relaycorp / awala-pong Goto Github PK

Using relaycorp/relaynet-pohttp-js#3

Send them using fire-and-forget from current process. In the future, these should probably be send to a queue like Amazon SQS.

We'll probably have to use a service like https://requestbin.fullcontact.com/ to test that things work.

• Configure Docker / Docker Compose (inc. MongoDB container).
• Configure linter.
• Configure build automation.
• Configure test runner.
• Configure CIS.
• Etc.

The objective here is to deploy the app to GCP, but leverage Kubernetes as much as possible to avoid vendor lock-in.

We're currently creating a mock HTTP server that mimics the gateway and runs on the host computer, so the Pong queue can't reach it from within Kubernetes.

Instead of finding an awful workaround to make this mock server reachable from a pod, we should just deploy the public gateway. This is essentially what we're already doing in the Relaynet-Internet Gateway functional test suite: We're deploying both apps locally, and then using a PoWeb client to communicate with the Pong app.

Once we do this, we should also ditch Circle CI and move the functional test suite run into the existing GitHub Actions workflow.

To receive ping messages.

The scope of this ticket is to return the appropriate HTTP response per PoHTTP, without actually processing the parcel -- That'd be part of #2.

Then remove the implementation from the core lib as this is the last place where it's used.

This will require changing relaynet-pong to expose a script to do this and also relaynet-core-js to expose the certificate serial number in SessionlessEnvelopedData values.

Bull v3 only supports JSON serialization, so we have to base64-encode binary data like the service message in the parcel: OptimalBits/bull#1411

However, this is too inefficient performance- and storage-wise, so we should find a way to store buffers instead. Bull v4 may support that per the issue above.

• Implement storage/retrieval of ephemeral keys in channel session protocol (using MongoDB).
• Implement relaycorp/relaynet-core-js#24
• Integrate relaycorp/relaynet-core-js#16, relaycorp/relaynet-core-js#15 and relaycorp/relaynet-core-js#12

See counterpart: relaycorp/awala-ping-desktop#6

Specifying the current endpoint id in the ENDPOINT_KEY_ID environment variable makes it extremely cumbersome to bootstrap a new environment or do key rotation, so we should store that pointer to the current key id in a persistent data store like etcd or MongoDB.

• #609
• Integrate ConfigMap library. See relaycorp/cloud-gateway#87

I struggled to get this to work in #16 so I left the CircleCI job in .circleci/config.yml but disabled it.

For some reason it seems to get stuck at trying to compile the TS -> JS; e.g.: https://app.circleci.com/jobs/github/relaycorp/relaynet-pong/123

See also:

• https://circleci.com/docs/2.0/building-docker-images/
• https://circleci.com/docs/2.0/docker-compose/

To make sure we use tini when deploying the image on k8s.

https://github.com/krallin/tini

Using OpenCensus unless OpenTelemetry is production-ready.

Data will be pushed to Datadog.

So that we can ditch Vault in production and use GCP KMS instead.

For consistency with other Relaycorp server-side apps and to make it possible to use Kubernetes-specific functionality (needed for #26, for example).

The current implementation only supports one key pair at a time and the private key should be specified in the environment, which makes it hard to deploy and operate this app securely.

To solve this, we should integrate Hashicorp Vault, possibly along with istio to avoid having to manage Vault client credentials.

• Intro to prospective contributors.
• Document install instructions.
• README.

We're getting the following in prod after regenerating the key (relaycorp/cloud-pong#5):

UnknownKeyError: Key is not a node key
    at VaultPrivateKeyStore.fetchNodeKey (/opt/pong/node_modules/@relaycorp/relaynet-core/build/main/lib/keyStores/privateKeyStore.js:30:19)
    at processTicksAndRejections (internal/process/task_queues.js:94:5)

https://console.cloud.google.com/errors/CLzLyfK1oNKuLg?time=P30D&project=relaycorp-cloud-ping

They should be rotated every 6 months.

We could use a k8s CronJob.

Not sure when they broke, but they don't work with 5feabd8 at least. 56a2a0e may be the culprit, considering the error:

gateway_1  | FAIL build/main/functional_tests/main.test.js
gateway_1  |   ● Test suite failed to run
gateway_1  | 
gateway_1  |     Cannot find module '@relaycorp/keystore-vault' from 'main.test.js'
gateway_1  | 
gateway_1  |       1 | /* tslint:disable:no-let */
gateway_1  |     > 2 | import { VaultPrivateKeyStore } from '@relaycorp/keystore-vault';
gateway_1  |         | ^
gateway_1  |       3 | import {
gateway_1  |       4 |   Certificate,
gateway_1  |       5 |   EnvelopedData,
gateway_1  | 
gateway_1  |       at Resolver.resolveModule (node_modules/jest-resolve/build/index.js:259:17)
gateway_1  |       at Object.<anonymous> (src/functional_tests/main.test.ts:2:1)
gateway_1  | 
gateway_1  | Test Suites: 1 failed, 1 total
gateway_1  | Tests:       0 total
gateway_1  | Snapshots:   0 total
gateway_1  | Time:        0.914s
gateway_1  | Ran all test suites.

The odd thing is that the functional test suite works perfectly on Circle CI.