44 lines
2.2 KiB
Python
44 lines
2.2 KiB
Python
"""Build per-service Vault Agent configs (no secret values in configs)."""
|
|
import json
|
|
from pathlib import Path
|
|
|
|
BASE = (Path(__file__).parent / 'vault' / 'agent.hcl').read_text()
|
|
|
|
|
|
def kv(path, field):
|
|
return '{{ with secret "kv/data/' + path + '" }}{{ .Data.data.' + field + ' }}{{ end }}'
|
|
|
|
|
|
def config(service):
|
|
env = {}
|
|
if service == 'nats':
|
|
env['NATS_TOKEN'] = kv('nats', 'token')
|
|
else:
|
|
database = 'sxchnge' if service == 'bff' else 'sxchnge_notifications'
|
|
env['SXCHNGE_MONGO_URI'] = ('{{ with secret "database/creds/' + service + '" }}'
|
|
'mongodb://{{ .Data.username | urlquery }}:{{ .Data.password | urlquery }}'
|
|
'@mongo:27017/' + database + '?authSource=admin&replicaSet=rs0{{ end }}')
|
|
env['TLS_CA'] = kv('tls', 'ca')
|
|
if service == 'bff':
|
|
env['SXCHNGE_JWT_SECRET'] = kv('bff', 'jwt')
|
|
env['SXCHNGE_NOTIFICATIONS_TOKEN'] = kv('caller', 'token')
|
|
else:
|
|
env['SXCHNGE_NOTIFICATIONS_PRODUCT_TOKEN'] = kv('caller', 'token')
|
|
env['SXCHNGE_NATS_URL'] = ('{{ with secret "kv/data/nats" }}'
|
|
'nats://{{ .Data.data.token }}@nats:4222{{ end }}')
|
|
env['TLS_CERT'] = kv('notifications-tls', 'certificate')
|
|
env['TLS_KEY'] = kv('notifications-tls', 'private_key')
|
|
env['EMAIL_API_KEY'] = kv('email', 'api_key')
|
|
# JSON is valid YAML and escapes arbitrary provider configuration.
|
|
env['EMAIL_CONFIG'] = ('{{ with secret "kv/data/email" }}'
|
|
'email:\n driver: {{ .Data.data.driver | toJSON }}\n'
|
|
' settings:\n api_key_env: EMAIL_API_KEY\n'
|
|
' sender_address: {{ .Data.data.sender_address | toJSON }}\n'
|
|
' sender_name: {{ .Data.data.sender_name | toJSON }}\n{{ end }}')
|
|
result = BASE
|
|
for name, template in env.items():
|
|
result += '\nenv_template ' + json.dumps(name) + ' {\n contents = ' + json.dumps(template) + '\n error_on_missing_key = true\n}\n'
|
|
command = '/usr/local/bin/start-nats' if service == 'nats' else '/usr/local/bin/start-service'
|
|
result += '\nexec {\n command = [' + json.dumps(command) + ']\n restart_on_secret_changes = "always"\n restart_stop_signal = "SIGTERM"\n}\n'
|
|
return result
|