himari-aws 0.1.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +15 -0
- data/README.md +127 -14
- data/Rakefile +2 -0
- data/lambda/Dockerfile +40 -0
- data/lambda/Gemfile +35 -0
- data/lambda/Gemfile.lock +374 -0
- data/lambda/README.md +42 -0
- data/lambda/entrypoint.rb +5 -0
- data/lambda/terraform/README.md +92 -0
- data/lambda/terraform/functions/aws.tf +2 -0
- data/lambda/terraform/functions/dynamodb.tf +18 -0
- data/lambda/terraform/functions/lambda_rack.tf +66 -0
- data/lambda/terraform/functions/lambda_secrets_rotation.tf +33 -0
- data/lambda/terraform/functions/outputs.tf +19 -0
- data/lambda/terraform/functions/variables.tf +65 -0
- data/lambda/terraform/functions/versions.tf +7 -0
- data/lambda/terraform/iam/aws.tf +2 -0
- data/lambda/terraform/iam/outputs.tf +7 -0
- data/lambda/terraform/iam/role.tf +77 -0
- data/lambda/terraform/iam/variables.tf +44 -0
- data/lambda/terraform/iam/versions.tf +8 -0
- data/lambda/terraform/image/aws.tf +1 -0
- data/lambda/terraform/image/copy.tf +45 -0
- data/lambda/terraform/image/ecr.tf +42 -0
- data/lambda/terraform/image/outputs.tf +9 -0
- data/lambda/terraform/image/variables.tf +20 -0
- data/lambda/terraform/image/versions.tf +9 -0
- data/lambda/terraform/signing_key/aws.tf +1 -0
- data/lambda/terraform/signing_key/outputs.tf +3 -0
- data/lambda/terraform/signing_key/secret.tf +18 -0
- data/lambda/terraform/signing_key/variables.tf +24 -0
- data/lambda/terraform/signing_key/versions.tf +7 -0
- data/lib/himari/aws/dynamodb_storage.rb +41 -16
- data/lib/himari/aws/lambda_handler.rb +76 -0
- data/lib/himari/aws/secretsmanager_signing_key_provider.rb +8 -5
- data/lib/himari/aws/secretsmanager_signing_key_rotation_handler.rb +36 -9
- data/lib/himari/aws/version.rb +1 -1
- data/lib/himari-aws.rb +2 -0
- metadata +49 -10
- data/Gemfile +0 -12
- data/Gemfile.lock +0 -171
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 85a23ea8f8d589be0168080f22f979e78d26113119166ba0a99936448b74ed7c
|
|
4
|
+
data.tar.gz: 1837996eac719023197e7e56544c77b2b4d93426e6942cf60e37053bf007d2c5
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 6e74908b3c34af13b018436918b6a83f87d4180d28505348c9aba6e25024ddcab1cc323df5c151c2e45aa3ec00afb4d40b2fb2c7c6a9b6bc77193010a0d757ae
|
|
7
|
+
data.tar.gz: 2b5bcd9303a70d87b51c80ef9dead217844d13ec68b942941088aa3ba6e9398bd09419d102321600efa9e311c11ae596e23e404988bd8763e30d8c802cf9166b
|
data/CHANGELOG.md
ADDED
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
## [0.3.0] - 2026-06-03
|
|
2
|
+
|
|
3
|
+
### Enhancements
|
|
4
|
+
|
|
5
|
+
- Lambda image: copy the prebuilt image with skopeo instead of docker (gains an `architecture` input), with Terraform AWS provider v6 compatibility and a `role_name` output [#18](https://github.com/sorah/himari/pull/18)
|
|
6
|
+
- DynamoDB storage: compare-and-swap writes backing refresh-token rotation [#14](https://github.com/sorah/himari/pull/14)
|
|
7
|
+
- Lambda image: bundle `omniauth-entra-id` and `omniauth-okta`, depend explicitly on `aws-sdk-ssm` and `aws-sdk-secretsmanager`, and make `rack-cors` available.
|
|
8
|
+
|
|
9
|
+
### Changes
|
|
10
|
+
|
|
11
|
+
- Lambda image: Ruby 4.0, build on dnf, and rolled dependencies (including `apigatewayv2_rack` 0.5.0).
|
|
12
|
+
|
|
13
|
+
## [0.2.0] - 2023-03-22
|
|
14
|
+
|
|
15
|
+
- Initial release: `Himari::Aws::DynamodbStorage`, Secrets Manager signing key provider and rotation handler, prebuilt Lambda container image, and Terraform modules.
|
data/README.md
CHANGED
|
@@ -1,24 +1,137 @@
|
|
|
1
|
-
# Himari
|
|
1
|
+
# himari-aws: AWS related plugins for Himari
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
- DynamoDB storage backend
|
|
4
|
+
- Secrets Manager automatic rotation Lambda function for signing keys
|
|
5
|
+
- Secrets Manager signing key provider
|
|
6
|
+
- Lambda container image to host Himari itself (TODO)
|
|
4
7
|
|
|
5
|
-
|
|
8
|
+
## Deploy on Lambda with Terraform
|
|
6
9
|
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
TODO: Replace `UPDATE_WITH_YOUR_GEM_NAME_PRIOR_TO_RELEASE_TO_RUBYGEMS_ORG` with your gem name right after releasing it to RubyGems.org. Please do not do it earlier due to security reasons. Alternatively, replace this section with instructions to install your gem from git if you don't plan to release to RubyGems.org.
|
|
10
|
-
|
|
11
|
-
Install the gem and add to the application's Gemfile by executing:
|
|
10
|
+
- See [./lambda/terraform/](./lambda/terraform/) for quick deployment using Terraform modules.
|
|
12
11
|
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
If bundler is not being used to manage dependencies, install the gem by executing:
|
|
12
|
+
## Installation
|
|
16
13
|
|
|
17
|
-
|
|
14
|
+
```ruby
|
|
15
|
+
gem 'himari'
|
|
16
|
+
gem 'himari-aws'
|
|
17
|
+
gem 'nokogiri'
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
### IAM policy
|
|
21
|
+
|
|
22
|
+
```json
|
|
23
|
+
{
|
|
24
|
+
"Version": "2012-10-17",
|
|
25
|
+
"Statement": [
|
|
26
|
+
{
|
|
27
|
+
"Effect": "Allow",
|
|
28
|
+
"Action": [
|
|
29
|
+
"dynamodb:DeleteItem",
|
|
30
|
+
"dynamodb:Query",
|
|
31
|
+
"dynamodb:UpdateItem"
|
|
32
|
+
],
|
|
33
|
+
"Resource": "arn:aws:dynamodb:[REGION]:[ACCOUNTID]:table/himari_*"
|
|
34
|
+
},
|
|
35
|
+
{
|
|
36
|
+
"Effect": "Allow",
|
|
37
|
+
"Action": [
|
|
38
|
+
"secretsmanager:DescribeSecret",
|
|
39
|
+
"secretsmanager:GetSecretValue",
|
|
40
|
+
"secretsmanager:PutSecretValue",
|
|
41
|
+
"secretsmanager:UpdateSecretVersionStage"
|
|
42
|
+
],
|
|
43
|
+
"Resource": "arn:aws:secretsmanager:[REGION]:[ACCOUNTID]:secret:himari_*"
|
|
44
|
+
}
|
|
45
|
+
]
|
|
46
|
+
}
|
|
47
|
+
```
|
|
18
48
|
|
|
19
49
|
## Usage
|
|
20
50
|
|
|
21
|
-
|
|
51
|
+
### Secrets Manager Rotation Handler
|
|
52
|
+
|
|
53
|
+
1. Deploy [./lib/himari/aws/secretsmanager_signing_key_rotation_handler.rb](./lib/himari/aws/secretsmanager_signing_key_rotation_handler.rb) as a Lambda function. This file works standalone.
|
|
54
|
+
|
|
55
|
+
- Refer to the [./lambda](./lambda) for prebuilt container image
|
|
56
|
+
|
|
57
|
+
2. Grant secrets manager a `lambda:InvokeFunction` to the function.
|
|
58
|
+
3. Create a secrets manager secret and set up rotation.
|
|
59
|
+
|
|
60
|
+
You can tag a secret with `HimariKey` key and the following value to customize key types:
|
|
61
|
+
|
|
62
|
+
- RSA 2048-bit: `kty=rsa,len=2048`
|
|
63
|
+
- RSA 4096-bit: `kty=rsa,len=4096`
|
|
64
|
+
- EC P-256: `kty=ec,len=256`
|
|
65
|
+
|
|
66
|
+
_you may also specify in base64'd json_
|
|
67
|
+
|
|
68
|
+
### config.ru
|
|
69
|
+
|
|
70
|
+
```ruby
|
|
71
|
+
# config.ru
|
|
72
|
+
require 'himari'
|
|
73
|
+
require 'himari/aws'
|
|
74
|
+
require 'json'
|
|
75
|
+
require 'omniauth'
|
|
76
|
+
require 'open-uri'
|
|
77
|
+
require 'rack/session/cookie'
|
|
78
|
+
|
|
79
|
+
use(Rack::Session::Cookie,
|
|
80
|
+
path: '/',
|
|
81
|
+
expire_after: 3600,
|
|
82
|
+
secure: true,
|
|
83
|
+
secret: ENV.fetch('SECRET_KEY_BASE'),
|
|
84
|
+
)
|
|
85
|
+
|
|
86
|
+
use OmniAuth::Builder do
|
|
87
|
+
provider :developer, fields: %i(login), uid_field: :login
|
|
88
|
+
end
|
|
89
|
+
|
|
90
|
+
use(Himari::Middlewares::Config,
|
|
91
|
+
issuer: 'https://idp.example.net',
|
|
92
|
+
providers: [
|
|
93
|
+
{ name: :github, button: 'Log in with GitHub' },
|
|
94
|
+
],
|
|
95
|
+
storage: Himari::Aws::DynamodbStorage.new(table_name: 'himari'),
|
|
96
|
+
)
|
|
97
|
+
|
|
98
|
+
# Signing key from Secrets Manager. For rotation deployment, read
|
|
99
|
+
use(Himari::Aws::SecretsmanagerSigningKeyProvider,
|
|
100
|
+
secret_id: 'arn:aws:secretsmanager:ap-northeast-1:...:secret:himari-xxx',
|
|
101
|
+
group: nil,
|
|
102
|
+
kid_prefix: 'asm1',
|
|
103
|
+
)
|
|
104
|
+
|
|
105
|
+
# Add clients as many as you need
|
|
106
|
+
use(Himari::Middlewares::Client,
|
|
107
|
+
name: 'awsalb',
|
|
108
|
+
id: '...',
|
|
109
|
+
secret_hash: '...', # sha384 hexdigest of secret
|
|
110
|
+
# secret: '...' # or in cleartext
|
|
111
|
+
redirect_uris: %w(https://app.example.net/oauth2/idpresponse),
|
|
112
|
+
)
|
|
113
|
+
|
|
114
|
+
use(Himari::Middlewares::ClaimsRule, name: 'developer-initialize') do |context, decision|
|
|
115
|
+
next decision.skip!("provider not in scope") unless context.provider == 'developer'
|
|
116
|
+
decision.initialize_claims!(
|
|
117
|
+
sub: "dev_#{Digest::SHA256.hexdigest(context.auth[:uid])}",
|
|
118
|
+
name: context.auth[:info][:login],
|
|
119
|
+
preferred_username: context.auth[:info][:login],
|
|
120
|
+
)
|
|
121
|
+
decision.continue!
|
|
122
|
+
end
|
|
123
|
+
|
|
124
|
+
use(Himari::Middlewares::AuthenticationRule, name: 'always-allow') do |context, decision|
|
|
125
|
+
next decision.skip!("provider not in scope") unless context.provider == 'developer'
|
|
126
|
+
decision.allow!
|
|
127
|
+
end
|
|
128
|
+
|
|
129
|
+
use(Himari::Middlewares::AuthorizationRule, name: 'always-allow') do |context, decision|
|
|
130
|
+
decision.allow!
|
|
131
|
+
end
|
|
132
|
+
|
|
133
|
+
run Himari::App
|
|
134
|
+
```
|
|
22
135
|
|
|
23
136
|
## Development
|
|
24
137
|
|
|
@@ -28,7 +141,7 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
|
|
|
28
141
|
|
|
29
142
|
## Contributing
|
|
30
143
|
|
|
31
|
-
Bug reports and pull requests are welcome on GitHub at https://github.com/
|
|
144
|
+
Bug reports and pull requests are welcome on GitHub at https://github.com/sorah/himari.
|
|
32
145
|
|
|
33
146
|
## License
|
|
34
147
|
|
data/Rakefile
CHANGED
data/lambda/Dockerfile
ADDED
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
# context must be repository root
|
|
2
|
+
FROM public.ecr.aws/lambda/ruby:4.0 as builder
|
|
3
|
+
RUN --mount=type=cache,target=/var/cache/dnf dnf update -y && dnf install -y gcc gcc-c++ make
|
|
4
|
+
|
|
5
|
+
COPY ./himari/himari.gemspec ${LAMBDA_TASK_ROOT}/app/himari/himari.gemspec
|
|
6
|
+
COPY ./himari/lib/himari/version.rb ${LAMBDA_TASK_ROOT}/app/himari/lib/himari/version.rb
|
|
7
|
+
|
|
8
|
+
COPY ./himari-aws/himari-aws.gemspec ${LAMBDA_TASK_ROOT}/app/himari-aws/himari-aws.gemspec
|
|
9
|
+
COPY ./himari-aws/lib/himari/aws/version.rb ${LAMBDA_TASK_ROOT}/app/himari-aws/lib/himari/aws/version.rb
|
|
10
|
+
|
|
11
|
+
COPY ./omniauth-himari/omniauth-himari.gemspec ${LAMBDA_TASK_ROOT}/app/omniauth-himari/omniauth-himari.gemspec
|
|
12
|
+
COPY ./omniauth-himari/lib/omniauth-himari/version.rb ${LAMBDA_TASK_ROOT}/app/omniauth-himari/lib/omniauth-himari/version.rb
|
|
13
|
+
|
|
14
|
+
COPY ./himari-aws/lambda/Gemfile* ${LAMBDA_TASK_ROOT}/app/himari-aws/lambda/
|
|
15
|
+
WORKDIR ${LAMBDA_TASK_ROOT}/app
|
|
16
|
+
|
|
17
|
+
ENV LANG=C.UTF-8
|
|
18
|
+
ENV BUNDLE_GEMFILE ${LAMBDA_TASK_ROOT}/app/himari-aws/lambda/Gemfile
|
|
19
|
+
ENV BUNDLE_PATH ${LAMBDA_TASK_ROOT}/vendor/bundle
|
|
20
|
+
ENV BUNDLE_DEPLOYMENT 1
|
|
21
|
+
ENV BUNDLE_JOBS 16
|
|
22
|
+
ENV HIMARI_LAMBDA_IMAGE 1
|
|
23
|
+
RUN bundle install
|
|
24
|
+
|
|
25
|
+
COPY . ${LAMBDA_TASK_ROOT}/app
|
|
26
|
+
|
|
27
|
+
FROM public.ecr.aws/lambda/ruby:4.0
|
|
28
|
+
|
|
29
|
+
COPY --from=builder ${LAMBDA_TASK_ROOT}/vendor ${LAMBDA_TASK_ROOT}/vendor
|
|
30
|
+
COPY . ${LAMBDA_TASK_ROOT}/app
|
|
31
|
+
|
|
32
|
+
COPY ./himari-aws/lambda/entrypoint.rb ${LAMBDA_TASK_ROOT}/himari_lambda_entrypoint.rb
|
|
33
|
+
|
|
34
|
+
WORKDIR ${LAMBDA_TASK_ROOT}/app
|
|
35
|
+
ENV LANG=C.UTF-8
|
|
36
|
+
ENV BUNDLE_GEMFILE ${LAMBDA_TASK_ROOT}/app/himari-aws/lambda/Gemfile
|
|
37
|
+
ENV BUNDLE_PATH ${LAMBDA_TASK_ROOT}/vendor/bundle
|
|
38
|
+
ENV BUNDLE_DEPLOYMENT 1
|
|
39
|
+
ENV HIMARI_LAMBDA_IMAGE 1
|
|
40
|
+
CMD [ "himari_lambda_entrypoint.Himari::Aws::LambdaHandler.rack_handler" ]
|
data/lambda/Gemfile
ADDED
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
source 'https://rubygems.org'
|
|
4
|
+
|
|
5
|
+
root = File.join('..', '..')
|
|
6
|
+
|
|
7
|
+
gem 'himari', path: File.join(root, 'himari')
|
|
8
|
+
gem 'himari-aws', path: File.join(root, 'himari-aws')
|
|
9
|
+
gem 'omniauth-himari', path: File.join(root, 'omniauth-himari')
|
|
10
|
+
|
|
11
|
+
gem 'aws-sdk-secretsmanager'
|
|
12
|
+
gem 'aws-sdk-ssm' # paraemeter store
|
|
13
|
+
gem 'nokogiri'
|
|
14
|
+
# gem 'apigatewayv2_rack', git: 'https://github.com/sorah/apigatewayv2_rack'
|
|
15
|
+
gem 'apigatewayv2_rack', '>= 0.5.0'
|
|
16
|
+
|
|
17
|
+
# contribs
|
|
18
|
+
gem 'secure_headers'
|
|
19
|
+
gem 'rack-cors'
|
|
20
|
+
|
|
21
|
+
gem 'omniauth-oauth2'
|
|
22
|
+
gem 'omniauth-saml'
|
|
23
|
+
# gem 'omniauth-twitter'
|
|
24
|
+
gem 'omniauth-github'
|
|
25
|
+
gem 'omniauth-auth0'
|
|
26
|
+
gem 'omniauth-entra-id'
|
|
27
|
+
gem 'omniauth-okta'
|
|
28
|
+
# gem 'omniauth-shibboleth'
|
|
29
|
+
gem 'omniauth-gitlab'
|
|
30
|
+
# gem 'omniauth-kerberos'
|
|
31
|
+
gem 'omniauth-google-oauth2'
|
|
32
|
+
gem 'omniauth-discord'
|
|
33
|
+
gem 'omniauth-apple'
|
|
34
|
+
# gem 'omniauth-ldap' # omniauth < 2
|
|
35
|
+
# gem 'omniauth-slack'# omniauth-oauth2 version constraints does not match with omniauth-github
|
data/lambda/Gemfile.lock
ADDED
|
@@ -0,0 +1,374 @@
|
|
|
1
|
+
PATH
|
|
2
|
+
remote: ../../himari
|
|
3
|
+
specs:
|
|
4
|
+
himari (0.6.0)
|
|
5
|
+
addressable
|
|
6
|
+
concurrent-ruby
|
|
7
|
+
httpx
|
|
8
|
+
omniauth (>= 2.0)
|
|
9
|
+
openid_connect
|
|
10
|
+
rack-oauth2
|
|
11
|
+
rack-protection
|
|
12
|
+
sinatra (>= 3.0)
|
|
13
|
+
|
|
14
|
+
PATH
|
|
15
|
+
remote: ../../omniauth-himari
|
|
16
|
+
specs:
|
|
17
|
+
omniauth-himari (0.3.0)
|
|
18
|
+
faraday
|
|
19
|
+
jwt
|
|
20
|
+
oauth2
|
|
21
|
+
omniauth
|
|
22
|
+
omniauth-oauth2
|
|
23
|
+
|
|
24
|
+
PATH
|
|
25
|
+
remote: ..
|
|
26
|
+
specs:
|
|
27
|
+
himari-aws (0.3.0)
|
|
28
|
+
apigatewayv2_rack
|
|
29
|
+
aws-sdk-dynamodb
|
|
30
|
+
aws-sdk-secretsmanager
|
|
31
|
+
himari
|
|
32
|
+
|
|
33
|
+
GEM
|
|
34
|
+
remote: https://rubygems.org/
|
|
35
|
+
specs:
|
|
36
|
+
activemodel (8.1.3)
|
|
37
|
+
activesupport (= 8.1.3)
|
|
38
|
+
activesupport (8.1.3)
|
|
39
|
+
base64
|
|
40
|
+
bigdecimal
|
|
41
|
+
concurrent-ruby (~> 1.0, >= 1.3.1)
|
|
42
|
+
connection_pool (>= 2.2.5)
|
|
43
|
+
drb
|
|
44
|
+
i18n (>= 1.6, < 2)
|
|
45
|
+
json
|
|
46
|
+
logger (>= 1.4.2)
|
|
47
|
+
minitest (>= 5.1)
|
|
48
|
+
securerandom (>= 0.3)
|
|
49
|
+
tzinfo (~> 2.0, >= 2.0.5)
|
|
50
|
+
uri (>= 0.13.1)
|
|
51
|
+
addressable (2.9.0)
|
|
52
|
+
public_suffix (>= 2.0.2, < 8.0)
|
|
53
|
+
aes_key_wrap (1.1.0)
|
|
54
|
+
apigatewayv2_rack (0.5.0)
|
|
55
|
+
base64
|
|
56
|
+
rack
|
|
57
|
+
stringio
|
|
58
|
+
attr_required (1.0.2)
|
|
59
|
+
auth-sanitizer (0.1.4)
|
|
60
|
+
version_gem (~> 1.1, >= 1.1.9)
|
|
61
|
+
aws-eventstream (1.4.0)
|
|
62
|
+
aws-partitions (1.1257.0)
|
|
63
|
+
aws-sdk-core (3.251.0)
|
|
64
|
+
aws-eventstream (~> 1, >= 1.3.0)
|
|
65
|
+
aws-partitions (~> 1, >= 1.992.0)
|
|
66
|
+
aws-sigv4 (~> 1.9)
|
|
67
|
+
base64
|
|
68
|
+
bigdecimal
|
|
69
|
+
jmespath (~> 1, >= 1.6.1)
|
|
70
|
+
logger
|
|
71
|
+
aws-sdk-dynamodb (1.168.0)
|
|
72
|
+
aws-sdk-core (~> 3, >= 3.248.0)
|
|
73
|
+
aws-sigv4 (~> 1.5)
|
|
74
|
+
aws-sdk-secretsmanager (1.133.0)
|
|
75
|
+
aws-sdk-core (~> 3, >= 3.248.0)
|
|
76
|
+
aws-sigv4 (~> 1.5)
|
|
77
|
+
aws-sdk-ssm (1.216.0)
|
|
78
|
+
aws-sdk-core (~> 3, >= 3.248.0)
|
|
79
|
+
aws-sigv4 (~> 1.5)
|
|
80
|
+
aws-sigv4 (1.12.1)
|
|
81
|
+
aws-eventstream (~> 1, >= 1.0.2)
|
|
82
|
+
base64 (0.3.0)
|
|
83
|
+
bigdecimal (4.1.2)
|
|
84
|
+
bindata (2.5.1)
|
|
85
|
+
cgi (0.5.1)
|
|
86
|
+
concurrent-ruby (1.3.6)
|
|
87
|
+
connection_pool (3.0.2)
|
|
88
|
+
date (3.5.1)
|
|
89
|
+
drb (2.2.3)
|
|
90
|
+
faraday (2.14.2)
|
|
91
|
+
faraday-net_http (>= 2.0, < 3.5)
|
|
92
|
+
json
|
|
93
|
+
logger
|
|
94
|
+
faraday-follow_redirects (0.5.0)
|
|
95
|
+
faraday (>= 1, < 3)
|
|
96
|
+
faraday-net_http (3.4.4)
|
|
97
|
+
net-http (~> 0.5)
|
|
98
|
+
hashie (5.1.0)
|
|
99
|
+
logger
|
|
100
|
+
http-2 (1.1.3)
|
|
101
|
+
httpx (1.7.8)
|
|
102
|
+
http-2 (>= 1.1.3)
|
|
103
|
+
i18n (1.14.8)
|
|
104
|
+
concurrent-ruby (~> 1.0)
|
|
105
|
+
jmespath (1.6.2)
|
|
106
|
+
json (2.19.8)
|
|
107
|
+
json-jwt (1.17.1)
|
|
108
|
+
activesupport (>= 4.2)
|
|
109
|
+
aes_key_wrap
|
|
110
|
+
base64
|
|
111
|
+
bindata
|
|
112
|
+
faraday (~> 2.0)
|
|
113
|
+
faraday-follow_redirects
|
|
114
|
+
jwt (2.10.3)
|
|
115
|
+
base64
|
|
116
|
+
logger (1.7.0)
|
|
117
|
+
mail (2.9.0)
|
|
118
|
+
logger
|
|
119
|
+
mini_mime (>= 0.1.1)
|
|
120
|
+
net-imap
|
|
121
|
+
net-pop
|
|
122
|
+
net-smtp
|
|
123
|
+
mini_mime (1.1.5)
|
|
124
|
+
mini_portile2 (2.8.9)
|
|
125
|
+
minitest (6.0.6)
|
|
126
|
+
drb (~> 2.0)
|
|
127
|
+
prism (~> 1.5)
|
|
128
|
+
multi_xml (0.9.1)
|
|
129
|
+
bigdecimal (>= 3.1, < 5)
|
|
130
|
+
mustermann (3.1.1)
|
|
131
|
+
net-http (0.9.1)
|
|
132
|
+
uri (>= 0.11.1)
|
|
133
|
+
net-imap (0.6.4)
|
|
134
|
+
date
|
|
135
|
+
net-protocol
|
|
136
|
+
net-pop (0.1.2)
|
|
137
|
+
net-protocol
|
|
138
|
+
net-protocol (0.2.2)
|
|
139
|
+
timeout
|
|
140
|
+
net-smtp (0.5.1)
|
|
141
|
+
net-protocol
|
|
142
|
+
nokogiri (1.19.3)
|
|
143
|
+
mini_portile2 (~> 2.8.2)
|
|
144
|
+
racc (~> 1.4)
|
|
145
|
+
oauth2 (2.0.20)
|
|
146
|
+
auth-sanitizer (~> 0.1, >= 0.1.3)
|
|
147
|
+
faraday (>= 0.17.3, < 4.0)
|
|
148
|
+
jwt (>= 1.0, < 4.0)
|
|
149
|
+
logger (~> 1.2)
|
|
150
|
+
multi_xml (~> 0.5)
|
|
151
|
+
rack (>= 1.2, < 4)
|
|
152
|
+
snaky_hash (~> 2.0, >= 2.0.4)
|
|
153
|
+
version_gem (~> 1.1, >= 1.1.9)
|
|
154
|
+
omniauth (2.1.4)
|
|
155
|
+
hashie (>= 3.4.6)
|
|
156
|
+
logger
|
|
157
|
+
rack (>= 2.2.3)
|
|
158
|
+
rack-protection
|
|
159
|
+
omniauth-apple (1.4.0)
|
|
160
|
+
json-jwt
|
|
161
|
+
omniauth-oauth2
|
|
162
|
+
omniauth-auth0 (3.2.0)
|
|
163
|
+
jwt (~> 2)
|
|
164
|
+
omniauth (~> 2)
|
|
165
|
+
omniauth-oauth2 (~> 1)
|
|
166
|
+
omniauth-discord (1.2.0)
|
|
167
|
+
omniauth-oauth2 (~> 1.6)
|
|
168
|
+
omniauth-entra-id (3.1.1)
|
|
169
|
+
jwt (>= 2.9.2)
|
|
170
|
+
omniauth-oauth2 (~> 1.8)
|
|
171
|
+
omniauth-github (2.0.1)
|
|
172
|
+
omniauth (~> 2.0)
|
|
173
|
+
omniauth-oauth2 (~> 1.8)
|
|
174
|
+
omniauth-gitlab (4.1.0)
|
|
175
|
+
omniauth (~> 2.0)
|
|
176
|
+
omniauth-oauth2 (~> 1.8.0)
|
|
177
|
+
omniauth-google-oauth2 (1.2.2)
|
|
178
|
+
jwt (>= 2.9.2)
|
|
179
|
+
oauth2 (~> 2.0)
|
|
180
|
+
omniauth (~> 2.0)
|
|
181
|
+
omniauth-oauth2 (~> 1.8)
|
|
182
|
+
omniauth-oauth2 (1.8.0)
|
|
183
|
+
oauth2 (>= 1.4, < 3)
|
|
184
|
+
omniauth (~> 2.0)
|
|
185
|
+
omniauth-okta (2.0.0)
|
|
186
|
+
omniauth (~> 2.0)
|
|
187
|
+
omniauth-oauth2 (~> 1.7, >= 1.7.1)
|
|
188
|
+
omniauth-saml (2.2.5)
|
|
189
|
+
omniauth (~> 2.1)
|
|
190
|
+
ruby-saml (~> 1.18)
|
|
191
|
+
openid_connect (2.5.0)
|
|
192
|
+
activemodel
|
|
193
|
+
attr_required (>= 1.0.0)
|
|
194
|
+
faraday (~> 2.0)
|
|
195
|
+
faraday-follow_redirects
|
|
196
|
+
json-jwt (>= 1.16)
|
|
197
|
+
mail
|
|
198
|
+
rack-oauth2 (~> 2.2)
|
|
199
|
+
swd (~> 2.0)
|
|
200
|
+
tzinfo
|
|
201
|
+
validate_url
|
|
202
|
+
webfinger (~> 2.0)
|
|
203
|
+
prism (1.9.0)
|
|
204
|
+
public_suffix (7.0.5)
|
|
205
|
+
racc (1.8.1)
|
|
206
|
+
rack (3.2.6)
|
|
207
|
+
rack-cors (3.0.0)
|
|
208
|
+
logger
|
|
209
|
+
rack (>= 3.0.14)
|
|
210
|
+
rack-oauth2 (2.3.0)
|
|
211
|
+
activesupport
|
|
212
|
+
attr_required
|
|
213
|
+
faraday (~> 2.0)
|
|
214
|
+
faraday-follow_redirects
|
|
215
|
+
json-jwt (>= 1.11.0)
|
|
216
|
+
rack (>= 2.1.0)
|
|
217
|
+
rack-protection (4.2.1)
|
|
218
|
+
base64 (>= 0.1.0)
|
|
219
|
+
logger (>= 1.6.0)
|
|
220
|
+
rack (>= 3.0.0, < 4)
|
|
221
|
+
rack-session (2.1.2)
|
|
222
|
+
base64 (>= 0.1.0)
|
|
223
|
+
rack (>= 3.0.0)
|
|
224
|
+
rexml (3.4.4)
|
|
225
|
+
ruby-saml (1.18.1)
|
|
226
|
+
nokogiri (>= 1.13.10)
|
|
227
|
+
rexml
|
|
228
|
+
secure_headers (7.2.0)
|
|
229
|
+
cgi (>= 0.1)
|
|
230
|
+
securerandom (0.4.1)
|
|
231
|
+
sinatra (4.2.1)
|
|
232
|
+
logger (>= 1.6.0)
|
|
233
|
+
mustermann (~> 3.0)
|
|
234
|
+
rack (>= 3.0.0, < 4)
|
|
235
|
+
rack-protection (= 4.2.1)
|
|
236
|
+
rack-session (>= 2.0.0, < 3)
|
|
237
|
+
tilt (~> 2.0)
|
|
238
|
+
snaky_hash (2.0.4)
|
|
239
|
+
hashie (>= 0.1.0, < 6)
|
|
240
|
+
version_gem (>= 1.1.8, < 3)
|
|
241
|
+
stringio (3.2.0)
|
|
242
|
+
swd (2.0.3)
|
|
243
|
+
activesupport (>= 3)
|
|
244
|
+
attr_required (>= 0.0.5)
|
|
245
|
+
faraday (~> 2.0)
|
|
246
|
+
faraday-follow_redirects
|
|
247
|
+
tilt (2.7.0)
|
|
248
|
+
timeout (0.6.1)
|
|
249
|
+
tzinfo (2.0.6)
|
|
250
|
+
concurrent-ruby (~> 1.0)
|
|
251
|
+
uri (1.1.1)
|
|
252
|
+
validate_url (1.0.15)
|
|
253
|
+
activemodel (>= 3.0.0)
|
|
254
|
+
public_suffix
|
|
255
|
+
version_gem (1.1.10)
|
|
256
|
+
webfinger (2.1.3)
|
|
257
|
+
activesupport
|
|
258
|
+
faraday (~> 2.0)
|
|
259
|
+
faraday-follow_redirects
|
|
260
|
+
|
|
261
|
+
PLATFORMS
|
|
262
|
+
ruby
|
|
263
|
+
|
|
264
|
+
DEPENDENCIES
|
|
265
|
+
apigatewayv2_rack (>= 0.5.0)
|
|
266
|
+
aws-sdk-secretsmanager
|
|
267
|
+
aws-sdk-ssm
|
|
268
|
+
himari!
|
|
269
|
+
himari-aws!
|
|
270
|
+
nokogiri
|
|
271
|
+
omniauth-apple
|
|
272
|
+
omniauth-auth0
|
|
273
|
+
omniauth-discord
|
|
274
|
+
omniauth-entra-id
|
|
275
|
+
omniauth-github
|
|
276
|
+
omniauth-gitlab
|
|
277
|
+
omniauth-google-oauth2
|
|
278
|
+
omniauth-himari!
|
|
279
|
+
omniauth-oauth2
|
|
280
|
+
omniauth-okta
|
|
281
|
+
omniauth-saml
|
|
282
|
+
rack-cors
|
|
283
|
+
secure_headers
|
|
284
|
+
|
|
285
|
+
CHECKSUMS
|
|
286
|
+
activemodel (8.1.3) sha256=90c05cbe4cef3649b8f79f13016191ea94c4525ce4a5c0fb7ef909c4b91c8219
|
|
287
|
+
activesupport (8.1.3) sha256=21a5e0dfbd4c3ddd9e1317ec6a4d782fa226e7867dc70b0743acda81a1dca20e
|
|
288
|
+
addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
|
|
289
|
+
aes_key_wrap (1.1.0) sha256=b935f4756b37375895db45669e79dfcdc0f7901e12d4e08974d5540c8e0776a5
|
|
290
|
+
apigatewayv2_rack (0.5.0) sha256=30fb327ddacfeb0490657052791cea327ef852348ca32c21fa412161bfe492b2
|
|
291
|
+
attr_required (1.0.2) sha256=f0ebfc56b35e874f4d0ae799066dbc1f81efefe2364ca3803dc9ea6a4de6cb99
|
|
292
|
+
auth-sanitizer (0.1.4) sha256=ded72221d4d3a7c91e34e8a87b21e6a42cbf7829697f140dcf49d542422faedc
|
|
293
|
+
aws-eventstream (1.4.0) sha256=116bf85c436200d1060811e6f5d2d40c88f65448f2125bc77ffce5121e6e183b
|
|
294
|
+
aws-partitions (1.1257.0) sha256=03c531f40fdd979a9ae2aae70140c60e59000e6f62a60b3d6171b78cdded960c
|
|
295
|
+
aws-sdk-core (3.251.0) sha256=ef8186cb5509147e590310da58fab4c5b0901eba0e85a72955abdf772e425c87
|
|
296
|
+
aws-sdk-dynamodb (1.168.0) sha256=9bd479a23c6ab006130c7c1ebf5f9dd4c05d90ce03255f69ca8d04748fef0aec
|
|
297
|
+
aws-sdk-secretsmanager (1.133.0) sha256=467d64d44aa5206fa45d9fc9d5b90290ed7aa9101ed18393caf9b8fbe5c277dc
|
|
298
|
+
aws-sdk-ssm (1.216.0) sha256=7d03b033d183025ae5a4b473766d215fc0fca6a2978b347a16f2a3cdff49b62c
|
|
299
|
+
aws-sigv4 (1.12.1) sha256=6973ff95cb0fd0dc58ba26e90e9510a2219525d07620c8babeb70ef831826c00
|
|
300
|
+
base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
|
|
301
|
+
bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
|
|
302
|
+
bindata (2.5.1) sha256=53186a1ec2da943d4cb413583d680644eb810aacbf8902497aac8f191fad9e58
|
|
303
|
+
bundler (4.0.12) sha256=7f8b757d28dfb636e7b24fba2344ac6dd13b5b24f4b46d62573d483f211825ac
|
|
304
|
+
cgi (0.5.1) sha256=e93fcafc69b8a934fe1e6146121fa35430efa8b4a4047c4893764067036f18e9
|
|
305
|
+
concurrent-ruby (1.3.6) sha256=6b56837e1e7e5292f9864f34b69c5a2cbc75c0cf5338f1ce9903d10fa762d5ab
|
|
306
|
+
connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a
|
|
307
|
+
date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0
|
|
308
|
+
drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373
|
|
309
|
+
faraday (2.14.2) sha256=73ccb9994a9e8648f010e32eca2ae82e41c57860aa10932cda29418b9e0223ad
|
|
310
|
+
faraday-follow_redirects (0.5.0) sha256=5cde93c894b30943a5d2b93c2fe9284216a6b756f7af406a1e55f211d97d10ad
|
|
311
|
+
faraday-net_http (3.4.4) sha256=0e78af151747ed1b00f33e25973b4bc220d7f16c00c39676817c8b12331eb588
|
|
312
|
+
hashie (5.1.0) sha256=c266471896f323c446ea8207f8ffac985d2718df0a0ba98651a3057096ca3870
|
|
313
|
+
himari (0.6.0)
|
|
314
|
+
himari-aws (0.3.0)
|
|
315
|
+
http-2 (1.1.3) sha256=1b2f379d35a11dbae94f8a1a52c053d8c161eb4a0c98b5d1605ff1b2bf171c9c
|
|
316
|
+
httpx (1.7.8) sha256=6d769465ed608287a272ba0e4700fc22cee6f0335d80bd5c2effaf7fb7bd2a3a
|
|
317
|
+
i18n (1.14.8) sha256=285778639134865c5e0f6269e0b818256017e8cde89993fdfcbfb64d088824a5
|
|
318
|
+
jmespath (1.6.2) sha256=238d774a58723d6c090494c8879b5e9918c19485f7e840f2c1c7532cf84ebcb1
|
|
319
|
+
json (2.19.8) sha256=6354310fd76ef69b87d5bd1f38b40d730613baf90b6803d2d0a48f618d32dfaa
|
|
320
|
+
json-jwt (1.17.1) sha256=5e1ced0f7b206b4c567efee19e6503c1426a819749132926cda579ec013d1f46
|
|
321
|
+
jwt (2.10.3) sha256=e4d9352fbc7309b1a7448c7dd713dfe4d8c47077af80759cdbed8f878ea0b484
|
|
322
|
+
logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
|
|
323
|
+
mail (2.9.0) sha256=6fa6673ecd71c60c2d996260f9ee3dd387d4673b8169b502134659ece6d34941
|
|
324
|
+
mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef
|
|
325
|
+
mini_portile2 (2.8.9) sha256=0cd7c7f824e010c072e33f68bc02d85a00aeb6fce05bb4819c03dfd3c140c289
|
|
326
|
+
minitest (6.0.6) sha256=153ea36d1d987a62942382b61075745042a2b3123b1cd48f4c3675af9cc7d6f1
|
|
327
|
+
multi_xml (0.9.1) sha256=7ce766b59c17241ed62976caeae1fae9b2431b263398c35396239a68c4a64e57
|
|
328
|
+
mustermann (3.1.1) sha256=4c6170c7234d5499c345562ba7c7dfe73e1754286dcc1abb053064d66a127198
|
|
329
|
+
net-http (0.9.1) sha256=25ba0b67c63e89df626ed8fac771d0ad24ad151a858af2cc8e6a716ca4336996
|
|
330
|
+
net-imap (0.6.4) sha256=9a5598c67a3022c284d98430ef1d4948e7dbdb62596f61081ea8ca933270a02b
|
|
331
|
+
net-pop (0.1.2) sha256=848b4e982013c15b2f0382792268763b748cce91c9e91e36b0f27ed26420dff3
|
|
332
|
+
net-protocol (0.2.2) sha256=aa73e0cba6a125369de9837b8d8ef82a61849360eba0521900e2c3713aa162a8
|
|
333
|
+
net-smtp (0.5.1) sha256=ed96a0af63c524fceb4b29b0d352195c30d82dd916a42f03c62a3a70e5b70736
|
|
334
|
+
nokogiri (1.19.3) sha256=78312cbac32a40c812780d9678221b79d51288eec00054c1a8d15f7ce05960e8
|
|
335
|
+
oauth2 (2.0.20) sha256=790c6316346da12f9dcaf27a67530f802950af05d35c3874918da84f2deae674
|
|
336
|
+
omniauth (2.1.4) sha256=42a05b0496f0d22e1dd85d42aaf602f064e36bb47a6826a27ab55e5ba608763c
|
|
337
|
+
omniauth-apple (1.4.0) sha256=f449ce4c206e784536cbaf64b7c36072ac5e7c73103b1a01ba3c1d9454bf6e24
|
|
338
|
+
omniauth-auth0 (3.2.0) sha256=9241a8ce3ead46070f101f8f5170f09d7c2c3841321734d7a4852d954815db9c
|
|
339
|
+
omniauth-discord (1.2.0) sha256=e6e92649a645862ccb29ce3d5f2f876de9e26198722b9d05f9f6d4f3805d5c70
|
|
340
|
+
omniauth-entra-id (3.1.1) sha256=16622979423891352f916709f0698401e692e60bb41d4dbf5f7a17d98fee27ef
|
|
341
|
+
omniauth-github (2.0.1) sha256=8ff8e70ac6d6db9d52485eef52cfa894938c941496e66b52b5e2773ade3ccad4
|
|
342
|
+
omniauth-gitlab (4.1.0) sha256=543f1fa710488220b382bd683a3f314f5b29c36de85ad746f356f37795959613
|
|
343
|
+
omniauth-google-oauth2 (1.2.2) sha256=74c3f3d0221c048f938846092fb15a1f15237526f50a7c93d9793f9a4ff1be11
|
|
344
|
+
omniauth-himari (0.3.0)
|
|
345
|
+
omniauth-oauth2 (1.8.0) sha256=b2f8e9559cc7e2d4efba57607691d6d2b634b879fc5b5b6ccfefa3da85089e78
|
|
346
|
+
omniauth-okta (2.0.0) sha256=6425fd3140c3130bc8793a536f8200bfc154faac69fe6661d03959d841639655
|
|
347
|
+
omniauth-saml (2.2.5) sha256=552ad464564d711f0dfd169e0ad801de809cf3ac71c4bc9094f152d5a0d7ab59
|
|
348
|
+
openid_connect (2.5.0) sha256=659aff8edce0907798e3f6837e5f27ae2937ae8735216f3e900ab8daa29e39c4
|
|
349
|
+
prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
|
|
350
|
+
public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
|
|
351
|
+
racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
|
|
352
|
+
rack (3.2.6) sha256=5ed78e1f73b2e25679bec7d45ee2d4483cc4146eb1be0264fc4d94cb5ef212c2
|
|
353
|
+
rack-cors (3.0.0) sha256=7b95be61db39606906b61b83bd7203fa802b0ceaaad8fcb2fef39e097bf53f68
|
|
354
|
+
rack-oauth2 (2.3.0) sha256=43e02cf73f13886a0a06499603caeec58aeba6eae1fefc4977c9678b7652c632
|
|
355
|
+
rack-protection (4.2.1) sha256=cf6e2842df8c55f5e4d1a4be015e603e19e9bc3a7178bae58949ccbb58558bac
|
|
356
|
+
rack-session (2.1.2) sha256=595434f8c0c3473ae7d7ac56ecda6cc6dfd9d37c0b2b5255330aa1576967ffe8
|
|
357
|
+
rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142
|
|
358
|
+
ruby-saml (1.18.1) sha256=1b0e7a44aef150b4197955f5e015d593672e242cfdc5d06aa7554ec2350b9107
|
|
359
|
+
secure_headers (7.2.0) sha256=713b3d20af12b8c6633d97e276b286f1520e57be0d84b00f3bf43d22a1b70f83
|
|
360
|
+
securerandom (0.4.1) sha256=cc5193d414a4341b6e225f0cb4446aceca8e50d5e1888743fac16987638ea0b1
|
|
361
|
+
sinatra (4.2.1) sha256=b7aeb9b11d046b552972ade834f1f9be98b185fa8444480688e3627625377080
|
|
362
|
+
snaky_hash (2.0.4) sha256=2b12758c57defa6796341a1620f84b1a23737421d8d7e2575d0550b53cc4fece
|
|
363
|
+
stringio (3.2.0) sha256=c37cb2e58b4ffbd33fe5cd948c05934af997b36e0b6ca6fdf43afa234cf222e1
|
|
364
|
+
swd (2.0.3) sha256=4cdbe2a4246c19f093fce22e967ec3ebdd4657d37673672e621bf0c7eb770655
|
|
365
|
+
tilt (2.7.0) sha256=0d5b9ba69f6a36490c64b0eee9f6e9aad517e20dcc848800a06eb116f08c6ab3
|
|
366
|
+
timeout (0.6.1) sha256=78f57368a7e7bbadec56971f78a3f5ecbcfb59b7fcbb0a3ed6ddc08a5094accb
|
|
367
|
+
tzinfo (2.0.6) sha256=8daf828cc77bcf7d63b0e3bdb6caa47e2272dcfaf4fbfe46f8c3a9df087a829b
|
|
368
|
+
uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
|
|
369
|
+
validate_url (1.0.15) sha256=72fe164c0713d63a9970bd6700bea948babbfbdcec392f2342b6704042f57451
|
|
370
|
+
version_gem (1.1.10) sha256=d0575dc9f2949b2db9497051f96e5c36d7c6c2f2e81afd1a73cacccd4690e506
|
|
371
|
+
webfinger (2.1.3) sha256=567a52bde77fb38ca6b67e55db755f988766ec4651c1d24916a65aa70540695c
|
|
372
|
+
|
|
373
|
+
BUNDLED WITH
|
|
374
|
+
4.0.12
|
data/lambda/README.md
ADDED
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
# Himari Lambda Container Image
|
|
2
|
+
|
|
3
|
+
## Deploy
|
|
4
|
+
|
|
5
|
+
- See [./terraform/](./terraform/) for quick deployment using Terraform modules.
|
|
6
|
+
|
|
7
|
+
## Image
|
|
8
|
+
|
|
9
|
+
### Prebuilt image
|
|
10
|
+
|
|
11
|
+
- https://gallery.ecr.aws/sorah/himari-lambda
|
|
12
|
+
- `public.ecr.aws/sorah/himari-lambda`
|
|
13
|
+
|
|
14
|
+
Images are tagged with commit SHA.
|
|
15
|
+
|
|
16
|
+
### Build an image
|
|
17
|
+
|
|
18
|
+
Run the following at the repository root:
|
|
19
|
+
|
|
20
|
+
```
|
|
21
|
+
docker build -f himari-aws/lambda/Dockerfile .
|
|
22
|
+
```
|
|
23
|
+
|
|
24
|
+
### Usage
|
|
25
|
+
|
|
26
|
+
The same container image supports multiple handlers:
|
|
27
|
+
|
|
28
|
+
#### Rack app for API Gateway v2, Function URL, ALB target
|
|
29
|
+
|
|
30
|
+
- Handler: `himari_lambda_entrypoint.Himari::Aws::LambdaHandler.rack_handler`
|
|
31
|
+
|
|
32
|
+
Served through [apigatewayv2_rack](https://github.com/sorah/apigatewayv2_rack).
|
|
33
|
+
|
|
34
|
+
This handler reads `config.ru` from:
|
|
35
|
+
|
|
36
|
+
- `${LAMBDA_TASK_ROOT}/config.ru` in a container image
|
|
37
|
+
- DynamoDB Table item (pk=`rack`, sk=`rack:${HIMARI_RACK_DIGEST}`, file=config.ru content) on table `$HIMARI_RACK_DYNAMODB_TABLE`
|
|
38
|
+
- where HIMARI_RACK_DIGEST must be [base64'd sha256 hash](https://developer.hashicorp.com/terraform/language/functions/base64sha256) of `file` attribute
|
|
39
|
+
|
|
40
|
+
#### Secrets Manager automatic rotation handler
|
|
41
|
+
|
|
42
|
+
- Handler: `himari_lambda_entrypoint.Himari::Aws::LambdaHandler.secrets_rotation_handler`
|