Organize local infrastructure and Vault secrets by service ownership

infra/local/vault/notifications.hcl

@@ -0,0 +1,43 @@
+vault { address = "http://vault:8200" }
+auto_auth {
+  method "approle" {
+    config = {
+      role_id_file_path = "/etc/agent/role-id"
+      secret_id_file_path = "/etc/agent/secret-id"
+      remove_secret_id_file_after_reading = false
+    }
+  }
+}
+template_config {
+  static_secret_render_interval = "10s"
+  exit_on_retry_failure = true
+}
+
+
+env_template "SXCHNGE_NOTIFICATIONS_PRODUCT_TOKEN" {
+  contents = "{{ with secret \"kv/data/services/notifications/callers/bff\" }}{{ .Data.data.token }}{{ end }}"
+  error_on_missing_key = true
+}
+
+env_template "SXCHNGE_NATS_URL" {
+  contents = "{{ with secret \"kv/data/infrastructure/nats/auth\" }}nats://{{ .Data.data.token }}@nats:4222{{ end }}"
+  error_on_missing_key = true
+}
+
+
+
+env_template "EMAIL_API_KEY" {
+  contents = "{{ with secret \"kv/data/services/notifications/email/resend\" }}{{ .Data.data.api_key }}{{ end }}"
+  error_on_missing_key = true
+}
+
+env_template "EMAIL_CONFIG" {
+  contents = "{{ with secret \"kv/data/services/notifications/email/resend\" }}email:\n  driver: {{ .Data.data.driver | toJSON }}\n  settings:\n    api_key_env: EMAIL_API_KEY\n    sender_address: {{ .Data.data.sender_address | toJSON }}\n    sender_name: {{ .Data.data.sender_name | toJSON }}\n{{ end }}"
+  error_on_missing_key = true
+}
+
+exec {
+  command = ["/usr/local/bin/start-service"]
+  restart_on_secret_changes = "always"
+  restart_stop_signal = "SIGTERM"
+}