refactor

2024-12-24 14:19:23 +01:00
parent 35dd2d38bf
commit a856f24132
22 changed files with 445 additions and 858 deletions
--- a/deploy/scripts/build-register-service-binary.sh
+++ b/deploy/scripts/build-register-service-binary.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o deploy/bin/register-service deploy/bin/register-service.go
--- a/deploy/scripts/gen-certs.sh
+++ b/deploy/scripts/gen-certs.sh
@@ -0,0 +1,255 @@
+# #!/bin/bash
+
+export DEPLOY_DIR="./deploy"
+export CERTS_DIR="${DEPLOY_DIR}/certs/"
+
+export REGISTRY_CN="registry.egommerce.local,api-registry,localhost"
+export REGISTRY_SAN="DNS:registry.egommerce.local,DNS:api-registry,DNS:localhost,IP:127.0.0.1"
+export GATEWAY_CN="gateway.egommerce.local,api-gatway,localhost"
+export GATEWAY_SAN="DNS:gateway.egommerce.local,DNS:api-gateway,DNS:gw.egommerce.local,DNS:localhost,IP:127.0.0.1"
+export VAULT_CN="vault.egommerce.local,api-vault,localhost"
+export VAULT_SAN="DNS:vault.egommerce.local,DNS:api-vault,DNS:localhost,IP:127.0.0.1"
+export EVENTBUS_CN="esb.egommerce.local,api-eventbus,localhost"
+export EVENTBUS_SAN="DNS:esb.egommerce.local,DNS:api-eventbus,DNS:localhost,IP:127.0.0.1"
+export CACHE_CN="cache.egommerce.local,api-cache,localhost"
+export CACHE_SAN="DNS:cache.egommerce.local,DNS:api-cache,DNS:localhost,IP:127.0.0.1"
+export LOGGER_CN="logger.egommerce.local,api-logger,localhost"
+export LOGGER_SAN="DNS:logger.egommerce.local,DNS:api-logger,DNS:localhost,IP:127.0.0.1"
+export PROMETHEUS_CN="prometheus.egommerce.local,api-prometheus,localhost"
+export PROMETHEUS_SAN="DNS:prometheus.egommerce.local,DNS:api-prometheus,DNS:localhost,IP:127.0.0.1"
+export GRAFANA_CN="grafana.egommerce.local,api-grafana,localhost"
+export GRAFANA_SAN="DNS:grafana.egommerce.local,DNS:api-grafana,DNS:localhost,IP:127.0.0.1"
+export POSTGRES_CN="postgresdb.egommerce.local,db-postgres,localhost"
+export POSTGRES_SAN="DNS:pstgresdb.egommerce.local,DNS:db-postgres,DNS:localhost,IP:127.0.0.1"
+export MONGO_CN="mongo.db.egommerce.local,db-mongo,localhost"
+export MONGO_SAN="DNS:mongo.db.egommerce.local,DNS:db-mongo,DNS:localhost,IP:127.0.0.1"
+export IDENTITY_CN="gateway.egommerce.local,identity.egommerce.local"
+export IDENTITY_SAN="DNS:gateway.egommerce.local,DNS:identity.egommerce.local,DNS:localhost,IP:127.0.0.1"
+export CATALOG_CN="gateway.egommerce.local, catalog.egommerce.local"
+export CATALOG_SAN="DNS:gateway.egommerce.local,DNS:catalog.egommerce.local,DNS:localhost,IP:127.0.0.1"
+export BASKET_CN="gateway.egommerce.local"
+export BASKET_SAN="DNS:gateway.egommerce.local,DNS:localhost,IP:127.0.0.1"
+export ORDER_CN="gateway.egommerce.local"
+export ORDER_SAN="DNS:gateway.egommerce.local,DNS:localhost,IP:127.0.0.1"
+export PRICING_CN="gateway.egommerce.local"
+export PRICING_SAN="DNS:gateway.egommerce.local,DNS:localhost,IP:127.0.0.1"
+
+# Create required directories
+mkdir -p \
+    ${CERTS_DIR} \
+    ${CERTS_DIR}ca-root \
+    ${CERTS_DIR}api-registry \
+    ${CERTS_DIR}api-gateway \
+    ${CERTS_DIR}api-vault \
+    ${CERTS_DIR}api-eventbus \
+    ${CERTS_DIR}api-cache \
+    ${CERTS_DIR}api-logger \
+    ${CERTS_DIR}api-prometheus \
+    ${CERTS_DIR}api-grafana \
+    ${CERTS_DIR}db-postgres \
+    ${CERTS_DIR}db-mongo \
+    ${CERTS_DIR}identity-svc \
+    ${CERTS_DIR}basket-svc \
+    ${CERTS_DIR}catalog-svc \
+    ${CERTS_DIR}order-svc \
+    ${CERTS_DIR}pricing-svc
+
+# Generate Root CA cert
+# openssl req -newkey rsa:2048 -nodes -x509 -days 1024 \
+#     -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/OU=DevOps Team/CN=Egommerce CA" \
+#     -keyout ${CERTS_DIR}ca-root/ca-root.key -out ${CERTS_DIR}ca-root/ca-root.crt >/dev/null
+
+
+# Generate Registry cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$REGISTRY_CN" \
+    -keyout ${CERTS_DIR}api-registry/api-registry.key \
+    -out ${CERTS_DIR}api-registry/api-registry.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}api-registry/api-registry.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${REGISTRY_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}api-registry/api-registry.crt >/dev/null
+
+
+# Generate Gateway cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$GATEWAY_CN" \
+    -keyout ${CERTS_DIR}api-gateway/api-gateway.key \
+    -out ${CERTS_DIR}api-gateway/api-gateway.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}api-gateway/api-gateway.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${GATEWAY_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}api-gateway/api-gateway.crt >/dev/null
+
+
+# Genearte Vault cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$VAULT_CN" \
+    -keyout ${CERTS_DIR}api-vault/api-vault.key \
+    -out ${CERTS_DIR}api-vault/api-vault.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}api-vault/api-vault.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${VAULT_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}api-vault/api-vault.crt >/dev/null
+
+
+# Genearte Eventbus cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$EVENTBUS_CN" \
+    -keyout ${CERTS_DIR}api-eventbus/api-eventbus.key \
+    -out ${CERTS_DIR}api-eventbus/api-eventbus.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}api-eventbus/api-eventbus.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${EVENTBUS_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}api-eventbus/api-eventbus.crt >/dev/null
+
+
+# Genearte Cache cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$CACHE_CN" \
+    -keyout ${CERTS_DIR}api-cache/api-cache.key \
+    -out ${CERTS_DIR}api-cache/api-cache.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}api-cache/api-cache.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${CACHE_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}api-cache/api-cache.crt >/dev/null
+
+
+# Genearte Logger cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$LOGGER_CN" \
+    -keyout ${CERTS_DIR}api-logger/api-logger.key \
+    -out ${CERTS_DIR}api-logger/api-logger.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}api-logger/api-logger.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${LOGGER_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}api-logger/api-logger.crt >/dev/null
+
+
+# Genearte Prometheus cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$PROMETHEUS_CN" \
+    -keyout ${CERTS_DIR}api-prometheus/api-prometheus.key \
+    -out ${CERTS_DIR}api-prometheus/api-prometheus.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}api-prometheus/api-prometheus.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${PROMETHEUS_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}api-prometheus/api-prometheus.crt >/dev/null
+
+
+# Genearte Grafana cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$GRAFANA_CN" \
+    -keyout ${CERTS_DIR}api-grafana/api-grafana.key \
+    -out ${CERTS_DIR}api-grafana/api-grafana.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}api-grafana/api-grafana.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${GRAFANA_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}api-grafana/api-grafana.crt >/dev/null
+
+
+# Genearte Postgres cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$POSTGRES_CN" \
+    -keyout ${CERTS_DIR}db-postgres/db-postgres.key \
+    -out ${CERTS_DIR}db-postgres/db-postgres.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}db-postgres/db-postgres.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${POSTGRES_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}db-postgres/db-postgres.crt >/dev/null
+
+
+# Genearte Mongo cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$MONGO_CN" \
+    -keyout ${CERTS_DIR}db-mongo/db-mongo.key \
+    -out ${CERTS_DIR}db-mongo/db-mongo.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}db-mongo/db-mongo.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${MONGO_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}db-mongo/db-mongo.crt >/dev/null
+
+
+# Genearte Identity cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$IDENTITY_CN" \
+    -keyout ${CERTS_DIR}identity-svc/identity-svc.key \
+    -out ${CERTS_DIR}identity-svc/identity-svc.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}identity-svc/identity-svc.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${IDENTITY_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}identity-svc/identity-svc.crt >/dev/null
+
+
+# Genearte Basket cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$BASKET_CN" \
+    -keyout ${CERTS_DIR}basket-svc/basket-svc.key \
+    -out ${CERTS_DIR}basket-svc/basket-svc.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}basket-svc/basket-svc.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${BASKET_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}basket-svc/basket-svc.crt >/dev/null
+
+
+# Genearte Catalog cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$CATALOG_CN" \
+    -keyout ${CERTS_DIR}catalog-svc/catalog-svc.key \
+    -out ${CERTS_DIR}catalog-svc/catalog-svc.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}catalog-svc/catalog-svc.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${CATALOG_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}catalog-svc/catalog-svc.crt >/dev/null
+
+
+# Genearte Order cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$ORDER_CN" \
+    -keyout ${CERTS_DIR}order-svc/order-svc.key \
+    -out ${CERTS_DIR}order-svc/order-svc.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}order-svc/order-svc.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${ORDER_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}order-svc/order-svc.crt >/dev/null
+
+
+# Genearte Pricing cert
+openssl req -newkey rsa:2048 -nodes \
+    -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$PRICING_CN" \
+    -keyout ${CERTS_DIR}pricing-svc/pricing-svc.key \
+    -out ${CERTS_DIR}pricing-svc/pricing-svc.csr >/dev/null
+
+openssl x509 -req -days 365 \
+    -in ${CERTS_DIR}pricing-svc/pricing-svc.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
+    -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${PRICING_SAN}")) \
+    -CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
+    -out ${CERTS_DIR}pricing-svc/pricing-svc.crt >/dev/null
--- a/deploy/scripts/remove-dangling-images.sh
+++ b/deploy/scripts/remove-dangling-images.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+docker rmi $(docker images --filter "dangling=true" -q --no-trunc)
--- a/deploy/scripts/start-docker.sh
+++ b/deploy/scripts/start-docker.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+# RUN IT FORM THE REPO ROOT DIR
+
+echo "Starting egommerce docker stack..."
+docker stack deploy --with-registry-auth --detach=false \
+    --compose-file deploy/docker/stack.yml \
+    --compose-file deploy/docker/stack.dev.yml \
+    --compose-file deploy/docker/stack.dev.local.yml \
+    egommerce
+
+echo "Done."
--- a/deploy/scripts/start-k8s.sh
+++ b/deploy/scripts/start-k8s.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# RUN IT FORM THE REPO ROOT DIR
+
+echo "Starting egommerce k8s stack..."
+
+kubectl apply -f deploy/k8s/stack.yml
+# kubectl apply -f deploy/k8s/stack.prod.yml
+# kubectl apply -f deploy/k8s/stack.dev.yml
+# kubectl apply -f deploy/k8s/stack.dev.local.yml
+
+
+echo "Done."
--- a/deploy/scripts/vault-init-template.sh
+++ b/deploy/scripts/vault-init-template.sh
@@ -0,0 +1,45 @@
+#!/bin/sh
+
+vault secrets enable pki
+vault secrets tune -max-lease-ttl=87600h pki
+
+vault write -field=certificate pki/root/generate/internal \
+        common_name="ego.io" \
+        ttl=87600h > CA_cert.crt
+
+vault write pki/config/urls \
+        issuing_certificates="https://127.0.0.1:8200/v1/pki/ca" \
+        crl_distribution_points="https://127.0.0.1:8200/v1/pki/crl"
+
+vault secrets enable -path=pki_int pki
+vault secrets tune -max-lease-ttl=43800h pki_int
+
+vault write -format=json pki_int/intermediate/generate/internal \
+        common_name="ego.io Intermediate Authority" \
+        | jq -r '.data.csr' > pki_intermediate.csr
+
+vault write -format=json pki/root/sign-intermediate csr=@pki_intermediate.csr \
+        format=pem_bundle ttl="43800h" \
+        | jq -r '.data.certificate' > intermediate.cert.pem
+
+vault write pki_int/intermediate/set-signed certificate=@intermediate.cert.pem
+
+vault write pki_int/roles/ego.io \
+  allowed_domains="ego.io" \
+  allow_subdomains=true \
+  generate_lease=true \
+  max_ttl="720h"
+
+vault write pki_int/issue/ego.io \
+  common_name="catalog.service.ego.io" \
+  ttl="24h" | tee certs.txt
+
+
+# CONFIGURE CONSUL
+mkdir -p /opt/consul/agent-certs
+
+grep -Pzo "(?s)(?<=certificate)[^\-]*.*?END CERTIFICATE[^\n]*\n" certs.txt | sed 's/^\s*-/-/g' > /opt/consul/agent-certs/agent.crt
+grep -Pzo "(?s)(?<=private_key)[^\-]*.*?END RSA PRIVATE KEY[^\n]*\n" certs.txt | sed 's/^\s*-/-/g' > /opt/consul/agent-certs/agent.key
+grep -Pzo "(?s)(?<=issuing_ca)[^\-]*.*?END CERTIFICATE[^\n]*\n" certs.txt | sed 's/^\s*-/-/g' > /opt/consul/agent-certs/ca.crt
+## FIXME ^^ invalid pattern flag...
+
--- a/deploy/scripts/volumes-restart.sh
+++ b/deploy/scripts/volumes-restart.sh