Merge pull request #33 from GSA/clean-up-deploy-secrets

Clean up deploy secrets
2026-07-18 05:30:48 -04:00 · 2022-09-02 13:38:17 -04:00
parent 38a6ea4de4 def35bf402
commit 355e805eaf
4 changed files with 10 additions and 183 deletions
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -35,8 +35,9 @@ jobs:
    - name: Deploy to cloud.gov
      uses: 18f/cg-deploy-action@main
      env:
-        DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}
-        SECRET_KEY: ${{ secrets.SECRET_KEY }}
+        DANGEROUS_SALT: ${{ secrets.PROD_DANGEROUS_SALT }}
+        SECRET_KEY: ${{ secrets.PROD_SECRET_KEY }}
+        ADMIN_CLIENT_SECRET: ${{ secrets.PROD_ADMIN_CLIENT_SECRET }}
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      with:
@@ -44,11 +45,11 @@ jobs:
        cf_password: ${{ secrets.cloudgov_password }}
        cf_org: gsa-10x-prototyping
        cf_space: 10x-notifications
-        full_command: |
-          cf push --strategy rolling \
-          --var DANGEROUS_SALT="$DANGEROUS_SALT" \
-          --var SECRET_KEY="$SECRET_KEY" \
-          --var AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" \
+        push_arguments: >-
+          --var DANGEROUS_SALT="$DANGEROUS_SALT"
+          --var SECRET_KEY="$SECRET_KEY"
+          --var ADMIN_CLIENT_SECRET="$ADMIN_CLIENT_SECRET"
+          --var AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID"
          --var AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY"

  bail:
--- a/18
+++ b/18
@@ -13,11 +13,6 @@ CF_SPACE ?= ${DEPLOY_ENV}
 CF_HOME ?= ${HOME}
 $(eval export CF_HOME)

-CF_MANIFEST_PATH ?= /tmp/manifest.yml
-
-
-NOTIFY_CREDENTIALS ?= ~/.notify-credentials
-

 ## DEVELOPMENT

@@ -120,19 +115,6 @@ cf-login: ## Log in to Cloud Foundry
 	@echo "Logging in to Cloud Foundry on ${CF_API}"
 	@cf login -a "${CF_API}" -u ${CF_USERNAME} -p "${CF_PASSWORD}" -o "${CF_ORG}" -s "${CF_SPACE}"

-.PHONY: generate-manifest
-generate-manifest:
-	$(if ${CF_APP},,$(error Must specify CF_APP))
-	$(if ${CF_SPACE},,$(error Must specify CF_SPACE))
-	$(if $(shell which gpg2), $(eval export GPG=gpg2), $(eval export GPG=gpg))
-	$(if ${GPG_PASSPHRASE_TXT}, $(eval export DECRYPT_CMD=echo -n $$$${GPG_PASSPHRASE_TXT} | ${GPG} --quiet --batch --passphrase-fd 0 --pinentry-mode loopback -d), $(eval export DECRYPT_CMD=${GPG} --quiet --batch -d))
-
-	@jinja2 --strict manifest.yml.j2 \
-	    -D environment=${CF_SPACE} \
-	    -D CF_APP=${CF_APP} \
-	    --format=yaml \
-	    <(${DECRYPT_CMD} ${NOTIFY_CREDENTIALS}/credentials/${CF_SPACE}/paas/environment-variables.gpg) 2>&1
-
 .PHONY: cf-deploy
 cf-deploy: ## Deploys the app to Cloud Foundry
 	$(if ${CF_SPACE},,$(error Must specify CF_SPACE))
--- a/manifest.yml
+++ b/manifest.yml
@@ -27,9 +27,10 @@ applications:
      NOTIFICATION_QUEUE_PREFIX: prototype_10x
      STATSD_HOST: localhost

-      INTERNAL_CLIENT_API_KEYS: '{"notify-admin":["dev-notify-secret-key"]}'
+      INTERNAL_CLIENT_API_KEYS: '{"notify-admin":["((ADMIN_CLIENT_SECRET))"]}'

      # Credentials variables
+      ADMIN_CLIENT_SECRET: ((ADMIN_CLIENT_SECRET))
      DANGEROUS_SALT: ((DANGEROUS_SALT))
      SECRET_KEY: ((SECRET_KEY))
      AWS_REGION: us-west-2
@@ -37,5 +38,3 @@ applications:
      AWS_US_TOLL_FREE_NUMBER: +18446120782

      DVLA_EMAIL_ADDRESSES: []
-
-      NOTIFY_EMAIL_DOMAIN: dispostable.com
--- a/manifest.yml.j2
+++ b/manifest.yml.j2
@@ -1,155 +0,0 @@
-{%- set app_vars = {
-  'notify-api': {
-    'NOTIFY_APP_NAME': 'api',
-    'disk_quota': '2G',
-    'sqlalchemy_pool_size': 15,
-    'additional_env_vars': {
-      'STATSD_HOST': None
-    },
-    'routes': {
-      'preview': ['api.notify.works', 'notify-api-preview.apps.internal'],
-      'staging': ['api.staging-notify.works', 'notify-api-staging.apps.internal'],
-      'production': ['api.notifications.service.gov.uk', 'notify-api-production.apps.internal'],
-    },
-    'health-check-type': 'port',
-    'health-check-invocation-timeout': 3,
-    'instances': {
-      'preview': None,
-      'staging': None,
-      'production': 25
-    },
-  },
-
-  'notify-api-sms-receipts': {
-    'NOTIFY_APP_NAME': 'api',
-    'disk_quota': '2G',
-    'additional_env_vars': {
-      'STATSD_HOST': None
-    },
-    'routes': {
-      'preview': ['api.notify.works/notifications/sms/mmg', 'api.notify.works/notifications/sms/firetext', 'notify-api-sms-receipts-preview.apps.internal'],
-      'staging': ['api.staging-notify.works/notifications/sms/mmg', 'api.staging-notify.works/notifications/sms/firetext', 'notify-api-sms-receipts-staging.apps.internal'],
-      'production': ['api.notifications.service.gov.uk/notifications/sms/mmg', 'api.notifications.service.gov.uk/notifications/sms/firetext', 'notify-api-sms-receipts-production.apps.internal' ],
-    },
-    'health-check-type': 'port',
-    'health-check-invocation-timeout': 3,
-    'instances': {
-      'preview': 1,
-      'staging': 2,
-      'production': 10
-    },
-  },
-
-  'notify-api-db-migration': {
-    'NOTIFY_APP_NAME': 'api',
-    'instances': {
-      'preview': 0,
-      'staging': 0,
-      'production': 0
-    },
-  },
-
-  'notify-delivery-celery-beat': {'memory': '512M'},
-  'notify-delivery-worker-jobs': {'memory': '2G'},
-  'notify-delivery-worker-research': {},
-  'notify-delivery-worker-sender': {'disk_quota': '2G', 'memory': '4G'},
-  'notify-delivery-worker-periodic': {},
-  'notify-delivery-worker-reporting': {
-    'additional_env_vars': {
-      'CELERYD_PREFETCH_MULTIPLIER': 1,
-    }
-  },
-  'notify-delivery-worker-priority': {},
-  'notify-delivery-worker-letters': {'memory': '2G'},
-  'notify-delivery-worker-retry-tasks': {},
-  'notify-delivery-worker-internal': {},
-  'notify-delivery-worker-broadcasts': {
-    'additional_env_vars': {
-      'CELERYD_PREFETCH_MULTIPLIER': 1,
-      'CBC_PROXY_AWS_ACCESS_KEY_ID': CBC_PROXY_AWS_ACCESS_KEY_ID,
-      'CBC_PROXY_AWS_SECRET_ACCESS_KEY': CBC_PROXY_AWS_SECRET_ACCESS_KEY,
-    }
-  },
-  'notify-delivery-worker-receipts': {},
-  'notify-delivery-worker-service-callbacks': {'disk_quota': '2G'},
-  'notify-delivery-worker-save-api-notifications': {'disk_quota': '2G'},
-} -%}
-
-{%- set app = app_vars[CF_APP] -%}
-{%- set instance_count = app.get('instances', {}).get(environment) -%}
-
---
-
-applications:
-  - name: {{ CF_APP }}
-    buildpack: python_buildpack
-    {% if instance_count is not none %}
-    instances: {{ instance_count }}
-    {%- endif %}
-    memory: {{ app.get('memory', '1G') }}
-    disk_quota: {{ app.get('disk_quota', '1G')}}
-
-    routes:
-      {%- for route in app.get('routes', {}).get(environment, []) %}
-      - route: {{ route }}
-      {%- endfor%}
-      - route: {{ CF_APP }}-{{ environment }}.cloudapps.digital
-    health-check-type: {{ app.get('health-check-type', 'process') }}
-    health-check-invocation-timeout: {{ app.get('health-check-invocation-timeout', 1) }}
-
-    services:
-      - notify-db
-      - notify-redis
-      - logit-ssl-syslog-drain
-      {% if CF_APP == 'notify-api' %}
-      - notify-prometheus
-      - notify-splunk
-      {% endif %}
-
-    env:
-      NOTIFY_APP_NAME: {{ app.get('NOTIFY_APP_NAME', CF_APP.replace('notify-', '')) }}
-      NOTIFY_LOG_PATH: /home/vcap/logs/app.log
-      SQLALCHEMY_POOL_SIZE: {{ app.get('sqlalchemy_pool_size', 1) }}
-      FLASK_APP: application.py
-      NOTIFY_ENVIRONMENT: {{ environment }}
-
-      # Credentials variables
-      ADMIN_BASE_URL: '{{ ADMIN_BASE_URL }}'
-      INTERNAL_CLIENT_API_KEYS: '{{ INTERNAL_CLIENT_API_KEYS | tojson }}'
-      API_HOST_NAME: '{{ API_HOST_NAME }}'
-      DANGEROUS_SALT: '{{ DANGEROUS_SALT }}'
-      SECRET_KEY: '{{ SECRET_KEY }}'
-      ROUTE_SECRET_KEY_1: '{{ ROUTE_SECRET_KEY_1 }}'
-      ROUTE_SECRET_KEY_2: '{{ ROUTE_SECRET_KEY_2 }}'
-      CRONITOR_KEYS: '{{ CRONITOR_KEYS | tojson }}'
-      METRICS_BASIC_AUTH_TOKEN: {{ METRICS_BASIC_AUTH_TOKEN }}
-
-      HIGH_VOLUME_SERVICE: '{{ HIGH_VOLUME_SERVICE | tojson }}'
-
-      DOCUMENT_DOWNLOAD_API_HOST: '{{ DOCUMENT_DOWNLOAD_API_HOST }}'
-      DOCUMENT_DOWNLOAD_API_KEY: '{{ DOCUMENT_DOWNLOAD_API_KEY }}'
-
-      NOTIFICATION_QUEUE_PREFIX: '{{ NOTIFICATION_QUEUE_PREFIX }}'
-      AWS_ACCESS_KEY_ID: '{{ AWS_ACCESS_KEY_ID }}'
-      AWS_SECRET_ACCESS_KEY: '{{ AWS_SECRET_ACCESS_KEY }}'
-
-      STATSD_HOST: "notify-statsd-exporter-{{ environment }}.apps.internal"
-
-      ZENDESK_API_KEY: '{{ ZENDESK_API_KEY }}'
-
-      MMG_API_KEY: '{{ MMG_API_KEY }}'
-      MMG_INBOUND_SMS_AUTH: '{{ MMG_INBOUND_SMS_AUTH | tojson }}'
-      MMG_INBOUND_SMS_USERNAME: '{{ MMG_INBOUND_SMS_USERNAME | tojson }}'
-
-      FIRETEXT_API_KEY: '{{ FIRETEXT_API_KEY }}'
-      FIRETEXT_INTERNATIONAL_API_KEY: '{{ FIRETEXT_INTERNATIONAL_API_KEY }}'
-      FIRETEXT_INBOUND_SMS_AUTH: '{{ FIRETEXT_INBOUND_SMS_AUTH | tojson }}'
-
-      TEMPLATE_PREVIEW_API_HOST: '{{ TEMPLATE_PREVIEW_API_HOST }}'
-      TEMPLATE_PREVIEW_API_KEY: '{{ TEMPLATE_PREVIEW_API_KEY }}'
-
-      DVLA_EMAIL_ADDRESSES: '{{ DVLA_EMAIL_ADDRESSES | tojson  }}'
-
-      {% for key, value in app.get('additional_env_vars', {}).items() %}
-      {{key}}: '{{value}}'
-      {% endfor %}