6 +45,8 @@ b64enc() {
 MONGO_USER_B64="$(b64enc "${MONGO_USER}")"
 MONGO_PASSWORD_B64="$(b64enc "${MONGO_PASSWORD}")"
 API_ENDPOINT_SECRET_B64="$(b64enc "${API_ENDPOINT_SECRET}")"
+BFF_VAULT_ROLE_ID_B64="$(b64enc "${BFF_VAULT_ROLE_ID}")"
+BFF_VAULT_SECRET_ID_B64="$(b64enc "${BFF_VAULT_SECRET_ID}")"
 NATS_USER_B64="$(b64enc "${NATS_USER}")"
 NATS_PASSWORD_B64="$(b64enc "${NATS_PASSWORD}")"
 NATS_URL_B64="$(b64enc "${NATS_URL}")"
@@ -77,6 +81,8 @@ ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" \
   MONGO_USER_B64="$MONGO_USER_B64" \
   MONGO_PASSWORD_B64="$MONGO_PASSWORD_B64" \
   API_ENDPOINT_SECRET_B64="$API_ENDPOINT_SECRET_B64" \
+  BFF_VAULT_ROLE_ID_B64="$BFF_VAULT_ROLE_ID_B64" \
+  BFF_VAULT_SECRET_ID_B64="$BFF_VAULT_SECRET_ID_B64" \
   NATS_USER_B64="$NATS_USER_B64" \
   NATS_PASSWORD_B64="$NATS_PASSWORD_B64" \
   NATS_URL_B64="$NATS_URL_B64" \
@@ -124,11 +130,14 @@ decode_b64() {
 MONGO_USER="$(decode_b64 "$MONGO_USER_B64")"
 MONGO_PASSWORD="$(decode_b64 "$MONGO_PASSWORD_B64")"
 API_ENDPOINT_SECRET="$(decode_b64 "$API_ENDPOINT_SECRET_B64")"
+BFF_VAULT_ROLE_ID="$(decode_b64 "$BFF_VAULT_ROLE_ID_B64")"
+BFF_VAULT_SECRET_ID="$(decode_b64 "$BFF_VAULT_SECRET_ID_B64")"
 NATS_USER="$(decode_b64 "$NATS_USER_B64")"
 NATS_PASSWORD="$(decode_b64 "$NATS_PASSWORD_B64")"
 NATS_URL="$(decode_b64 "$NATS_URL_B64")"
 
 export MONGO_USER MONGO_PASSWORD API_ENDPOINT_SECRET
+export BFF_VAULT_ROLE_ID BFF_VAULT_SECRET_ID
 export NATS_USER NATS_PASSWORD NATS_URL
 COMPOSE_PROJECT_NAME="$COMPOSE_PROJECT"
 export COMPOSE_PROJECT_NAME

ci/scripts/bff/deploy.sh

@@ -50,11 +50,18 @@ load_env_file ./.env.version
 
 BFF_MONGO_SECRET_PATH="${BFF_MONGO_SECRET_PATH:?missing BFF_MONGO_SECRET_PATH}"
 BFF_API_SECRET_PATH="${BFF_API_SECRET_PATH:?missing BFF_API_SECRET_PATH}"
+BFF_VAULT_SECRET_PATH="${BFF_VAULT_SECRET_PATH:?missing BFF_VAULT_SECRET_PATH}"
 
 export MONGO_USER="$(./ci/vlt kv_get kv "${BFF_MONGO_SECRET_PATH}" user)"
 export MONGO_PASSWORD="$(./ci/vlt kv_get kv "${BFF_MONGO_SECRET_PATH}" password)"
 
 export API_ENDPOINT_SECRET="$(./ci/vlt kv_get kv "${BFF_API_SECRET_PATH}" secret)"
+export BFF_VAULT_ROLE_ID="$(./ci/vlt kv_get kv "${BFF_VAULT_SECRET_PATH}" role_id)"
+export BFF_VAULT_SECRET_ID="$(./ci/vlt kv_get kv "${BFF_VAULT_SECRET_PATH}" secret_id)"
+if [ -z "${BFF_VAULT_ROLE_ID}" ] || [ -z "${BFF_VAULT_SECRET_ID}" ]; then
+  echo "[bff-deploy] vault approle creds are empty for path ${BFF_VAULT_SECRET_PATH}" >&2
+  exit 1
+fi
 
 load_nats_env