Skip to content

Commit b87e484

Browse files
rikukissarikukissa
committed
make jwt key stack specific
1 parent 0d764ab commit b87e484

File tree

4 files changed

+43
-156
lines changed

4 files changed

+43
-156
lines changed

‎infrastructure/docker-compose.app.yml‎

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ services:
1111
- 'traefik.enable=false'
1212
replicas: 1
1313
secrets:
14-
- jwt-public-key.{{ts}}
14+
- jwt-public-key.{{STACK}}.{{ts}}
1515
configs:
1616
- source: hearth-check-dupe-plugin.{{ts}}
1717
target: /src/hearth/lib/plugins/checkDuplicateTask.js
@@ -29,14 +29,14 @@ services:
2929
notification:
3030
image: opencrvs/ocrvs-notification:${VERSION}
3131
secrets:
32-
- jwt-public-key.{{ts}}
32+
- jwt-public-key.{{STACK}}.{{ts}}
3333
environment:
3434
- HOST=0.0.0.0
3535
- NODE_ENV=production
3636
- LANGUAGES=en,fr
3737
- SENTRY_DSN=${SENTRY_DSN:-}
3838
- APN_SERVICE_URL=http://apm-server:8200
39-
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
39+
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
4040
- MONGO_URL=mongodb://${STACK}__notification:${NOTIFICATION_MONGODB_PASSWORD}@mongo1/${STACK}__notification?replicaSet=rs0
4141
- COUNTRY_CONFIG_URL=http://countryconfig:3040
4242
deploy:
@@ -56,7 +56,7 @@ services:
5656
image: ${DOCKERHUB_ACCOUNT}/${DOCKERHUB_REPO}:${COUNTRY_CONFIG_VERSION}
5757
restart: unless-stopped
5858
secrets:
59-
- jwt-public-key.{{ts}}
59+
- jwt-public-key.{{STACK}}.{{ts}}
6060
deploy:
6161
labels:
6262
- 'traefik.enable=true'
@@ -192,18 +192,18 @@ services:
192192
gateway:
193193
image: opencrvs/ocrvs-gateway:${VERSION}
194194
secrets:
195-
- jwt-public-key.{{ts}}
195+
- jwt-public-key.{{STACK}}.{{ts}}
196196
environment:
197197
- HOST=0.0.0.0
198198
- NODE_ENV=production
199199
- LANGUAGES=en,fr
200200
- SENTRY_DSN=${SENTRY_DSN:-}
201201
- APN_SERVICE_URL=http://apm-server:8200
202-
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
202+
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
203203
- LOGIN_URL=https://login.${STACK}.{{hostname}}
204204
- CLIENT_APP_URL=https://register.${STACK}.{{hostname}}
205205
- DOMAIN=${STACK}.{{hostname}}
206-
- MINIO_BUCKET=${STACK}__ocrvs
206+
- MINIO_BUCKET=${STACK}--ocrvs
207207
- REDIS_HOST=redis
208208
- CONFIG_SMS_CODE_EXPIRY_SECONDS=600
209209
- CONFIG_TOKEN_EXPIRY_SECONDS=604800
@@ -248,14 +248,14 @@ services:
248248
workflow:
249249
image: opencrvs/ocrvs-workflow:${VERSION}
250250
secrets:
251-
- jwt-public-key.{{ts}}
251+
- jwt-public-key.{{STACK}}.{{ts}}
252252
environment:
253253
- HOST=0.0.0.0
254254
- NODE_ENV=production
255255
- LANGUAGES=en,fr
256256
- SENTRY_DSN=${SENTRY_DSN:-}
257257
- APN_SERVICE_URL=http://apm-server:8200
258-
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
258+
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
259259
- SEARCH_URL=http://search:9090/
260260
- METRICS_URL=http://metrics:1050
261261
- DOCUMENTS_URL=http://documents:9050
@@ -282,15 +282,15 @@ services:
282282
search:
283283
image: opencrvs/ocrvs-search:${VERSION}
284284
secrets:
285-
- jwt-public-key.{{ts}}
285+
- jwt-public-key.{{STACK}}.{{ts}}
286286
environment:
287287
- HOST=0.0.0.0
288288
- NODE_ENV=production
289289
- SENTRY_DSN=${SENTRY_DSN:-}
290290
- OPENCRVS_INDEX_NAME=ocrvs--${STACK}
291291
- ES_HOST=search-user:${ROTATING_SEARCH_ELASTIC_PASSWORD}@elasticsearch:9200
292292
- APN_SERVICE_URL=http://apm-server:8200
293-
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
293+
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
294294
- HEARTH_MONGO_URL=mongodb://${STACK}__hearth:${HEARTH_MONGODB_PASSWORD}@mongo1/${STACK}__hearth-dev?replicaSet=rs0
295295
- USER_MANAGEMENT_URL=http://user-mgnt:3030/
296296
- FHIR_URL=http://hearth:3447/fhir
@@ -310,15 +310,15 @@ services:
310310
metrics:
311311
image: opencrvs/ocrvs-metrics:${VERSION}
312312
secrets:
313-
- jwt-public-key.{{ts}}
313+
- jwt-public-key.{{STACK}}.{{ts}}
314314
volumes:
315315
- /data/vsexport:/usr/src/app/packages/metrics/src/scripts
316316
environment:
317317
- HOST=0.0.0.0
318318
- NODE_ENV=production
319319
- SENTRY_DSN=${SENTRY_DSN:-}
320320
- APN_SERVICE_URL=http://apm-server:8200
321-
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
321+
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
322322
- MONGO_URL=mongodb://${STACK}__metrics:${METRICS_MONGODB_PASSWORD}@mongo1/${STACK}__metrics?replicaSet=rs0
323323
- HEARTH_MONGO_URL=mongodb://${STACK}__hearth:${HEARTH_MONGODB_PASSWORD}@mongo1/${STACK}__hearth-dev?replicaSet=rs0
324324
- DASHBOARD_MONGO_URL=mongodb://${STACK}__performance:${PERFORMANCE_MONGODB_PASSWORD}@mongo1/${STACK}__performance?replicaSet=rs0
@@ -350,15 +350,15 @@ services:
350350
auth:
351351
image: opencrvs/ocrvs-auth:${VERSION}
352352
secrets:
353-
- jwt-public-key.{{ts}}
354-
- jwt-private-key.{{ts}}
353+
- jwt-public-key.{{STACK}}.{{ts}}
354+
- jwt-private-key.{{STACK}}.{{ts}}
355355
environment:
356356
- HOST=0.0.0.0
357357
- NODE_ENV=production
358358
- SENTRY_DSN=${SENTRY_DSN:-}
359359
- APN_SERVICE_URL=http://apm-server:8200
360-
- CERT_PRIVATE_KEY_PATH=/run/secrets/jwt-private-key.{{ts}}
361-
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
360+
- CERT_PRIVATE_KEY_PATH=/run/secrets/jwt-private-key.{{STACK}}.{{ts}}
361+
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
362362
- LOGIN_URL=https://login.${STACK}.{{hostname}}
363363
- COUNTRY_CONFIG_URL=https://countryconfig.${STACK}.{{hostname}}
364364
- CLIENT_APP_URL=https://register.${STACK}.{{hostname}}
@@ -397,14 +397,14 @@ services:
397397
user-mgnt:
398398
image: opencrvs/ocrvs-user-mgnt:${VERSION}
399399
secrets:
400-
- jwt-public-key.{{ts}}
400+
- jwt-public-key.{{STACK}}.{{ts}}
401401
environment:
402402
- HOST=0.0.0.0
403403
- NODE_ENV=production
404404
- SENTRY_DSN=${SENTRY_DSN:-}
405405
- APN_SERVICE_URL=http://apm-server:8200
406406
- RECORD_SEARCH_QUOTA=2000
407-
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
407+
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
408408
- MONGO_URL=mongodb://${STACK}__user-mgnt:${USER_MGNT_MONGODB_PASSWORD}@mongo1/${STACK}__user-mgnt?replicaSet=rs0
409409
- NOTIFICATION_SERVICE_URL=http://notification:2020/
410410
- METRICS_URL=http://metrics:1050
@@ -427,14 +427,14 @@ services:
427427
webhooks:
428428
image: opencrvs/ocrvs-webhooks:${VERSION}
429429
secrets:
430-
- jwt-public-key.{{ts}}
430+
- jwt-public-key.{{STACK}}.{{ts}}
431431
environment:
432432
- HOST=0.0.0.0
433433
- NODE_ENV=production
434434
- SENTRY_DSN=${SENTRY_DSN:-}
435435
- APN_SERVICE_URL=http://apm-server:8200
436436
- MONGO_URL=mongodb://${STACK}__webhooks:${WEBHOOKS_MONGODB_PASSWORD}@mongo1/${STACK}__webhooks?replicaSet=rs0
437-
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
437+
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
438438
- REDIS_HOST=redis
439439
- AUTH_URL=http://auth:4040
440440
- USER_MANAGEMENT_URL=http://user-mgnt:3030/
@@ -468,13 +468,13 @@ services:
468468
config:
469469
image: opencrvs/ocrvs-config:${VERSION}
470470
secrets:
471-
- jwt-public-key.{{ts}}
471+
- jwt-public-key.{{STACK}}.{{ts}}
472472
environment:
473473
- HOST=0.0.0.0
474474
- NODE_ENV=production
475475
- SENTRY_DSN=${SENTRY_DSN:-}
476476
- APN_SERVICE_URL=http://apm-server:8200
477-
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
477+
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
478478
- MONGO_URL=mongodb://${STACK}__config:${CONFIG_MONGODB_PASSWORD}@mongo1/${STACK}__application-config?replicaSet=rs0
479479
- LOGIN_URL=https://login.${STACK}.{{hostname}}
480480
- CLIENT_APP_URL=https://register.${STACK}.{{hostname}}
@@ -523,18 +523,18 @@ services:
523523
labels:
524524
- 'traefik.enable=false'
525525
secrets:
526-
- jwt-public-key.{{ts}}
526+
- jwt-public-key.{{STACK}}.{{ts}}
527527
environment:
528528
- HOST=0.0.0.0
529529
- NODE_ENV=production
530530
- APN_SERVICE_URL=http://apm-server:8200
531-
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
531+
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
532532
- MINIO_ACCESS_KEY=${MINIO_ROOT_USER}
533533
- MINIO_SECRET_KEY=${MINIO_ROOT_PASSWORD}
534534
- MINIO_URL=minio.{{hostname}}
535535
- MINIO_HOST=minio
536536
- MINIO_PORT=9000
537-
- MINIO_BUCKET=${STACK}__ocrvs
537+
- MINIO_BUCKET=${STACK}--ocrvs
538538
- COUNTRY_CONFIG_URL=http://countryconfig:3040
539539
networks:
540540
- overlay_net
@@ -578,7 +578,7 @@ services:
578578
- MINIO_SECRET_KEY=${MINIO_ROOT_PASSWORD}
579579
- MINIO_HOST=minio
580580
- MINIO_PORT=9000
581-
- MINIO_BUCKET=${STACK}__ocrvs
581+
- MINIO_BUCKET=${STACK}--ocrvs
582582
- SUPER_USER_PASSWORD=${SUPER_USER_PASSWORD}
583583
- STACK=${STACK}
584584
- DASHBOARD_MONGO_URL=mongodb://mongo1/${STACK}__performance
@@ -681,9 +681,9 @@ services:
681681
constraints:
682682
- node.labels.data1 == true
683683
secrets:
684-
jwt-public-key.{{ts}}:
684+
jwt-public-key.{{STACK}}.{{ts}}:
685685
external: true
686-
jwt-private-key.{{ts}}:
686+
jwt-private-key.{{STACK}}.{{ts}}:
687687
external: true
688688
configs:
689689
hearth-check-dupe-plugin.{{ts}}:

‎infrastructure/docker-compose.qa-deploy.yml‎

Lines changed: 0 additions & 125 deletions
This file was deleted.

‎infrastructure/mongodb/on-deploy.sh‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,12 @@ if [[ $HEARTH_USER != "FOUND" ]]; then
122122
pwd: '$HEARTH_MONGODB_PASSWORD',
123123
roles: [{ role: 'readWrite', db: "${DATABASE_PREFIX}__hearth" }, { role: 'readWrite', db: "${DATABASE_PREFIX}__performance" }, { role: 'readWrite', db: "${DATABASE_PREFIX}__hearth-dev" }]
124124
})
125+
use performance
126+
db.createUser({
127+
user: '${DATABASE_PREFIX}__hearth',
128+
pwd: '$HEARTH_MONGODB_PASSWORD',
129+
roles: [{ role: 'readWrite', db: "performance" }]
130+
})
125131
EOF
126132
else
127133
echo "hearth user exists"
@@ -131,6 +137,11 @@ else
131137
pwd: '$HEARTH_MONGODB_PASSWORD',
132138
roles: [{ role: 'readWrite', db: "${DATABASE_PREFIX}__hearth" }, { role: 'readWrite', db: "${DATABASE_PREFIX}__performance" }, { role: 'readWrite', db: "${DATABASE_PREFIX}__hearth-dev" }]
133139
})
140+
use performance
141+
db.updateUser('${DATABASE_PREFIX}__hearth', {
142+
pwd: '$HEARTH_MONGODB_PASSWORD',
143+
roles: [{ role: 'readWrite', db: "performance" }]
144+
})
134145
EOF
135146
fi
136147

‎infrastructure/rotate-secrets.sh‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,10 @@ PRIV_KEY=$(openssl genrsa 2048 2>/dev/null)
1414
PUB_KEY=$(echo "$PRIV_KEY" | openssl rsa -pubout 2>/dev/null)
1515
UNIX_TS=$(date +%s)
1616

17-
echo "$PUB_KEY" | docker secret create jwt-public-key.$UNIX_TS -
18-
echo "$PRIV_KEY" | docker secret create jwt-private-key.$UNIX_TS -
17+
echo "$PUB_KEY" | docker secret create jwt-public-key.$STACK.$UNIX_TS -
18+
echo "$PRIV_KEY" | docker secret create jwt-private-key.$STACK.$UNIX_TS -
1919

2020
sed -i "s/{{ts}}/$UNIX_TS/g" "$@"
21+
sed -i "s/{{STACK}}/$STACK/g" "$@"
2122
echo "DONE - `date --iso-8601=ns`"
2223
echo

0 commit comments

Comments
 (0)