Run local infrastructure and product images with Vault-managed secrets #43

2026-09-12T19:05:03Z

tech commented

2026-09-12 19:05:03 +00:00

Closes #42.

make build && make up builds the latest stable, digest-pinned Vault, Mongo replica set, NATS, notifications, BFF and Caddy-served frontend. Make and containerized shell own orchestration; infrastructure lives under infra/, without Python.

Vault holds service JWT/email secrets and infrastructure NATS/Mongo bootstrap secrets. Driver and sender settings live in runtime YAML. Bootstrap safely migrates legacy entries, archives readable history privately, and retires obsolete TLS and caller-token KV paths. Agent policies use exact required paths. Mongo application credentials come from the database plugin; replacement pools drain operations and transactions without periodic service restarts.

Caddy owns browser HTTPS, static files, SPA fallback and API proxying. BFF-to-notifications uses plaintext gRPC without caller authentication on the trusted private network. The existing product notification namespace preserves receipts and idempotency. NATS authentication stays enabled. Optional explicit gRPC TLS remains available. Existing unused PKI history is retained; new bootstrap does not provision it.

Validation passed on the final change: make build, make test, make lint-backend, make test-dev-tooling, make test-dev-infra and diff checks. Tests cover Send/Get and idempotent replay without credentials, absence of bearer metadata, and repeatable secret retirement preserving NATS authentication. Live Vault has no obsolete caller entries and service policies deny those paths. Earlier rotation validation exercised three replacements with unchanged BFF PID and 1,083 expected responses with zero failures; isolated fresh bootstrap and Caddy static/SPA/API checks also passed.

make up applied the final migration and intentionally stopped at the missing Resend API key. Set the key using make email or kv/services/notifications/email/resend, configure the verified sender in infra/local/notifications/runtime.yml, then rebuild/start. No email was sent; full product readiness is not claimed. Mongo is a single-node replica set without HA. Trust Caddy's exported .local/dev/ca.pem for browser HTTPS. Earlier supplementary tagged-test limitations remain recorded in docs/implementation.md. No optional security scan or merge.

See docs/local-development.md, infra/README.md, and docs/implementation.md. Latest commit: ce6583f.

Startup completion message (ce6583f): make up now ends with a Sendico-style success heading, frontend/API/health/Vault URLs, a public CA trust reminder, and make ps, make logs, and make down. It appears only after service health checks and CA export succeed, and prints no credentials. make test-dev-tooling, git diff --check, and a containerized shell smoke check passed; the smoke check previewed success and verified nonzero exits with no success message after simulated startup/CA export failures. UX review covered readable labels, actionable next steps and confirmed-success timing, reusing command exit status and Compose diagnostics without new analytics. Live startup was not rerun for this message-only change. The user's local sender configuration remains uncommitted and unchanged. Details: docs/local-development.md.

Closes #42. `make build && make up` builds the latest stable, digest-pinned Vault, Mongo replica set, NATS, notifications, BFF and Caddy-served frontend. Make and containerized shell own orchestration; infrastructure lives under `infra/`, without Python. Vault holds service JWT/email secrets and infrastructure NATS/Mongo bootstrap secrets. Driver and sender settings live in runtime YAML. Bootstrap safely migrates legacy entries, archives readable history privately, and retires obsolete TLS and caller-token KV paths. Agent policies use exact required paths. Mongo application credentials come from the database plugin; replacement pools drain operations and transactions without periodic service restarts. Caddy owns browser HTTPS, static files, SPA fallback and API proxying. BFF-to-notifications uses plaintext gRPC without caller authentication on the trusted private network. The existing product notification namespace preserves receipts and idempotency. NATS authentication stays enabled. Optional explicit gRPC TLS remains available. Existing unused PKI history is retained; new bootstrap does not provision it. Validation passed on the final change: `make build`, `make test`, `make lint-backend`, `make test-dev-tooling`, `make test-dev-infra` and diff checks. Tests cover Send/Get and idempotent replay without credentials, absence of bearer metadata, and repeatable secret retirement preserving NATS authentication. Live Vault has no obsolete caller entries and service policies deny those paths. Earlier rotation validation exercised three replacements with unchanged BFF PID and 1,083 expected responses with zero failures; isolated fresh bootstrap and Caddy static/SPA/API checks also passed. `make up` applied the final migration and intentionally stopped at the missing Resend API key. Set the key using `make email` or `kv/services/notifications/email/resend`, configure the verified sender in `infra/local/notifications/runtime.yml`, then rebuild/start. No email was sent; full product readiness is not claimed. Mongo is a single-node replica set without HA. Trust Caddy's exported `.local/dev/ca.pem` for browser HTTPS. Earlier supplementary tagged-test limitations remain recorded in `docs/implementation.md`. No optional security scan or merge. See `docs/local-development.md`, `infra/README.md`, and `docs/implementation.md`. Latest commit: ce6583f. Startup completion message (ce6583f): `make up` now ends with a Sendico-style success heading, frontend/API/health/Vault URLs, a public CA trust reminder, and `make ps`, `make logs`, and `make down`. It appears only after service health checks and CA export succeed, and prints no credentials. `make test-dev-tooling`, `git diff --check`, and a containerized shell smoke check passed; the smoke check previewed success and verified nonzero exits with no success message after simulated startup/CA export failures. UX review covered readable labels, actionable next steps and confirmed-success timing, reusing command exit status and Compose diagnostics without new analytics. Live startup was not rerun for this message-only change. The user's local sender configuration remains uncommitted and unchanged. Details: docs/local-development.md.

tech added the backend frontend labels 2026-09-12 19:05:03 +00:00

tech added 1 commit 2026-09-12 19:05:04 +00:00

Build local product stack with Vault-managed secrets (#42 ) 184a3be413

tech referenced this pull request

2026-09-12 19:05:39 +00:00

Run the local product stack with Vault-managed secrets #42

tech added 1 commit 2026-09-12 19:05:45 +00:00

Record local environment delivery PR (#42 ) 80d6917aa7

tech added 1 commit 2026-09-12 20:19:39 +00:00

Keep Mongo operations online across Vault credential rotation 23f7b78c3b

tech added 1 commit 2026-09-12 21:14:37 +00:00

Replace Python development tooling with Make and containerized shell 1b8800ee73