bff for callbacks

docker-compose.dev.yml

@@ -35,6 +35,12 @@ volumes:
       type: tmpfs
       device: tmpfs
       o: size=8m,uid=0,gid=0,mode=0700
+  dev-bff-vault-run:
+    driver: local
+    driver_opts:
+      type: tmpfs
+      device: tmpfs
+      o: size=8m,uid=0,gid=0,mode=0700
 
 # ============================================================================
 # INFRASTRUCTURE SERVICES
@@ -923,6 +929,39 @@ services:
       VAULT_ADDR: ${VAULT_ADDR}
       VAULT_TOKEN_FILE: /run/vault/token
 
+  # --------------------------------------------------------------------------
+  # BFF Vault Agent (sidecar for AppRole authentication)
+  # --------------------------------------------------------------------------
+  dev-bff-vault-agent:
+    <<: *common-env
+    image: hashicorp/vault:latest
+    container_name: dev-bff-vault-agent
+    restart: unless-stopped
+    cap_add: ["IPC_LOCK"]
+    environment:
+      VAULT_ADDR: ${VAULT_ADDR}
+      BFF_VAULT_ROLE_ID: ${BFF_VAULT_ROLE_ID}
+      BFF_VAULT_SECRET_ID: ${BFF_VAULT_SECRET_ID}
+    command: >
+      sh -c 'set -eu; umask 077;
+             : "$$BFF_VAULT_ROLE_ID"; : "$$BFF_VAULT_SECRET_ID";
+             echo "$$BFF_VAULT_ROLE_ID" > /run/vault/role_id;
+             echo "$$BFF_VAULT_SECRET_ID" > /run/vault/secret_id;
+             unset BFF_VAULT_ROLE_ID BFF_VAULT_SECRET_ID;
+             exec vault agent -config=/etc/vault/agent/bff.hcl'
+    volumes:
+      - ./ci/dev/vault-agent/bff.hcl:/etc/vault/agent/bff.hcl:ro
+      - dev-bff-vault-run:/run/vault
+    depends_on:
+      dev-vault: { condition: service_healthy }
+    healthcheck:
+      test: ["CMD", "test", "-s", "/run/vault/token"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+    networks:
+      - sendico-dev
+
   # --------------------------------------------------------------------------
   # BFF (Backend for Frontend / Server) Service
   # --------------------------------------------------------------------------
@@ -942,9 +981,11 @@ services:
       dev-payments-quotation: { condition: service_started }
       dev-payments-methods: { condition: service_started }
       dev-chain-gateway: { condition: service_started }
+      dev-bff-vault-agent: { condition: service_healthy }
     volumes:
       - ./api/edge/bff:/src/api/edge/bff
       - ./api/edge/bff/config.dev.yml:/app/config.yml:ro
+      - dev-bff-vault-run:/run/vault:ro
     ports:
       - "8080:8080"
     networks:
@@ -977,6 +1018,8 @@ services:
       API_PROTOCOL: http
       SERVICE_HOST: localhost
       API_ENDPOINT: /api/v1
+      VAULT_ADDR: ${VAULT_ADDR}
+      VAULT_TOKEN_FILE: /run/vault/token
 
   # --------------------------------------------------------------------------
   # Frontend (Flutter Web)