Skip to content

Commit dbcc892

Browse files
tobiastobias
committed
Consolidate config; read sensitive values from SSM
This gets rid of config merging, and instead uses a single configuration file that reads sensitive values from AWS SSM parameters in production.
1 parent f64438e commit dbcc892

File tree

8 files changed

+88
-87
lines changed

8 files changed

+88
-87
lines changed

‎README.md‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -136,26 +136,23 @@ configuration. This can be done by `lein run`.
136136
Deployment
137137
----------
138138

139-
See the [Deployment instructions](https://github.com/clojars/clojars-server-config#deployment) in the
140-
[clojars-server-config repo](https://github.com/clojars/clojars-server-config).
139+
See the [Deployment instructions](https://github.com/clojars/infrastructure#deployment) in the
140+
[infrastructure repo](https://github.com/clojars/infrastructure).
141141

142142
Also see [Configuration](#configuration).
143143

144144
Configuration
145145
-------------
146146

147-
The default configuration is loaded from
148-
`resources/default_config.edn`. To override values from the default
149-
config, place them in map in an edn file, and specify the path to that
150-
file via the `CLOJARS_EXTRA_CONFIG` environment variable.
147+
The configuration is loaded from `resources/config.edn`.
151148

152149
When running automated tests at the repl, or with `lein test`, a test environment
153150
is used to provide isolation. It can be found in `test/clojars/test/test_helper.clj`.
154151

155152
License
156153
-------
157154

158-
Copyright © 2009-2022 Alex Osborne, Phil Hagelberg, Nelson Morris,
155+
Copyright © 2009-2023 Alex Osborne, Phil Hagelberg, Nelson Morris,
159156
Toby Crawley, Daniel Compton and
160157
[contributors](https://github.com/clojars/clojars-web/graphs/contributors).
161158

‎project.clj‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -91,16 +91,17 @@
9191
org.apache.xmlgraphics/batik-svggen]]
9292

9393
;; logging
94-
[org.clojure/tools.logging "1.2.3"]
94+
[org.clojure/tools.logging "1.2.4"]
9595
[ch.qos.logback/logback-classic "1.3.0-alpha5"
9696
:exclusions [com.sun.mail/javax.mail]]
9797
;; Upgrading for compatibility with logback 1.3.x
9898
[org.slf4j/jcl-over-slf4j "2.0.0-alpha1"]
9999

100100
;; AWS
101-
[com.cognitect.aws/api "0.8.539"]
102-
[com.cognitect.aws/endpoints "1.1.12.129"]
103-
[com.cognitect.aws/s3 "814.2.991.0"]]
101+
[com.cognitect.aws/api "0.8.635"]
102+
[com.cognitect.aws/endpoints "1.1.12.373"]
103+
[com.cognitect.aws/s3 "825.2.1250.0"]
104+
[com.cognitect.aws/ssm "825.2.1283.0"]]
104105
:plugins [[supersport "1"]]
105106
:main ^:skip-aot clojars.main
106107
:target-path "target/%s/"

‎resources/config.edn‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{:base-url "https://clojars.org"
2+
:bcrypt-work-factor 12
3+
:bind "127.0.0.1"
4+
:cdn-token #profile {:production #ssm-parameter "/clojars/production/cdn_token"
5+
:default nil}
6+
:cdn-url "https://repo.clojars.org"
7+
:db {:dbtype "postgresql"
8+
:dbname "clojars"
9+
:host #profile {:production #ssm-parameter "/clojars/production/db_host"
10+
:default "localhost"}
11+
:port #profile {:default 55432
12+
:test #or [#env DB_PORT 55433]
13+
:production 5432}
14+
:user "clojars"
15+
:password #profile {:production #ssm-parameter "/clojars/production/db_user"
16+
:default "clojars"}}
17+
:deletion-backup-dir #profile {:production "/home/clojars/repo-deleted"
18+
:default "data/test/repo-backup"}
19+
:github-oauth {:client-id #profile {:production #ssm-parameter "/clojars/production/github_oauth_client_id"
20+
:default "testing"}
21+
:client-secret #profile {:production #ssm-parameter "/clojars/production/github_oauth_client_secret"
22+
:default "testing"}
23+
:callback-uri "https://clojars.org/oauth/github/callback"}
24+
:gitlab-oauth {:client-id #profile {:production #ssm-parameter "/clojars/production/gitlab_oauth_client_id"
25+
:default "testing"}
26+
:client-secret #profile {:production #ssm-parameter "/clojars/production/gitlab_oauth_client_secret"
27+
:default "testing"}
28+
:callback-uri "https://clojars.org/oauth/gitlab/callback"}
29+
:index-path "data/index"
30+
:mail {:from "contact@clojars.org"
31+
:hostname "127.0.0.1"
32+
:tls? false}
33+
:nrepl-port 7991
34+
:port #profile {:default 8080
35+
:test 0
36+
:production 8001}
37+
:repo #profile {:production "repo"
38+
:test "data/test/repo"
39+
:default "data/dev_repo"}
40+
:s3 {:repo-bucket #profile {:production "clojars-repo-production"
41+
:default "clojars-repo-development"}
42+
:stats-bucket #profile {:production "clojars-stats-production"
43+
:default "clojars-stats-development"}}
44+
:sentry-dsn #profile {:production #ssm-parameter "/clojars/production/sentry_dsn"
45+
:default nil}
46+
:stats-dir "data/stats"}

‎resources/default_config.edn‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

‎src/clojars/config.clj‎

Lines changed: 31 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,35 @@
22
(:require
33
[aero.core :as aero]
44
[clojure.java.io :as io]
5-
[meta-merge.core :refer [meta-merge]]))
5+
[cognitect.aws.client.api :as aws]))
66

7-
(defn get-extra-config-path
7+
(defn- ssm-client
88
[]
9-
(System/getenv "CLOJARS_EXTRA_CONFIG"))
9+
(aws/client {:api :ssm}))
1010

11-
;; We attempt to read a file defined by the CLOJARS_EXTRA_CONFIG env
12-
;; var at load time. This is used to load production configuration.
13-
(defn merge-extra-config
14-
[default-config]
15-
(meta-merge
16-
default-config
17-
(when-let [extra-config (get-extra-config-path)]
18-
(aero/read-config extra-config))))
11+
(defn- throw-on-error
12+
[v]
13+
(if (some? (:cognitect.anomalies/category v))
14+
(throw (ex-info "SSM request failed" v))
15+
v))
16+
17+
(defn- get-parameter-value
18+
[param-name]
19+
(->> {:op :GetParameter
20+
:request {:Name param-name
21+
:WithDecryption true}}
22+
(aws/invoke (ssm-client))
23+
(throw-on-error)
24+
(:Parameter)
25+
(:Value)))
26+
27+
(def ^:dynamic *profile* "development")
28+
29+
(defmethod aero/reader 'ssm-parameter
30+
[_opts _tag value]
31+
(if (= :production *profile*)
32+
(get-parameter-value value)
33+
""))
1934

2035
(defn jdbc-url [db-config]
2136
(if (string? db-config)
@@ -34,13 +49,10 @@
3449

3550
(defn- load-config
3651
[profile]
37-
(-> (io/resource "default_config.edn")
52+
(-> (io/resource "config.edn")
3853
(aero/read-config {:profile profile})
39-
(merge-extra-config)
4054
(translate)))
4155

42-
(def ^:dynamic *profile* "development")
43-
4456
(def config*
4557
(memoize load-config))
4658

@@ -51,6 +63,7 @@
5163
- CLOJARS_ENVIRONMENT environment variable
5264
- *profile* dynamic var (defaults to \"development\")"
5365
[]
54-
(let [env (keyword (or (System/getenv "CLOJARS_ENVIRONMENT")
55-
*profile*))]
56-
(config* env)))
66+
(let [profile (keyword (or (System/getenv "CLOJARS_ENVIRONMENT")
67+
*profile*))]
68+
(binding [*profile* profile]
69+
(config* profile))))

‎src/clojars/main.clj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929

3030
(defn error-reporter [config]
3131
(let [dsn (:sentry-dsn config)]
32-
(if (and dsn (not= "NOTSET" dsn))
32+
(if dsn
3333
(let [raven-reporter (err/raven-error-reporter {:dsn dsn})]
3434
(info "enabling raven-clj client dsn:project-id:" (:project-id (raven-clj/parse-dsn dsn)))
3535
(Thread/setDefaultUncaughtExceptionHandler raven-reporter)

‎src/clojars/storage.clj‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -92,9 +92,7 @@
9292

9393
(defn- purge
9494
[cdn-token cdn-url path]
95-
(when (and cdn-token
96-
cdn-url
97-
(not= "NOTSET" cdn-token))
95+
(when (and cdn-token cdn-url)
9896
(let [{:keys [status] :as resp} (cdn/purge cdn-token cdn-url path)]
9997
(when (not= "ok" status)
10098
(throw (ex-info (format "Fastly purge failed for %s" path) resp))))))

‎test/clojars/unit/config_test.clj‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

0 commit comments

Comments
 (0)