Merge branch 'main' into FORMS-2190-admin-responsiveness

Author: RyanBirtch-aot

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-ARG VARIANT="20.18.2-bookworm"
+ARG VARIANT="20.18.3-bookworm"
 FROM node:${VARIANT}
 
 # Install some extras such as vim for interactive rebases. Also some

.devcontainer/README.md

@@ -1,116 +1,6 @@
 # CHEFS Development with Dev Container
 
-The following guide will get you up and running and developing/debugging CHEFS as quickly as possible.
-We provide a [`devcontainer`](https://containers.dev) and will use [`VS Code`](https://code.visualstudio.com) to illustrate.
+Please refer to the online [CHEFS Techdocs](https://developer.gov.bc.ca/docs/default/component/chefs-techdocs/):
 
-By no means is CHEFS development limited to these tools; they are merely examples.
-
-## Caveats
-
-The primary use case for this `devcontainer` is for developing, debugging and unit testing CHEFS source code.
-
-There are limitations running this devcontainer, such as all networking is within this container. This container has [docker-in-docker](https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/docker-in-docker.md) which allows running demos, building docker images, running `docker compose` all within this container.
-
-## Files
-
-The `.devcontainer` folder contains the `devcontainer.json` file which defines this container. We are using a `Dockerfile` and `post-install.sh` to build and configure the container run image. The `Dockerfile` is simple but in place for simplifying image enhancements. The `post-install.sh` will install the required node libraries for CHEFS including the frontend and formio components.
-
-In order to run CHEFS you require Postgresql (seeded) and the CHEFS backend/API and frontend/UX - optionally you will use a [NATS](https://nats.io/) server for event streaming. Previously, this was a series of downloads and configuration updates and numerous commands to run. See `.devcontainer/chefs_local` files.
-
-**NODE_CONFIG_DIR** to simplify loading a default configuration to the CHEFS infrastructure (Postgresql, etc), we set an environment variable [`NODE_CONFIG_DIR`](https://github.com/node-config/node-config/wiki/Environment-Variables#node_config_dir). This supercedes the files found under `app/config`. Running node apps and commands (ex. knex, launch configurations) will use this environment variable and load configuration from `.devcontainer/chefs_local`.
-
-Also included are convenient launch tasks to run and debug CHEFS.
-
-## Open CHEFS in the devcontainer
-
-To open CHEFS in a devcontainer, we open the _root_ of this repository. We can open in 2 ways:
-
-1. Open Visual Studio Code, and use the Command Palette and use `Dev Containers: Open Folder in Container...`
-2. Open Visual Studio Code and `File|Open Folder...`, you should be prompted to `Reopen in Container`.
-
-## Running CHEFS locally
-
-Postgresql will be launched using docker compose. These will run inside of the devcontainer (docker-in-docker) but the ports are forwarded to the host machine and are accessible on the local host.
-
-CHEFS API and Frontend are running as node applications on the devcontainer - again, ports are forwarded to the host.
-
-### Configuring CHEFS locally
-
-When the devcontainer is built, it copies `.devcontainer/chefs_local/local.sample.json` to `.devcontainer/chefs_local/local.json`. This copy is not checked in and allows the developer to make changes and tweaks without impacting other developers or accidentially committing passwords.
-
-### Authorization Prerequisites
-
-1.  An IDIR account is required to access CHEFS.
-
-### Run/Debug
-
-1. start Postgresql and NATS. Many ways to start...
-   - right click on `.devcontainer/chefs_local/docker-compose.yml` and select `Compose up`
-   - or use command palette `Docker: Compose Up` then select `.devcontainer/chefs_local/docker-compose.yml`
-   - or `Terminal | Run Task...|chefs_local up`
-2. start CHEFS
-   - Run and Debug, select 'CHEFS' which will start both the API and the frontend.
-3. debug Frontend with Chrome
-   - Run and Debug, select 'CHEFS Frontend - chrome' which will start a Chrome browser against the frontend, will allow breakpoints in `/app/frontend/src`
-4. stop Postgresql and NATS. Many ways to stop...
-   - right click on `.devcontainer/chefs_local/docker-compose.yml` and select `Compose down`
-   - or use command palette `Docker: Compose Down` then select `.devcontainer/chefs_local/docker-compose.yml`
-   - or `Terminal | Run Task...|chefs_local down`
-
-_Notes_
-
-- `CHEFS Frontend` launch configuration is using the `chefs-frontend-localhost-5300` client in Keycloak, not `chefs-frontend-xxxx` client as we do in production.
-- `CHEFS API` will use the configuration found at `.devcontainer/chefs_local/local.json`
-- `Postgres DB`: localhost:5432
-- `CHEFS Frontend`: http://localhost:5173/app
-- `CHEFS API`: http://localhost:5173/app/api/v1
-
-## Formio Components
-
-If you are developing the formio components, you should build and redeploy them before running your local debug instances of CHEFS. Use tasks `Components build` and `Components Deploy`.
-
-## KNEX - Database tools
-
-[knex](https://knexjs.org) is installed globally and should be run from the `/app` directory where the knex configuration is located. Use knex to stub out migrations or to rollback migrations as you are developing.
-
-### create a migration file
-
-This will create a stub file with a timestamp. You will populate the up and down methods to add/update/delete database objects.
-
-```
-cd app
-knex migrate:make my_new_migration_script
-> Created Migration: /workspaces/common-hosted-form-service/app/src/db/migrations/20240119172630_my_new_migration_script.js
-```
-
-### rollback previous migration
-
-When developing your migrations, you may find it useful to run the migration and roll it back if it isn't exactly what you expect to happen.
-
-#### run the migration(s)
-
-```
-cd app
-knex migrate:latest
-> Batch 2 run: 1 migrations
-```
-
-#### rollback the migration(s)
-
-```
-cd app
-knex migrate:rollback
-> Batch 2 rolled back: 1 migrations
-```
-
-Please review the [knex](https://knexjs.org) for more detail and how to leverage the tool.
-
-## Troubleshooting
-
-All development machines are unique and here we will document problems that have been encountered and how to fix them.
-
-### Failure during load of devcontainer when running webpack (Segmentation Fault)
-
-Encountered on Mac Ventura 13.6, with Mac Docker Desktop 4.26.1 when running `npm run build:formio` on load, we hit a `Segmentation Fault`. The issue was resolved when turning off the virtualization settings in Docker Desktop.
-
-Under Settings, select `gRPC Fuse` instead of `VirtioFS` then unselect `Use Virtualization framework`. Restart Docker and VS Code.
+- [CHEFS Development with Dev Container](https://developer.gov.bc.ca/docs/default/component/chefs-techdocs/Developer/Contributors/CHEFS-Development-with-Dev-Container/)
+- [Local Setup](https://developer.gov.bc.ca/docs/default/component/chefs-techdocs/Developer/Contributors/Local-Setup/)

.devcontainer/chefs_local/config/freshclam.conf

@@ -0,0 +1,225 @@
+##
+## Example config file for freshclam
+## Please read the freshclam.conf(5) manual before editing this file.
+##
+
+
+# Comment or remove the line below.
+
+# Path to the database directory.
+# WARNING: It must match clamd.conf's directive!
+# Default: hardcoded (depends on installation options)
+DatabaseDirectory /opt/app-root/src
+
+# Path to the log file (make sure it has proper permissions)
+# Default: disabled
+#UpdateLogFile /dev/stdout
+
+# Maximum size of the log file.
+# Value of 0 disables the limit.
+# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
+# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes).
+# in bytes just don't use modifiers. If LogFileMaxSize is enabled,
+# log rotation (the LogRotate option) will always be enabled.
+# Default: 1M
+#LogFileMaxSize 2M
+
+# Log time with each message.
+# Default: no
+LogTime yes
+
+# Enable verbose logging.
+# Default: no
+LogVerbose yes
+
+# Use system logger (can work together with UpdateLogFile).
+# Default: no
+LogSyslog no
+
+# Specify the type of syslog messages - please refer to 'man syslog'
+# for facility names.
+# Default: LOG_LOCAL6
+#LogFacility LOG_MAIL
+
+# Enable log rotation. Always enabled when LogFileMaxSize is enabled.
+# Default: no
+#LogRotate yes
+
+# This option allows you to save the process identifier of the daemon
+# Default: disabled
+#PidFile /var/run/freshclam.pid
+
+# By default when started freshclam drops privileges and switches to the
+# "clamav" user. This directive allows you to change the database owner.
+# Default: clamav (may depend on installation options)
+DatabaseOwner clamupdate
+
+# Initialize supplementary group access (freshclam must be started by root).
+# Default: no
+#AllowSupplementaryGroups yes
+
+# Use DNS to verify virus database version. Freshclam uses DNS TXT records
+# to verify database and software versions. With this directive you can change
+# the database verification domain.
+# WARNING: Do not touch it unless you're configuring freshclam to use your
+# own database verification domain.
+# Default: current.cvd.clamav.net
+#DNSDatabaseInfo current.cvd.clamav.net
+
+# Use the ClamAV Mirror provided in OCP4 Silver cluster
+# DatabaseMirror https://clamav-mirror.apps.silver.devops.gov.bc.ca
+DatabaseMirror database.clamav.net
+
+# How many attempts to make before giving up.
+# Default: 3 (per mirror)
+#MaxAttempts 5
+
+# With this option you can control scripted updates. It's highly recommended
+# to keep it enabled.
+# Default: yes
+#ScriptedUpdates yes
+
+# By default freshclam will keep the local databases (.cld) uncompressed to
+# make their handling faster. With this option you can enable the compression;
+# the change will take effect with the next database update.
+# Default: no
+#CompressLocalDatabase no
+
+# With this option you can provide custom sources (http:// or file://) for
+# database files. This option can be used multiple times.
+# Default: no custom URLs
+#DatabaseCustomURL http://myserver.com/mysigs.ndb
+#DatabaseCustomURL file:///mnt/nfs/local.hdb
+
+# This option allows you to easily point freshclam to private mirrors.
+# If PrivateMirror is set, freshclam does not attempt to use DNS
+# to determine whether its databases are out-of-date, instead it will
+# use the If-Modified-Since request or directly check the headers of the
+# remote database files. For each database, freshclam first attempts
+# to download the CLD file. If that fails, it tries to download the
+# CVD file. This option overrides DatabaseMirror, DNSDatabaseInfo
+# and ScriptedUpdates. It can be used multiple times to provide
+# fall-back mirrors.
+# Default: disabled
+#PrivateMirror mirror1.mynetwork.com
+#PrivateMirror mirror2.mynetwork.com
+
+# Number of database checks per day.
+# Default: 12 (every two hours)
+#Checks 24
+
+# Proxy settings
+# Default: disabled
+#HTTPProxyServer myproxy.com
+#HTTPProxyPort 1234
+#HTTPProxyUsername myusername
+#HTTPProxyPassword mypass
+
+# If your servers are behind a firewall/proxy which applies User-Agent
+# filtering you can use this option to force the use of a different
+# User-Agent header.
+# Default: clamav/version_number
+#HTTPUserAgent SomeUserAgentIdString
+
+# Use aaa.bbb.ccc.ddd as client address for downloading databases. Useful for
+# multi-homed systems.
+# Default: Use OS'es default outgoing IP address.
+#LocalIPAddress aaa.bbb.ccc.ddd
+
+# Send the RELOAD command to clamd.
+# Default: no
+#NotifyClamd /path/to/clamd.conf
+
+# Run command after successful database update.
+# Default: disabled
+#OnUpdateExecute command
+
+# Run command when database update process fails.
+# Default: disabled
+#OnErrorExecute command
+
+# Run command when freshclam reports outdated version.
+# In the command string %v will be replaced by the new version number.
+# Default: disabled
+#OnOutdatedExecute command
+
+# Don't fork into background.
+# Default: no
+Foreground yes
+
+# Enable debug messages in libclamav.
+# Default: no
+#Debug yes
+
+# Timeout in seconds when connecting to database server.
+# Default: 30
+#ConnectTimeout 60
+
+# Timeout in seconds when reading from database server.
+# Default: 30
+#ReceiveTimeout 60
+
+# With this option enabled, freshclam will attempt to load new
+# databases into memory to make sure they are properly handled
+# by libclamav before replacing the old ones.
+# Default: yes
+#TestDatabases yes
+
+# When enabled freshclam will submit statistics to the ClamAV Project about
+# the latest virus detections in your environment. The ClamAV maintainers
+# will then use this data to determine what types of malware are the most
+# detected in the field and in what geographic area they are.
+# Freshclam will connect to clamd in order to get recent statistics.
+# Default: no
+#SubmitDetectionStats /path/to/clamd.conf
+
+# Country of origin of malware/detection statistics (for statistical
+# purposes only). The statistics collector at ClamAV.net will look up
+# your IP address to determine the geographical origin of the malware
+# reported by your installation. If this installation is mainly used to
+# scan data which comes from a different location, please enable this
+# option and enter a two-letter code (see http://www.iana.org/domains/root/db/)
+# of the country of origin.
+# Default: disabled
+#DetectionStatsCountry country-code
+
+# This option enables support for our "Personal Statistics" service.
+# When this option is enabled, the information on malware detected by
+# your clamd installation is made available to you through our website.
+# To get your HostID, log on http://www.stats.clamav.net and add a new
+# host to your host list. Once you have the HostID, uncomment this option
+# and paste the HostID here. As soon as your freshclam starts submitting
+# information to our stats collecting service, you will be able to view
+# the statistics of this clamd installation by logging into
+# http://www.stats.clamav.net with the same credentials you used to
+# generate the HostID. For more information refer to:
+# http://www.clamav.net/documentation.html#cctts
+# This feature requires SubmitDetectionStats to be enabled.
+# Default: disabled
+#DetectionStatsHostID unique-id
+
+# This option enables support for Google Safe Browsing. When activated for
+# the first time, freshclam will download a new database file (safebrowsing.cvd)
+# which will be automatically loaded by clamd and clamscan during the next
+# reload, provided that the heuristic phishing detection is turned on. This
+# database includes information about websites that may be phishing sites or
+# possible sources of malware. When using this option, it's mandatory to run
+# freshclam at least every 30 minutes.
+# Freshclam uses the ClamAV's mirror infrastructure to distribute the
+# database and its updates but all the contents are provided under Google's
+# terms of use. See http://www.google.com/transparencyreport/safebrowsing
+# and http://www.clamav.net/documentation.html#safebrowsing
+# for more information.
+# Default: disabled
+#SafeBrowsing yes
+
+# This option enables downloading of bytecode.cvd, which includes additional
+# detection mechanisms and improvements to the ClamAV engine.
+# Default: enabled
+#Bytecode yes
+
+# Download an additional 3rd party signature database distributed through
+# the ClamAV mirrors.
+# This option can be used multiple times.
+#ExtraDatabase dbname1
+#ExtraDatabase dbname2

.devcontainer/chefs_local/config/jetstream.conf

@@ -116,6 +116,6 @@ authorization: {
   users = [
     {user: admin, password: password, permissions: $ADMIN}
     {user: chefs, password: password, permissions: $CHEFS}
-    {user: chefsConsumer, password: password, permissions: $CHEFS_CONSUMER}
+    {nkey: UAG36HKWH3PZMLYAK5CAAVVXTXXBNA3YKUYMOF2J66UKHBVMTYMTM2ID, permissions: $CHEFS_CONSUMER}
   ]
 }

.devcontainer/chefs_local/docker-compose.yml

@@ -77,3 +77,20 @@ services:
     command: sh
     networks:
       - nats
+
+  clamav:
+    image: ghcr.io/bcgov/chefs-clamav:latest
+    container_name: chefs-clamav
+    restart: always
+    ports:
+      - "3310:3310"
+    environment:
+      CLAMAV_NO_CLAMD: "yes"
+      CLAMAV_NO_MILTERD: "true"
+    healthcheck:
+      test: ["CMD", "/opt/app-root/clamdcheck.sh"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+    volumes:
+      - ./config/freshclam.conf:/usr/local/etc/freshclam.conf