Deployment

[KDwevedi]

Tasklist for C4GT Credentialing Deployment

1. Fusion Auth

Official FA Compose Files

Note: Previous RCW Deployment was pointing to Konnect FA for JWKS. We should setup a dedicated instance for the following usecases:

1. JWKS YRI Required by Identity Service
2. Authentication required by BFF

2. Deploying Samagra RCW

• Devops Repo
  • Compose
  • .env

3. Data Migration

1. Old Prod Databases for Identity, Schema, Credential Services (See RCW, above) should be migrated.
   Droplet IP: 64.227.184.175
   Containers:

2dc2d135cb89   postgres:12.1-alpine               "docker-entrypoint.s…"    17 months ago   Up 4 months             0.0.0.0:4000->5432/tcp, :::4000->5432/tcp   c4gt-ulp-db-credential-ms-db-1
dadb8d9510cd   postgres:12.1-alpine               "docker-entrypoint.s…"    17 months ago   Up 4 months             0.0.0.0:4002->5432/tcp, :::4002->5432/tcp   c4gt-ulp-db-did-l3-db-1
3360eab05ce0   postgres:12.1-alpine               "docker-entrypoint.s…"    17 months ago   Up 4 months             0.0.0.0:4001->5432/tcp, :::4001->5432/tcp   c4gt-ulp-db-cred-schema-ms-db-1

2. Vault running at 139.59.20.91 contains relevant user data for identity service, that should be migrated to new deployment for rcw

4. C4GT BFF

• Compose File
• Sample .env

To be linked by @KDwevedi

[singhalkarun]

@KDwevedi we have following services already in our system

1. FusionAuth
2. Postgres - I believe we can use shared instance instead of multiple of them

Services to be deployed:

• Identity
• Schema
• Credential
• Vault
• BFF

Migrations to be done:

• Identity DB
• Schema DB
• Credential DB
• Vault Data

Do we have also have a rough idea on how much resources this requires as a system?

[KDwevedi]

The stack can share 2 vCPUs with ~4 GB RAM
This recommendation is based on using docker stats on my local setup w 8cores + 8GB RAM.

The usage for individual services should never spike beyond 1.5 vCPUs + 1-2GB RAM

The Most RAM intensive task is PDF rendering, which would by far take the most resources.

@techsavvyash does this sound fine for c4gt bff?

[techsavvyash]

This sounds fine to me! 👍🏼

[singhalkarun]

@techsavvyash @KDwevedi 2 Queries

1. Are we proceeding without fusionauth?
2. What all services need to be publicly accessible?

[KDwevedi]

@singhalkarun

1. Are we proceeding without fusionauth?

Yes

2. What all services need to be publicly accessible?

C4GT BFF, that's it

[singhalkarun]

@KDwevedi can you share docker-compose for bff?

[singhalkarun]

VAULT_ADDR=${VAULT_ADDR}
VAULT_TOKEN=${VAULT_TOKEN}
VAULT_BASE_URL=${VAULT_BASE_URL}
VAULT_ROOT_PATH=${VAULT_ROOT_PATH}
VAULT_TIMEOUT=${VAULT_TIMEOUT}
VAULT_PROXY=${VAULT_PROXY}

@KDwevedi also, can we cleanup the variables in services, I see redundancy, e.g., VAULT_ADDR VAULT_BASE_URL VAULT_PROXY seems to be same. Can you remove the redundancy from the compose shared and I will pick accordingly?

[KDwevedi]

This is the constructor for the vault client in identity service:

export class VaultService {
  private token: string;
  private vault: any;
  constructor() {
    this.token = process.env.VAULT_TOKEN;
    this.vault = new Vault({
      https: false,
      baseUrl: process.env.VAULT_BASE_URL,
      rootPath: process.env.VAULT_ROOT_PATH,
      timeout: process.env.VAULT_TIMEOUT,
      proxy: process.env.VAULT_PROXY === "true" ? true : false,
    });
  }

VAULT_BASE_URL, VAULT_PROXY are both used in the service and are distinct

VAULT_ADDR isn't used in Identity Service, can be removed from there

However VAULT_ADDR is also being passed to the vault image, where it might be necessary

vault:
  image: vault:1.12.3
  restart: always
  volumes:
    - ./vault.json:/vault/config/vault.json
    - ./data/vault-data:/vault/file
  environment:
    - VAULT_ADDR=${VAULT_ADDR}
    - VAULT_API_ADDR=${VAULT_API_ADDR}
    - VAULT_ADDRESS=${VAULT_ADDRESS}
  cap_add:
    - IPC_LOCK
  command: vault server -config=/vault/config/vault.json
  ports:
    - 8200:8200
  healthcheck:
    test:
      [
        "CMD-SHELL",
        "wget --spider http://127.0.0.1:8200/v1/sys/health || exit 1",
      ]
    interval: 10s
    timeout: 5s
    retries: 3

[singhalkarun]

Vault doesn't need any environment variable generally, we can remove, reference. Also, can you share the library which we are using for Vault? Unable to find those in https://www.npmjs.com/package/node-vault

[KDwevedi]

This is the library
https://www.npmjs.com/package/hashi-vault-js

[singhalkarun]

@KDwevedi updates on the docker compose for bff? We can deploy all the services here once bff is available and then start with migrations today

[KDwevedi]

@singhalkarun
added env and compose

• Compose File
• Sample .env