Build local product stack with Vault-managed secrets (#42)

dev/config/bff.yml

@@ -0,0 +1,39 @@
+# SXCHNGE-owned Mongo database and JWT key. Never point these at Sendico.
+http_server:
+  listen_address: 0.0.0.0:8082
+  read_header_timeout: 5
+  shutdown_timeout: 10
+database:
+  driver: mongodb
+  settings:
+    uri_env: SXCHNGE_MONGO_URI
+    database: sxchnge
+api:
+  middleware:
+    domain_env: SXCHNGE_DOMAIN
+    api_endpoint_env: SXCHNGE_API_ENDPOINT
+    api_protocol_env: SXCHNGE_API_PROTOCOL
+    signature:
+      algorithm: HS256
+      secret_key_env: SXCHNGE_JWT_SECRET
+    CORS:
+      allowed_origins: ["https://localhost:5126"]
+      allowed_methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"]
+      allowed_headers: ["Content-Type", "Authorization", "X-Auth-Transport", "X-CSRF-Protection"]
+      allow_credentials: true
+      max_age: 300
+    token:
+      expiration_hours:
+        account: 1
+        refresh: 720
+      length: 32
+    password:
+      token_length: 32
+      check:
+        min_length: 12
+  notifications:
+    address: notifications:8083
+    token_env: SXCHNGE_NOTIFICATIONS_TOKEN
+    ca_file: /run/sxchnge/ca.pem
+    server_name: notifications
+    activation_url: https://localhost:5126/verify-email

dev/config/nginx.conf

@@ -0,0 +1,17 @@
+server {
+    listen 8443 ssl;
+    ssl_certificate /etc/tls/server.crt;
+    ssl_certificate_key /etc/tls/server.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    root /usr/share/nginx/html;
+    index index.html;
+    location /api/ {
+        resolver 127.0.0.11 valid=10s ipv6=off;
+        set $bff http://bff:8082;
+        proxy_pass $bff;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-For $remote_addr;
+    }
+    location / { try_files $uri $uri/ /index.html; }
+}

dev/config/notifications.yml

@@ -0,0 +1,27 @@
+listen: "0.0.0.0:8083"
+tls_cert: "/run/sxchnge/server.crt"
+tls_key: "/run/sxchnge/server.key"
+database:
+  driver: mongodb
+  settings:
+    uri_env: SXCHNGE_MONGO_URI
+    database: sxchnge_notifications
+messaging:
+  driver: NATS
+  settings:
+    url_env: SXCHNGE_NATS_URL
+    broker_name: sxchnge-notifications
+    max_reconnects: -1
+    reconnect_wait: 2
+templates: "/etc/sxchnge/templates.json"
+callers:
+  product: "SXCHNGE_NOTIFICATIONS_PRODUCT_TOKEN"
+# Use replicas: 3 and environment: production for a three-node NATS cluster.
+# mode: ops validates resources without modifying them; app provisions them.
+queue:
+  stream:
+    replicas: 1
+    max_age_hours: 48
+  provisioning:
+    mode: app
+    environment: non-production