working with abra recipe lint

2025-11-06 14:06:33 -05:00
parent 54acd65edd
commit 9c6bb70b7a
3 changed files with 71 additions and 71 deletions
--- a/.env.sample
+++ b/.env.sample
@ -10,16 +10,21 @@ LETS_ENCRYPT_ENV=production
 ##############################################################################
 # SECRETS
 ##############################################################################
-SECRET_DJANGO_SECRET_KEY_VERSION=v1
-SECRET_OIDC_RP_CLIENT_SECRET_VERSION=v1
-SECRET_DJANGO_SUPERUSER_PASSWORD_VERSION=v1
-SECRET_MINIO_ROOT_PASSWORD_VERSION=v1
-SECRET_COLLABORATION_SERVER_SECRET_VERSION=v1
-SECRET_POSTGRES_PASSWORD_VERSION=v1
-SECRET_DB_PASSWORD_VERSION=v1
-
-MINIO_ROOT_PASSWORD_FILE="/run/secrets/minio_pass"
-POSTGRES_PASSWORD_FILE="/run/secrets/postgres_pass"
+# abbreviations are to fit abra 12 char secret recommendation
+# DJANGO_SECRET_KEY
+SECRET_DJANGO_SK_VERSION=v1
+# ODIC_RP_CLIENT_SECRET
+SECRET_OIDC_RPCS_VERSION=v1
+# DJANGO_SUPERUSER_PASSWORD
+SECRET_DJANGO_SP_VERSION=v1
+# MINIO_ROOT_PASSWORD
+SECRET_MINIO_RP_VERSION=v1
+# COLLABORATION_SERVER_SECRET
+SECRET_COLLAB_SS_VERSION=v1
+# POSTGRES_PASSWORD
+SECRET_POSTGRES_P_VERSION=v1
+# Y_PROVIDER_API_KEY
+SECRET_Y_API_KEY_VERSION=v1

 ##############################################################################
 # EMAIL
--- a/abra-entrypoint.sh
+++ b/abra-entrypoint.sh
@ -1,14 +1,14 @@
 #!/bin/sh
 set -e

-[ -f /run/secrets/postgres_password ] && export DB_PASSWORD="$(cat /run/secrets/postgres_password)"
-#[ -f /run/secrets/postgres_password ] && export POSTGRES_PASSWORD="$(cat /run/secrets/postgres_password)"
-[ -f /run/secrets/django_secret_key ] && export DJANGO_SECRET_KEY="$(cat /run/secrets/django_secret_key)"
-[ -f /run/secrets/minio_root_password ] && export MINIO_ROOT_PASSWORD="$(cat /run/secrets/minio_root_password)"
-[ -f /run/secrets/minio_root_password ] && export AWS_S3_SECRET_ACCESS_KEY="$(cat /run/secrets/minio_root_password)"
-[ -f /run/secrets/django_superuser_password ] && export DJANGO_SUPERUSER_PASSWORD="$(cat /run/secrets/django_superuser_password)"
-[ -f /run/secrets/oidc_rp_client_secret ] && export OIDC_RP_CLIENT_SECRET="$(cat /run/secrets/oidc_rp_client_secret)"
-[ -f /run/secrets/collaboration_server_secret ] && export COLLABORATION_SERVER_SECRET="$(cat /run/secrets/collaboration_server_secret)"
+[ -f /run/secrets/postgres_p ] && export DB_PASSWORD="$(cat /run/secrets/postgres_p)"
+[ -f /run/secrets/django_sk ] && export DJANGO_SECRET_KEY="$(cat /run/secrets/django_sk)"
+[ -f /run/secrets/minio_rp ] && export MINIO_ROOT_PASSWORD="$(cat /run/secrets/minio_rp)"
+[ -f /run/secrets/minio_rp ] && export AWS_S3_SECRET_ACCESS_KEY="$(cat /run/secrets/minio_rp)"
+[ -f /run/secrets/django_sp ] && export DJANGO_SUPERUSER_PASSWORD="$(cat /run/secrets/django_sp)"
+[ -f /run/secrets/oidc_rpcs ] && export OIDC_RP_CLIENT_SECRET="$(cat /run/secrets/oidc_rpcs)"
+[ -f /run/secrets/collab_ss ] && export COLLABORATION_SERVER_SECRET="$(cat /run/secrets/collab_ss)"
+[ -f /run/secrets/y_api_key ] && export Y_PROVIDER_API_KEY="$(cat /run/secrets/y_api_key)"

 # if not in "env" mode, then execute the original entrypoint and command
 if [ ! "$1" = "-e" ]; then
--- a/compose.yml
+++ b/compose.yml
@ -57,7 +57,7 @@ x-postgres-env: &postgres-env
  # Postgresql db container configuration
  POSTGRES_DB: docs
  POSTGRES_USER: docs
-  POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
+  POSTGRES_PASSWORD_FILE: /run/secrets/postgres_p
  # App database configuration
  DB_HOST: db
  DB_NAME: docs
@ -67,8 +67,7 @@ x-postgres-env: &postgres-env

 x-yprovider-env: &yprovider-env
  COLLABORATION_LOGGING: "true"
-  # FIXME: Move to docker secret
-  Y_PROVIDER_API_KEY: foobar
+  # Y_PROVIDER_API_KEY supplied via secrets
  COLLABORATION_API_URL: http://y-provider:4444/api/
  COLLABORATION_SERVER_ORIGIN: https://${DOMAIN}
  # COLLABORATION_SERVER_SECRET supplied via secrets
@ -77,7 +76,7 @@ x-yprovider-env: &yprovider-env

 x-minio-env: &minio-env
  MINIO_ROOT_USER: user
-  # MINIO_ROOT_PASSWORD supplied via secrets
+  MINIO_ROOT_PASSWORD_FILE: /run/secrets/minio_rp

 services:
  app:
@ -115,12 +114,13 @@ services:
        target: /abra-entrypoint.sh
        mode: 0555
    secrets:
-      - django_secret_key
-      - oidc_rp_client_secret
-      - django_superuser_password
-      - collaboration_server_secret
-      - minio_root_password
-      - postgres_password
+      - django_sk
+      - django_sp
+      - oidc_rpcs
+      - collab_ss
+      - minio_rp
+      - postgres_p
+      - y_api_key

  celery:
    image: lasuite/impress-backend:v3.4.2
@ -135,12 +135,13 @@ services:
        target: /abra-entrypoint.sh
        mode: 0555
    secrets:
-      - django_secret_key
-      - oidc_rp_client_secret
-      - django_superuser_password
-      - collaboration_server_secret
-      - minio_root_password
-      - postgres_password
+      - django_sk
+      - django_sp
+      - oidc_rpcs
+      - collab_ss
+      - minio_rp
+      - postgres_p
+      - y_api_key


  y-provider:
@ -156,12 +157,13 @@ services:
        mode: 0555
    # NOTE: healthcheck - `wget` is available in the container, but `wget http://localhost:4444` gives a 403
    secrets:
-      - django_secret_key
-      - oidc_rp_client_secret
-      - django_superuser_password
-      - collaboration_server_secret
-      - minio_root_password
-      - postgres_password
+      - django_sk
+      - django_sp
+      - oidc_rpcs
+      - collab_ss
+      - minio_rp
+      - postgres_p
+      - y_api_key

  db:
    image: postgres:16
@ -193,12 +195,12 @@ services:
          target: /abra-entrypoint.sh
          mode: 0555
    secrets:
-      - django_secret_key
-      - oidc_rp_client_secret
-      - django_superuser_password
-      - collaboration_server_secret
-      - minio_root_password
-      - postgres_password
+      - django_sk
+      - django_sp
+      - oidc_rpcs
+      - collab_ss
+      - minio_rp
+      - postgres_p

  redis:
    image: redis:8
@ -213,7 +215,7 @@ services:
      - backend 
 #    entrypoint: ["/abra-entrypoint.sh"]
    entrypoint: >
-      sh -c "MINIO_ROOT_PASSWORD=\"\$$(cat /run/secrets/minio_root_password)\" &&
+      sh -c "MINIO_ROOT_PASSWORD=\"\$$(cat /run/secrets/minio_rp)\" &&
      /usr/bin/mc alias set docs http://minio:9000 \$${MINIO_ROOT_USER} \"\$${MINIO_ROOT_PASSWORD}\" &&
      /usr/bin/mc mb --ignore-existing docs/docs-media-storage &&
      /usr/bin/mc version enable docs/docs-media-storage &&
@ -224,12 +226,7 @@ services:
      restart_policy:
        condition: none
    secrets:
-      - django_secret_key
-      - oidc_rp_client_secret
-      - django_superuser_password
-      - collaboration_server_secret
-      - minio_root_password
-      - postgres_password
+      - minio_rp

  minio:
    image: minio/minio:RELEASE.2025-05-24T17-08-30Z
@ -254,12 +251,7 @@ services:
        target: /abra-entrypoint.sh
        mode: 0555
    secrets:
-      - django_secret_key
-      - oidc_rp_client_secret
-      - django_superuser_password
-      - collaboration_server_secret
-      - minio_root_password
-      - postgres_password
+      - minio_rp

  web:
    image: nginx:1.29
@ -303,21 +295,24 @@ configs:
    file: abra-entrypoint.sh

 secrets:
-  django_secret_key:
+  django_sk:
    external: true
-    name: ${STACK_NAME}_django_secret_key_${SECRET_DJANGO_SECRET_KEY_VERSION}
-  oidc_rp_client_secret:
+    name: ${STACK_NAME}_django_sk_${SECRET_DJANGO_SK_VERSION}
+  oidc_rpcs:
    external: true
-    name: ${STACK_NAME}_oidc_rp_client_secret_${SECRET_OIDC_RP_CLIENT_SECRET_VERSION}
-  django_superuser_password:
+    name: ${STACK_NAME}_oidc_rpcs_${SECRET_OIDC_RPCS_VERSION}
+  django_sp:
    external: true
-    name: ${STACK_NAME}_django_superuser_password_${SECRET_DJANGO_SUPERUSER_PASSWORD_VERSION}
-  postgres_password:
+    name: ${STACK_NAME}_django_sp_${SECRET_DJANGO_SP_VERSION}
+  postgres_p:
    external: true
-    name: ${STACK_NAME}_postgres_password_${SECRET_POSTGRES_PASSWORD_VERSION}
-  collaboration_server_secret:
+    name: ${STACK_NAME}_postgres_p_${SECRET_POSTGRES_P_VERSION}
+  collab_ss:
    external: true
-    name: ${STACK_NAME}_collaboration_server_secret_${SECRET_COLLABORATION_SERVER_SECRET_VERSION}
-  minio_root_password:
+    name: ${STACK_NAME}_collab_ss_${SECRET_COLLAB_SS_VERSION}
+  minio_rp:
    external: true
-    name: ${STACK_NAME}_minio_root_password_${SECRET_MINIO_ROOT_PASSWORD_VERSION}
+    name: ${STACK_NAME}_minio_rp_${SECRET_MINIO_RP_VERSION}
+  y_api_key:
+    external: true
+    name: ${STACK_NAME}_y_api_key_${SECRET_Y_API_KEY_VERSION}