Skip to content

Commit

Permalink
make jwt key stack specific
Browse files Browse the repository at this point in the history
  • Loading branch information
@rikukissa
rikukissa committed Sep 11, 2024
1 parent 0d764ab commit 1068d3e
Show file tree
Hide file tree
Showing 3 changed files with 29 additions and 153 deletions.
52 changes: 26 additions & 26 deletions infrastructure/docker-compose.app.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ services:
- 'traefik.enable=false'
replicas: 1
secrets:
- jwt-public-key.{{ts}}
- jwt-public-key.{{STACK}}.{{ts}}
configs:
- source: hearth-check-dupe-plugin.{{ts}}
target: /src/hearth/lib/plugins/checkDuplicateTask.js
Expand All @@ -29,14 +29,14 @@ services:
notification:
image: opencrvs/ocrvs-notification:${VERSION}
secrets:
- jwt-public-key.{{ts}}
- jwt-public-key.{{STACK}}.{{ts}}
environment:
- HOST=0.0.0.0
- NODE_ENV=production
- LANGUAGES=en,fr
- SENTRY_DSN=${SENTRY_DSN:-}
- APN_SERVICE_URL=http://apm-server:8200
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
- MONGO_URL=mongodb://${STACK}__notification:${NOTIFICATION_MONGODB_PASSWORD}@mongo1/${STACK}__notification?replicaSet=rs0
- COUNTRY_CONFIG_URL=http://countryconfig:3040
deploy:
Expand All @@ -56,7 +56,7 @@ services:
image: ${DOCKERHUB_ACCOUNT}/${DOCKERHUB_REPO}:${COUNTRY_CONFIG_VERSION}
restart: unless-stopped
secrets:
- jwt-public-key.{{ts}}
- jwt-public-key.{{STACK}}.{{ts}}
deploy:
labels:
- 'traefik.enable=true'
Expand Down Expand Up @@ -192,14 +192,14 @@ services:
gateway:
image: opencrvs/ocrvs-gateway:${VERSION}
secrets:
- jwt-public-key.{{ts}}
- jwt-public-key.{{STACK}}.{{ts}}
environment:
- HOST=0.0.0.0
- NODE_ENV=production
- LANGUAGES=en,fr
- SENTRY_DSN=${SENTRY_DSN:-}
- APN_SERVICE_URL=http://apm-server:8200
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
- LOGIN_URL=https://login.${STACK}.{{hostname}}
- CLIENT_APP_URL=https://register.${STACK}.{{hostname}}
- DOMAIN=${STACK}.{{hostname}}
Expand Down Expand Up @@ -248,14 +248,14 @@ services:
workflow:
image: opencrvs/ocrvs-workflow:${VERSION}
secrets:
- jwt-public-key.{{ts}}
- jwt-public-key.{{STACK}}.{{ts}}
environment:
- HOST=0.0.0.0
- NODE_ENV=production
- LANGUAGES=en,fr
- SENTRY_DSN=${SENTRY_DSN:-}
- APN_SERVICE_URL=http://apm-server:8200
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
- SEARCH_URL=http://search:9090/
- METRICS_URL=http://metrics:1050
- DOCUMENTS_URL=http://documents:9050
Expand All @@ -282,15 +282,15 @@ services:
search:
image: opencrvs/ocrvs-search:${VERSION}
secrets:
- jwt-public-key.{{ts}}
- jwt-public-key.{{STACK}}.{{ts}}
environment:
- HOST=0.0.0.0
- NODE_ENV=production
- SENTRY_DSN=${SENTRY_DSN:-}
- OPENCRVS_INDEX_NAME=ocrvs--${STACK}
- ES_HOST=search-user:${ROTATING_SEARCH_ELASTIC_PASSWORD}@elasticsearch:9200
- APN_SERVICE_URL=http://apm-server:8200
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
- HEARTH_MONGO_URL=mongodb://${STACK}__hearth:${HEARTH_MONGODB_PASSWORD}@mongo1/${STACK}__hearth-dev?replicaSet=rs0
- USER_MANAGEMENT_URL=http://user-mgnt:3030/
- FHIR_URL=http://hearth:3447/fhir
Expand All @@ -310,15 +310,15 @@ services:
metrics:
image: opencrvs/ocrvs-metrics:${VERSION}
secrets:
- jwt-public-key.{{ts}}
- jwt-public-key.{{STACK}}.{{ts}}
volumes:
- /data/vsexport:/usr/src/app/packages/metrics/src/scripts
environment:
- HOST=0.0.0.0
- NODE_ENV=production
- SENTRY_DSN=${SENTRY_DSN:-}
- APN_SERVICE_URL=http://apm-server:8200
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
- MONGO_URL=mongodb://${STACK}__metrics:${METRICS_MONGODB_PASSWORD}@mongo1/${STACK}__metrics?replicaSet=rs0
- HEARTH_MONGO_URL=mongodb://${STACK}__hearth:${HEARTH_MONGODB_PASSWORD}@mongo1/${STACK}__hearth-dev?replicaSet=rs0
- DASHBOARD_MONGO_URL=mongodb://${STACK}__performance:${PERFORMANCE_MONGODB_PASSWORD}@mongo1/${STACK}__performance?replicaSet=rs0
Expand Down Expand Up @@ -350,15 +350,15 @@ services:
auth:
image: opencrvs/ocrvs-auth:${VERSION}
secrets:
- jwt-public-key.{{ts}}
- jwt-private-key.{{ts}}
- jwt-public-key.{{STACK}}.{{ts}}
- jwt-private-key.{{STACK}}.{{ts}}
environment:
- HOST=0.0.0.0
- NODE_ENV=production
- SENTRY_DSN=${SENTRY_DSN:-}
- APN_SERVICE_URL=http://apm-server:8200
- CERT_PRIVATE_KEY_PATH=/run/secrets/jwt-private-key.{{ts}}
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
- CERT_PRIVATE_KEY_PATH=/run/secrets/jwt-private-key.{{STACK}}.{{ts}}
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
- LOGIN_URL=https://login.${STACK}.{{hostname}}
- COUNTRY_CONFIG_URL=https://countryconfig.${STACK}.{{hostname}}
- CLIENT_APP_URL=https://register.${STACK}.{{hostname}}
Expand Down Expand Up @@ -397,14 +397,14 @@ services:
user-mgnt:
image: opencrvs/ocrvs-user-mgnt:${VERSION}
secrets:
- jwt-public-key.{{ts}}
- jwt-public-key.{{STACK}}.{{ts}}
environment:
- HOST=0.0.0.0
- NODE_ENV=production
- SENTRY_DSN=${SENTRY_DSN:-}
- APN_SERVICE_URL=http://apm-server:8200
- RECORD_SEARCH_QUOTA=2000
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
- MONGO_URL=mongodb://${STACK}__user-mgnt:${USER_MGNT_MONGODB_PASSWORD}@mongo1/${STACK}__user-mgnt?replicaSet=rs0
- NOTIFICATION_SERVICE_URL=http://notification:2020/
- METRICS_URL=http://metrics:1050
Expand All @@ -427,14 +427,14 @@ services:
webhooks:
image: opencrvs/ocrvs-webhooks:${VERSION}
secrets:
- jwt-public-key.{{ts}}
- jwt-public-key.{{STACK}}.{{ts}}
environment:
- HOST=0.0.0.0
- NODE_ENV=production
- SENTRY_DSN=${SENTRY_DSN:-}
- APN_SERVICE_URL=http://apm-server:8200
- MONGO_URL=mongodb://${STACK}__webhooks:${WEBHOOKS_MONGODB_PASSWORD}@mongo1/${STACK}__webhooks?replicaSet=rs0
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
- REDIS_HOST=redis
- AUTH_URL=http://auth:4040
- USER_MANAGEMENT_URL=http://user-mgnt:3030/
Expand Down Expand Up @@ -468,13 +468,13 @@ services:
config:
image: opencrvs/ocrvs-config:${VERSION}
secrets:
- jwt-public-key.{{ts}}
- jwt-public-key.{{STACK}}.{{ts}}
environment:
- HOST=0.0.0.0
- NODE_ENV=production
- SENTRY_DSN=${SENTRY_DSN:-}
- APN_SERVICE_URL=http://apm-server:8200
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
- MONGO_URL=mongodb://${STACK}__config:${CONFIG_MONGODB_PASSWORD}@mongo1/${STACK}__application-config?replicaSet=rs0
- LOGIN_URL=https://login.${STACK}.{{hostname}}
- CLIENT_APP_URL=https://register.${STACK}.{{hostname}}
Expand Down Expand Up @@ -523,12 +523,12 @@ services:
labels:
- 'traefik.enable=false'
secrets:
- jwt-public-key.{{ts}}
- jwt-public-key.{{STACK}}.{{ts}}
environment:
- HOST=0.0.0.0
- NODE_ENV=production
- APN_SERVICE_URL=http://apm-server:8200
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{ts}}
- CERT_PUBLIC_KEY_PATH=/run/secrets/jwt-public-key.{{STACK}}.{{ts}}
- MINIO_ACCESS_KEY=${MINIO_ROOT_USER}
- MINIO_SECRET_KEY=${MINIO_ROOT_PASSWORD}
- MINIO_URL=minio.{{hostname}}
Expand Down Expand Up @@ -681,9 +681,9 @@ services:
constraints:
- node.labels.data1 == true
secrets:
jwt-public-key.{{ts}}:
jwt-public-key.{{STACK}}.{{ts}}:
external: true
jwt-private-key.{{ts}}:
jwt-private-key.{{STACK}}.{{ts}}:
external: true
configs:
hearth-check-dupe-plugin.{{ts}}:
Expand Down
125 changes: 0 additions & 125 deletions infrastructure/docker-compose.qa-deploy.yml
View file

This file was deleted.

5 changes: 3 additions & 2 deletions infrastructure/rotate-secrets.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,10 @@ PRIV_KEY=$(openssl genrsa 2048 2>/dev/null)
PUB_KEY=$(echo "$PRIV_KEY" | openssl rsa -pubout 2>/dev/null)
UNIX_TS=$(date +%s)

echo "$PUB_KEY" | docker secret create jwt-public-key.$UNIX_TS -
echo "$PRIV_KEY" | docker secret create jwt-private-key.$UNIX_TS -
echo "$PUB_KEY" | docker secret create jwt-public-key.$STACK.$UNIX_TS -
echo "$PRIV_KEY" | docker secret create jwt-private-key.$STACK.$UNIX_TS -

sed -i "s/{{ts}}/$UNIX_TS/g" "$@"
sed -i "s/{{STACK}}/$STACK/g" "$@"
echo "DONE - `date --iso-8601=ns`"
echo

0 comments on commit 1068d3e

Please sign in to comment.