From 56d9ac8e6264e24be10c61898edfe588614a3ce2 Mon Sep 17 00:00:00 2001 From: Ryan Ahearn Date: Fri, 2 Sep 2022 10:53:00 -0400 Subject: [PATCH 1/2] Remove obsolete manifest.yml.j2 file --- Makefile | 18 ------ manifest.yml.j2 | 155 ------------------------------------------------ 2 files changed, 173 deletions(-) delete mode 100644 manifest.yml.j2 diff --git a/Makefile b/Makefile index f3d47b438..18caff76d 100644 --- a/Makefile +++ b/Makefile @@ -13,11 +13,6 @@ CF_SPACE ?= ${DEPLOY_ENV} CF_HOME ?= ${HOME} $(eval export CF_HOME) -CF_MANIFEST_PATH ?= /tmp/manifest.yml - - -NOTIFY_CREDENTIALS ?= ~/.notify-credentials - ## DEVELOPMENT @@ -120,19 +115,6 @@ cf-login: ## Log in to Cloud Foundry @echo "Logging in to Cloud Foundry on ${CF_API}" @cf login -a "${CF_API}" -u ${CF_USERNAME} -p "${CF_PASSWORD}" -o "${CF_ORG}" -s "${CF_SPACE}" -.PHONY: generate-manifest -generate-manifest: - $(if ${CF_APP},,$(error Must specify CF_APP)) - $(if ${CF_SPACE},,$(error Must specify CF_SPACE)) - $(if $(shell which gpg2), $(eval export GPG=gpg2), $(eval export GPG=gpg)) - $(if ${GPG_PASSPHRASE_TXT}, $(eval export DECRYPT_CMD=echo -n $$$${GPG_PASSPHRASE_TXT} | ${GPG} --quiet --batch --passphrase-fd 0 --pinentry-mode loopback -d), $(eval export DECRYPT_CMD=${GPG} --quiet --batch -d)) - - @jinja2 --strict manifest.yml.j2 \ - -D environment=${CF_SPACE} \ - -D CF_APP=${CF_APP} \ - --format=yaml \ - <(${DECRYPT_CMD} ${NOTIFY_CREDENTIALS}/credentials/${CF_SPACE}/paas/environment-variables.gpg) 2>&1 - .PHONY: cf-deploy cf-deploy: ## Deploys the app to Cloud Foundry $(if ${CF_SPACE},,$(error Must specify CF_SPACE)) diff --git a/manifest.yml.j2 b/manifest.yml.j2 deleted file mode 100644 index eeda63212..000000000 --- a/manifest.yml.j2 +++ /dev/null @@ -1,155 +0,0 @@ -{%- set app_vars = { - 'notify-api': { - 'NOTIFY_APP_NAME': 'api', - 'disk_quota': '2G', - 'sqlalchemy_pool_size': 15, - 'additional_env_vars': { - 'STATSD_HOST': None - }, - 'routes': { - 'preview': ['api.notify.works', 'notify-api-preview.apps.internal'], - 'staging': ['api.staging-notify.works', 'notify-api-staging.apps.internal'], - 'production': ['api.notifications.service.gov.uk', 'notify-api-production.apps.internal'], - }, - 'health-check-type': 'port', - 'health-check-invocation-timeout': 3, - 'instances': { - 'preview': None, - 'staging': None, - 'production': 25 - }, - }, - - 'notify-api-sms-receipts': { - 'NOTIFY_APP_NAME': 'api', - 'disk_quota': '2G', - 'additional_env_vars': { - 'STATSD_HOST': None - }, - 'routes': { - 'preview': ['api.notify.works/notifications/sms/mmg', 'api.notify.works/notifications/sms/firetext', 'notify-api-sms-receipts-preview.apps.internal'], - 'staging': ['api.staging-notify.works/notifications/sms/mmg', 'api.staging-notify.works/notifications/sms/firetext', 'notify-api-sms-receipts-staging.apps.internal'], - 'production': ['api.notifications.service.gov.uk/notifications/sms/mmg', 'api.notifications.service.gov.uk/notifications/sms/firetext', 'notify-api-sms-receipts-production.apps.internal' ], - }, - 'health-check-type': 'port', - 'health-check-invocation-timeout': 3, - 'instances': { - 'preview': 1, - 'staging': 2, - 'production': 10 - }, - }, - - 'notify-api-db-migration': { - 'NOTIFY_APP_NAME': 'api', - 'instances': { - 'preview': 0, - 'staging': 0, - 'production': 0 - }, - }, - - 'notify-delivery-celery-beat': {'memory': '512M'}, - 'notify-delivery-worker-jobs': {'memory': '2G'}, - 'notify-delivery-worker-research': {}, - 'notify-delivery-worker-sender': {'disk_quota': '2G', 'memory': '4G'}, - 'notify-delivery-worker-periodic': {}, - 'notify-delivery-worker-reporting': { - 'additional_env_vars': { - 'CELERYD_PREFETCH_MULTIPLIER': 1, - } - }, - 'notify-delivery-worker-priority': {}, - 'notify-delivery-worker-letters': {'memory': '2G'}, - 'notify-delivery-worker-retry-tasks': {}, - 'notify-delivery-worker-internal': {}, - 'notify-delivery-worker-broadcasts': { - 'additional_env_vars': { - 'CELERYD_PREFETCH_MULTIPLIER': 1, - 'CBC_PROXY_AWS_ACCESS_KEY_ID': CBC_PROXY_AWS_ACCESS_KEY_ID, - 'CBC_PROXY_AWS_SECRET_ACCESS_KEY': CBC_PROXY_AWS_SECRET_ACCESS_KEY, - } - }, - 'notify-delivery-worker-receipts': {}, - 'notify-delivery-worker-service-callbacks': {'disk_quota': '2G'}, - 'notify-delivery-worker-save-api-notifications': {'disk_quota': '2G'}, -} -%} - -{%- set app = app_vars[CF_APP] -%} -{%- set instance_count = app.get('instances', {}).get(environment) -%} - ---- - -applications: - - name: {{ CF_APP }} - buildpack: python_buildpack - {% if instance_count is not none %} - instances: {{ instance_count }} - {%- endif %} - memory: {{ app.get('memory', '1G') }} - disk_quota: {{ app.get('disk_quota', '1G')}} - - routes: - {%- for route in app.get('routes', {}).get(environment, []) %} - - route: {{ route }} - {%- endfor%} - - route: {{ CF_APP }}-{{ environment }}.cloudapps.digital - health-check-type: {{ app.get('health-check-type', 'process') }} - health-check-invocation-timeout: {{ app.get('health-check-invocation-timeout', 1) }} - - services: - - notify-db - - notify-redis - - logit-ssl-syslog-drain - {% if CF_APP == 'notify-api' %} - - notify-prometheus - - notify-splunk - {% endif %} - - env: - NOTIFY_APP_NAME: {{ app.get('NOTIFY_APP_NAME', CF_APP.replace('notify-', '')) }} - NOTIFY_LOG_PATH: /home/vcap/logs/app.log - SQLALCHEMY_POOL_SIZE: {{ app.get('sqlalchemy_pool_size', 1) }} - FLASK_APP: application.py - NOTIFY_ENVIRONMENT: {{ environment }} - - # Credentials variables - ADMIN_BASE_URL: '{{ ADMIN_BASE_URL }}' - INTERNAL_CLIENT_API_KEYS: '{{ INTERNAL_CLIENT_API_KEYS | tojson }}' - API_HOST_NAME: '{{ API_HOST_NAME }}' - DANGEROUS_SALT: '{{ DANGEROUS_SALT }}' - SECRET_KEY: '{{ SECRET_KEY }}' - ROUTE_SECRET_KEY_1: '{{ ROUTE_SECRET_KEY_1 }}' - ROUTE_SECRET_KEY_2: '{{ ROUTE_SECRET_KEY_2 }}' - CRONITOR_KEYS: '{{ CRONITOR_KEYS | tojson }}' - METRICS_BASIC_AUTH_TOKEN: {{ METRICS_BASIC_AUTH_TOKEN }} - - HIGH_VOLUME_SERVICE: '{{ HIGH_VOLUME_SERVICE | tojson }}' - - DOCUMENT_DOWNLOAD_API_HOST: '{{ DOCUMENT_DOWNLOAD_API_HOST }}' - DOCUMENT_DOWNLOAD_API_KEY: '{{ DOCUMENT_DOWNLOAD_API_KEY }}' - - NOTIFICATION_QUEUE_PREFIX: '{{ NOTIFICATION_QUEUE_PREFIX }}' - AWS_ACCESS_KEY_ID: '{{ AWS_ACCESS_KEY_ID }}' - AWS_SECRET_ACCESS_KEY: '{{ AWS_SECRET_ACCESS_KEY }}' - - STATSD_HOST: "notify-statsd-exporter-{{ environment }}.apps.internal" - - ZENDESK_API_KEY: '{{ ZENDESK_API_KEY }}' - - MMG_API_KEY: '{{ MMG_API_KEY }}' - MMG_INBOUND_SMS_AUTH: '{{ MMG_INBOUND_SMS_AUTH | tojson }}' - MMG_INBOUND_SMS_USERNAME: '{{ MMG_INBOUND_SMS_USERNAME | tojson }}' - - FIRETEXT_API_KEY: '{{ FIRETEXT_API_KEY }}' - FIRETEXT_INTERNATIONAL_API_KEY: '{{ FIRETEXT_INTERNATIONAL_API_KEY }}' - FIRETEXT_INBOUND_SMS_AUTH: '{{ FIRETEXT_INBOUND_SMS_AUTH | tojson }}' - - TEMPLATE_PREVIEW_API_HOST: '{{ TEMPLATE_PREVIEW_API_HOST }}' - TEMPLATE_PREVIEW_API_KEY: '{{ TEMPLATE_PREVIEW_API_KEY }}' - - DVLA_EMAIL_ADDRESSES: '{{ DVLA_EMAIL_ADDRESSES | tojson }}' - - {% for key, value in app.get('additional_env_vars', {}).items() %} - {{key}}: '{{value}}' - {% endfor %} From def35bf402947b0d3c664bddeb1c8cca264b3a80 Mon Sep 17 00:00:00 2001 From: Ryan Ahearn Date: Fri, 2 Sep 2022 11:49:51 -0400 Subject: [PATCH 2/2] Pass ADMIN_CLIENT_SECRET through deploy process --- .github/workflows/deploy.yml | 15 ++++++++------- manifest.yml | 5 ++--- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index cdb501850..f596c5b24 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -35,8 +35,9 @@ jobs: - name: Deploy to cloud.gov uses: 18f/cg-deploy-action@main env: - DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }} - SECRET_KEY: ${{ secrets.SECRET_KEY }} + DANGEROUS_SALT: ${{ secrets.PROD_DANGEROUS_SALT }} + SECRET_KEY: ${{ secrets.PROD_SECRET_KEY }} + ADMIN_CLIENT_SECRET: ${{ secrets.PROD_ADMIN_CLIENT_SECRET }} AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} with: @@ -44,11 +45,11 @@ jobs: cf_password: ${{ secrets.cloudgov_password }} cf_org: gsa-10x-prototyping cf_space: 10x-notifications - full_command: | - cf push --strategy rolling \ - --var DANGEROUS_SALT="$DANGEROUS_SALT" \ - --var SECRET_KEY="$SECRET_KEY" \ - --var AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" \ + push_arguments: >- + --var DANGEROUS_SALT="$DANGEROUS_SALT" + --var SECRET_KEY="$SECRET_KEY" + --var ADMIN_CLIENT_SECRET="$ADMIN_CLIENT_SECRET" + --var AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" --var AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" bail: diff --git a/manifest.yml b/manifest.yml index fc7f6d37d..ca6ea42eb 100644 --- a/manifest.yml +++ b/manifest.yml @@ -27,9 +27,10 @@ applications: NOTIFICATION_QUEUE_PREFIX: prototype_10x STATSD_HOST: localhost - INTERNAL_CLIENT_API_KEYS: '{"notify-admin":["dev-notify-secret-key"]}' + INTERNAL_CLIENT_API_KEYS: '{"notify-admin":["((ADMIN_CLIENT_SECRET))"]}' # Credentials variables + ADMIN_CLIENT_SECRET: ((ADMIN_CLIENT_SECRET)) DANGEROUS_SALT: ((DANGEROUS_SALT)) SECRET_KEY: ((SECRET_KEY)) AWS_REGION: us-west-2 @@ -37,5 +38,3 @@ applications: AWS_US_TOLL_FREE_NUMBER: +18446120782 DVLA_EMAIL_ADDRESSES: [] - - NOTIFY_EMAIL_DOMAIN: dispostable.com