Organize local infrastructure and Vault secrets by service ownership

infra/local/vault/bff.hcl

@@ -0,0 +1,31 @@
+vault { address = "http://vault:8200" }
+auto_auth {
+  method "approle" {
+    config = {
+      role_id_file_path = "/etc/agent/role-id"
+      secret_id_file_path = "/etc/agent/secret-id"
+      remove_secret_id_file_after_reading = false
+    }
+  }
+}
+template_config {
+  static_secret_render_interval = "10s"
+  exit_on_retry_failure = true
+}
+
+
+env_template "SXCHNGE_JWT_SECRET" {
+  contents = "{{ with secret \"kv/data/services/bff/jwt\" }}{{ .Data.data.jwt }}{{ end }}"
+  error_on_missing_key = true
+}
+
+env_template "SXCHNGE_NOTIFICATIONS_TOKEN" {
+  contents = "{{ with secret \"kv/data/services/notifications/callers/bff\" }}{{ .Data.data.token }}{{ end }}"
+  error_on_missing_key = true
+}
+
+exec {
+  command = ["/usr/local/bin/start-service"]
+  restart_on_secret_changes = "always"
+  restart_stop_signal = "SIGTERM"
+}

infra/local/vault/nats.hcl

@@ -0,0 +1,25 @@
+vault { address = "http://vault:8200" }
+auto_auth {
+  method "approle" {
+    config = {
+      role_id_file_path = "/etc/agent/role-id"
+      secret_id_file_path = "/etc/agent/secret-id"
+      remove_secret_id_file_after_reading = false
+    }
+  }
+}
+template_config {
+  static_secret_render_interval = "10s"
+  exit_on_retry_failure = true
+}
+
+env_template "NATS_TOKEN" {
+  contents = "{{ with secret \"kv/data/infrastructure/nats/auth\" }}{{ .Data.data.token }}{{ end }}"
+  error_on_missing_key = true
+}
+
+exec {
+  command = ["/usr/local/bin/start-nats"]
+  restart_on_secret_changes = "always"
+  restart_stop_signal = "SIGTERM"
+}

infra/local/vault/notifications.hcl

@@ -0,0 +1,43 @@
+vault { address = "http://vault:8200" }
+auto_auth {
+  method "approle" {
+    config = {
+      role_id_file_path = "/etc/agent/role-id"
+      secret_id_file_path = "/etc/agent/secret-id"
+      remove_secret_id_file_after_reading = false
+    }
+  }
+}
+template_config {
+  static_secret_render_interval = "10s"
+  exit_on_retry_failure = true
+}
+
+
+env_template "SXCHNGE_NOTIFICATIONS_PRODUCT_TOKEN" {
+  contents = "{{ with secret \"kv/data/services/notifications/callers/bff\" }}{{ .Data.data.token }}{{ end }}"
+  error_on_missing_key = true
+}
+
+env_template "SXCHNGE_NATS_URL" {
+  contents = "{{ with secret \"kv/data/infrastructure/nats/auth\" }}nats://{{ .Data.data.token }}@nats:4222{{ end }}"
+  error_on_missing_key = true
+}
+
+
+
+env_template "EMAIL_API_KEY" {
+  contents = "{{ with secret \"kv/data/services/notifications/email/resend\" }}{{ .Data.data.api_key }}{{ end }}"
+  error_on_missing_key = true
+}
+
+env_template "EMAIL_CONFIG" {
+  contents = "{{ with secret \"kv/data/services/notifications/email/resend\" }}email:\n  driver: {{ .Data.data.driver | toJSON }}\n  settings:\n    api_key_env: EMAIL_API_KEY\n    sender_address: {{ .Data.data.sender_address | toJSON }}\n    sender_name: {{ .Data.data.sender_name | toJSON }}\n{{ end }}"
+  error_on_missing_key = true
+}
+
+exec {
+  command = ["/usr/local/bin/start-service"]
+  restart_on_secret_changes = "always"
+  restart_stop_signal = "SIGTERM"
+}

infra/local/vault/server.hcl

@@ -0,0 +1,10 @@
+ui = true
+disable_mlock = true
+storage "file" {
+  path = "/vault/file"
+}
+listener "tcp" {
+  address = "0.0.0.0:8200"
+  tls_disable = true
+}
+api_addr = "http://vault:8200"

infra/local/vault/start.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Local-only automatic unseal. The root token is never mounted in this container.
+set -eu
+export VAULT_ADDR=http://127.0.0.1:8200
+vault server -config=/etc/vault/server.hcl &
+pid=$!
+trap 'kill -TERM "$pid"; wait "$pid"' TERM INT
+until [ -s /bootstrap/unseal ]; do
+    kill -0 "$pid" || exit 1
+    sleep 1
+done
+until vault operator unseal "$(cat /bootstrap/unseal)" >/dev/null 2>&1; do
+    kill -0 "$pid" || exit 1
+    sleep 1
+done
+wait "$pid"