Organize local infrastructure and Vault secrets by service ownership

infra/local/mongo/mongo-check.js

@@ -0,0 +1,32 @@
+// Run using a leased application identity, never the bootstrap administrator.
+if (db.hello().setName !== "rs0" || !db.hello().isWritablePrimary) {
+  throw new Error("replica set is not primary");
+}
+const own = db.getSiblingDB(database);
+const name = "local_check_" + new ObjectId().toHexString();
+const session = db.getMongo().startSession();
+try {
+  own.createCollection(name);
+  const collection = session.getDatabase(database).getCollection(name);
+  session.startTransaction();
+  collection.insertMany([{_id: "first"}, {_id: "second"}]);
+  session.commitTransaction();
+  if (own.getCollection(name).countDocuments({}) !== 2) throw new Error("commit failed");
+  session.startTransaction();
+  collection.deleteOne({_id: "first"});
+  collection.insertOne({_id: "aborted"});
+  session.abortTransaction();
+  if (own.getCollection(name).countDocuments({}) !== 2 ||
+      !own.getCollection(name).findOne({_id: "first"}) ||
+      own.getCollection(name).findOne({_id: "aborted"})) throw new Error("rollback failed");
+  let denied = false;
+  try {
+    const result = db.getSiblingDB(forbidden).runCommand({find: name, filter: {}});
+    denied = result.code === 13;
+  } catch (error) { denied = error.code === 13; }
+  if (!denied) throw new Error("cross-database access allowed");
+  print("scope-ok");
+} finally {
+  session.endSession();
+  own.getCollection(name).drop();
+}

infra/local/mongo/mongo-client.js

@@ -0,0 +1,9 @@
+// Public browser client: this identifier is not a client secret.
+db.getSiblingDB("sxchnge").clients.updateOne(
+  {clientId: "sxchnge-local-web"},
+  {$setOnInsert: {
+    clientName: "Local browser", allowedCIDRs: ["0.0.0.0/0", "::/0"],
+    allowedScopes: ["account"], redirectURIs: ["https://localhost:5126"],
+    grantTypes: ["password", "refresh_token"], tokenEndpointAuthMethod: "none", isRevoked: false
+  }}, {upsert: true}
+);

infra/local/mongo/start.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+set -eu
+cp /run/mongo/keyfile /tmp/mongo-keyfile
+chown mongodb:mongodb /tmp/mongo-keyfile
+chmod 400 /tmp/mongo-keyfile
+exec docker-entrypoint.sh "$@"