mirror of
https://github.com/GSA/notifications-api.git
synced 2025-12-14 09:12:06 -05:00
94 lines
5.4 KiB
Markdown
94 lines
5.4 KiB
Markdown
# Infrastructure overview
|
|
|
|
A diagram of the system is available [in our compliance repo](https://github.com/GSA/us-notify-compliance/blob/main/diagrams/rendered/apps/application.boundary.png).
|
|
|
|
Notify is a Flask application running on [cloud.gov](https://cloud.gov), which also brokers access to a PostgreSQL database and Redis store.
|
|
|
|
In addition to the Flask app, Notify uses Celery to manage the task queue. Celery stores tasks in Redis.
|
|
|
|
## GitHub Repositories
|
|
|
|
Application, infrastructure, and compliance work is spread across several repositories:
|
|
|
|
### Application
|
|
|
|
* [notifications-api](https://github.com/GSA/notifications-api) for the API app
|
|
* [notifications-admin](https://github.com/GSA/notifications-admin) for the Admin UI app
|
|
* [notifications-utils](https://github.com/GSA/notifications-utils) for common library functions
|
|
|
|
### Infrastructure
|
|
|
|
In addition to terraform directories in the api and admin apps above:
|
|
|
|
#### We maintain:
|
|
|
|
* [usnotify-ssb](https://github.com/GSA/usnotify-ssb) A supplemental service broker that provisions SES and SNS for us
|
|
* [ttsnotify-brokerpak-sms](https://github.com/GSA/ttsnotify-brokerpak-sms) The brokerpak defining SNS (SMS sending)
|
|
|
|
#### We use:
|
|
|
|
* [datagov-brokerpak-smtp](https://github.com/GSA-TTS/datagov-brokerpak-smtp) The brokerpak defining SES
|
|
* [cg-egress-proxy](https://github.com/GSA-TTS/cg-egress-proxy/) The caddy proxy that allows external API calls
|
|
|
|
### Compliance
|
|
|
|
* [us-notify-compliance](https://github.com/GSA/us-notify-compliance) for OSCAL control documentation and diagrams
|
|
|
|
## Terraform
|
|
|
|
The cloud.gov environment is configured with Terraform. See [the `terraform` folder](../terraform/) to learn about that.
|
|
|
|
## AWS
|
|
|
|
In addition to services provisioned through cloud.gov, we have several services provisioned directly in AWS. Our AWS services are currently located in the us-west-2 region using the tts-sandbox account. We plan to move to GovCloud shortly.
|
|
|
|
To send messages, we use Amazon Web Services SNS and SES. In addition, we use AWS Pinpoint to provision and manage phone numbers, short codes, and long codes for sending SMS.
|
|
|
|
In SES, we are currently using the "sandbox" mode. This requires email addresses to be pre-registered in the AWS console in order to receive emails. The DKIM settings live under the verified domain entry.
|
|
|
|
In SNS, we have 3 topics for SMS receipts. These are not currently functional, so senders won't know the status of messages.
|
|
|
|
Through Pinpoint, the API needs at least one number so that the application itself can send SMS for authentication codes.
|
|
|
|
The API also has access to AWS S3 buckets for storing CSVs of messages and contact lists. It does not access a third S3 bucket that stores agency logos.
|
|
|
|
SES and SNS for use by the cloud.gov-deployed apps is currently in the process of migrating to being provisioned through cloud.gov. Currently, SES, SNS, and S3 for local-development are still manually provisioned in AWS.
|
|
|
|
## New Relic
|
|
|
|
We are using [New Relic](https://one.newrelic.com/nr1-core?account=3389907) for application monitoring and error reporting. When requesting access to New Relic, ask to be added to the Benefits-Studio subaccount.
|
|
|
|
## Onboarding
|
|
|
|
- [ ] Join [the GSA GitHub org](https://github.com/GSA/GitHub-Administration#join-the-gsa-organization)
|
|
- [ ] Get permissions for the repos
|
|
- [ ] Get access to the cloud.gov org && space
|
|
- [ ] Get [access to AWS](https://handbook.tts.gsa.gov/launching-software/infrastructure/#cloud-service-provider-csp-sandbox-accounts), if necessary
|
|
- [ ] Get [access to New Relic](https://handbook.tts.gsa.gov/tools/new-relic/#how-do-i-get-access-to-new-relic), if necessary
|
|
- [ ] Pull down creds from cloud.gov and create the local .env file
|
|
- [ ] Do stuff!
|
|
|
|
## Setting up the infrastructure
|
|
|
|
### Steps to prepare SES
|
|
|
|
1. After the first deploy of the application with the SSB-brokered SES service completes:
|
|
1. Log into the SES console and navigate to the SNS subscription page.
|
|
2. Select "Request confirmation" for any subscriptions still in "Pending Confirmation" state
|
|
2. (For sandbox SES accounts) Go to SES console for \$AWS_REGION and create new origin and destination emails. AWS will send a verification via email which you'll need to complete.
|
|
3. Find and replace instances in the repo of "testsender", "testreceiver" and "dispostable.com", with your origin and destination email addresses, which you verified in step 1 above.
|
|
|
|
TODO: create env vars for these origin and destination email addresses for the root service, and create new migrations to update postgres seed fixtures
|
|
|
|
### Steps to prepare SNS
|
|
|
|
1. Go to Pinpoints console for \$AWS_PINPOINT_REGION and choose "create new project", then "configure for sms"
|
|
2. Tick the box at the top to enable SMS, choose "transactional" as the default type and save
|
|
3. In the lefthand sidebar, go the "SMS and Voice" (bottom) and choose "Phone Numbers"
|
|
4. Under "Number Settings" choose "Request Phone Number"
|
|
5. Choose Toll-free number, tick SMS, untick Voice, choose "transactional", hit next and then "request"
|
|
6. Go to SNS console for \$AWS_PINPOINT_REGION, look at lefthand sidebar under "Mobile" and go to "Text Messaging (SMS)"
|
|
7. Scroll down to "Sandbox destination phone numbers" and tap "Add phone number" then follow the steps to verify (you'll need to be able to retrieve a code sent to each number)
|
|
|
|
At this point, you _should_ be able to complete both the email and phone verification steps of the Notify user sign up process! 🎉
|