Build local product stack with Vault-managed secrets (#42)

dev/agents.py

@@ -0,0 +1,43 @@
+"""Build per-service Vault Agent configs (no secret values in configs)."""
+import json
+from pathlib import Path
+
+BASE = (Path(__file__).parent / 'vault' / 'agent.hcl').read_text()
+
+
+def kv(path, field):
+    return '{{ with secret "kv/data/' + path + '" }}{{ .Data.data.' + field + ' }}{{ end }}'
+
+
+def config(service):
+    env = {}
+    if service == 'nats':
+        env['NATS_TOKEN'] = kv('nats', 'token')
+    else:
+        database = 'sxchnge' if service == 'bff' else 'sxchnge_notifications'
+        env['SXCHNGE_MONGO_URI'] = ('{{ with secret "database/creds/' + service + '" }}'
+            'mongodb://{{ .Data.username | urlquery }}:{{ .Data.password | urlquery }}'
+            '@mongo:27017/' + database + '?authSource=admin&replicaSet=rs0{{ end }}')
+        env['TLS_CA'] = kv('tls', 'ca')
+        if service == 'bff':
+            env['SXCHNGE_JWT_SECRET'] = kv('bff', 'jwt')
+            env['SXCHNGE_NOTIFICATIONS_TOKEN'] = kv('caller', 'token')
+        else:
+            env['SXCHNGE_NOTIFICATIONS_PRODUCT_TOKEN'] = kv('caller', 'token')
+            env['SXCHNGE_NATS_URL'] = ('{{ with secret "kv/data/nats" }}'
+                'nats://{{ .Data.data.token }}@nats:4222{{ end }}')
+            env['TLS_CERT'] = kv('notifications-tls', 'certificate')
+            env['TLS_KEY'] = kv('notifications-tls', 'private_key')
+            env['EMAIL_API_KEY'] = kv('email', 'api_key')
+            # JSON is valid YAML and escapes arbitrary provider configuration.
+            env['EMAIL_CONFIG'] = ('{{ with secret "kv/data/email" }}'
+                'email:\n  driver: {{ .Data.data.driver | toJSON }}\n'
+                '  settings:\n    api_key_env: EMAIL_API_KEY\n'
+                '    sender_address: {{ .Data.data.sender_address | toJSON }}\n'
+                '    sender_name: {{ .Data.data.sender_name | toJSON }}\n{{ end }}')
+    result = BASE
+    for name, template in env.items():
+        result += '\nenv_template ' + json.dumps(name) + ' {\n  contents = ' + json.dumps(template) + '\n  error_on_missing_key = true\n}\n'
+    command = '/usr/local/bin/start-nats' if service == 'nats' else '/usr/local/bin/start-service'
+    result += '\nexec {\n  command = [' + json.dumps(command) + ']\n  restart_on_secret_changes = "always"\n  restart_stop_signal = "SIGTERM"\n}\n'
+    return result