@fishawack/lab-env 5.7.0-beta.2 → 5.7.0-beta.3

package/commands/create/services/aws/ses.js

@@ -0,0 +1,195 @@
+const crypto = require("crypto");
+const os = require("os");
+const { readFileSync, writeFileSync } = require("fs");
+const { SESClient, ListIdentitiesCommand } = require("@aws-sdk/client-ses");
+const {
+    IAMClient,
+    CreateUserCommand,
+    GetUserCommand,
+    CreateAccessKeyCommand,
+    ListAccessKeysCommand,
+    DeleteAccessKeyCommand,
+    AddUserToGroupCommand,
+} = require("@aws-sdk/client-iam");
+const { fromIni } = require("@aws-sdk/credential-providers");
+const { Spinner } = require("../../libs/utilities");
+
+const SES_REGION = "us-east-1";
+const SES_PROFILE = "fishawack";
+
+const getClient = () =>
+    new SESClient({
+        region: SES_REGION,
+        credentials: fromIni({ profile: SES_PROFILE }),
+    });
+
+module.exports.listVerifiedIdentities = async () => {
+    const client = getClient();
+
+    const res = await Spinner.prototype.simple(
+        "Retrieving verified SES identities",
+        () => {
+            return client.send(
+                new ListIdentitiesCommand({ IdentityType: "Domain" }),
+            );
+        },
+    );
+
+    return res.Identities || [];
+};
+
+/**
+ * Derives an SES SMTP password from an IAM secret access key.
+ * Uses the standard AWS SES SMTP credential derivation algorithm.
+ * https://docs.aws.amazon.com/ses/latest/dg/smtp-credentials.html
+ */
+module.exports.deriveSmtpPassword = (secretAccessKey, region = SES_REGION) => {
+    const VERSION = Buffer.from([0x04]);
+    const date = "11111111";
+    const service = "ses";
+    const terminal = "aws4_request";
+    const message = "SendRawEmail";
+
+    let signature = Buffer.from(`AWS4${secretAccessKey}`, "utf8");
+    for (const element of [date, region, service, terminal, message]) {
+        signature = crypto
+            .createHmac("sha256", signature)
+            .update(element)
+            .digest();
+    }
+
+    return Buffer.concat([VERSION, signature]).toString("base64");
+};
+
+const SES_SMTP_HOST = "email-smtp.us-east-1.amazonaws.com";
+const SES_GROUP = "AWSSESSendingGroupDoNotRename";
+
+const getIAMClient = () =>
+    new IAMClient({
+        region: SES_REGION,
+        credentials: fromIni({ profile: SES_PROFILE }),
+    });
+
+module.exports.ensureOperatorSESCredentials = async (username) => {
+    const UserName = `fw-auto-${username}-operator`;
+    const client = getIAMClient();
+
+    // Create user (or confirm it already exists)
+    try {
+        await Spinner.prototype.simple(
+            `Creating SES IAM user ${UserName}`,
+            () => client.send(new CreateUserCommand({ UserName })),
+        );
+    } catch {
+        await Spinner.prototype.simple(
+            `Retrieving existing SES IAM user ${UserName}`,
+            () => client.send(new GetUserCommand({ UserName })),
+        );
+    }
+
+    // Add user to SES sending group
+    await Spinner.prototype.simple(`Adding ${UserName} to ${SES_GROUP}`, () =>
+        client.send(
+            new AddUserToGroupCommand({ UserName, GroupName: SES_GROUP }),
+        ),
+    );
+
+    // Check for existing keys
+    const existing = await client.send(new ListAccessKeysCommand({ UserName }));
+
+    if (existing.AccessKeyMetadata.length) {
+        return null;
+    }
+
+    // Create access key and derive SMTP password
+    const keyRes = await Spinner.prototype.simple(
+        "Creating access key for SES user",
+        () => client.send(new CreateAccessKeyCommand({ UserName })),
+    );
+
+    const smtpPassword = module.exports.deriveSmtpPassword(
+        keyRes.AccessKey.SecretAccessKey,
+    );
+
+    // Wait for IAM credentials to propagate across AWS services
+    await Spinner.prototype.simple(
+        "Waiting for IAM credentials to propagate",
+        () => new Promise((r) => setTimeout(r, 10000)),
+    );
+
+    return {
+        username: keyRes.AccessKey.AccessKeyId,
+        password: smtpPassword,
+        host: SES_SMTP_HOST,
+    };
+};
+
+module.exports.rotateOperatorSESCredentials = async (username) => {
+    const UserName = `fw-auto-${username}-operator`;
+    const client = getIAMClient();
+
+    // List and delete existing keys
+    const existing = await Spinner.prototype.simple(
+        `Listing access keys for ${UserName}`,
+        () => client.send(new ListAccessKeysCommand({ UserName })),
+    );
+
+    for (const key of existing.AccessKeyMetadata) {
+        await Spinner.prototype.simple(
+            `Removing old access key ${key.AccessKeyId}`,
+            () =>
+                client.send(
+                    new DeleteAccessKeyCommand({
+                        UserName,
+                        AccessKeyId: key.AccessKeyId,
+                    }),
+                ),
+        );
+    }
+
+    // Create new access key and derive SMTP password
+    const keyRes = await Spinner.prototype.simple(
+        "Creating new access key for SES user",
+        () => client.send(new CreateAccessKeyCommand({ UserName })),
+    );
+
+    const smtpPassword = module.exports.deriveSmtpPassword(
+        keyRes.AccessKey.SecretAccessKey,
+    );
+
+    // Wait for IAM credentials to propagate across AWS services
+    await Spinner.prototype.simple(
+        "Waiting for IAM credentials to propagate",
+        () => new Promise((r) => setTimeout(r, 10000)),
+    );
+
+    return {
+        username: keyRes.AccessKey.AccessKeyId,
+        password: smtpPassword,
+        host: SES_SMTP_HOST,
+    };
+};
+
+const SES_FROM = "digitalautomation@avalerehealth.com";
+const MISC_PATH = `${os.homedir()}/targets/misc.json`;
+
+module.exports.updateMiscNodemailer = (creds) => {
+    const { misc } = require("../../libs/vars");
+
+    const file = JSON.parse(readFileSync(MISC_PATH, { encoding: "utf8" }));
+
+    file.nodemailer = {
+        driver: "AWSSES",
+        AWSSES: {
+            username: creds.username,
+            password: creds.password,
+            host: creds.host,
+        },
+        from: SES_FROM,
+    };
+
+    writeFileSync(MISC_PATH, JSON.stringify(file, null, 4));
+
+    // Mutate the in-memory misc object so email.js picks up fresh creds
+    misc.nodemailer = file.nodemailer;
+};

package/commands/create/templates/elasticbeanstalk/.ebextensions/laravel/cron.config

@@ -0,0 +1,45 @@
+files:
+  "/usr/local/bin/is_first_instance.sh":
+    mode: "000755"
+    owner: root
+    group: root
+    content: |
+      #!/bin/bash
+      # Get IMDSv2 token (required on Amazon Linux 2023)
+      TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" 2>/dev/null)
+
+      INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id 2>/dev/null)
+      REGION=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/dynamic/instance-identity/document 2>/dev/null | jq -r .region)
+
+      # Find the Auto Scaling Group name from the Elastic Beanstalk environment
+      ASG=$(aws ec2 describe-tags --filters "Name=resource-id,Values=$INSTANCE_ID" \
+          --region "$REGION" --output json | jq -r '.[][] | select(.Key=="aws:autoscaling:groupName") | .Value')
+
+      # Find the first instance in the Auto Scaling Group
+      FIRST=$(aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names "$ASG" \
+          --region "$REGION" --output json | \
+          jq -r '.AutoScalingGroups[].Instances[] | select(.LifecycleState=="InService") | .InstanceId' | sort | head -1)
+
+      # If the instance ids are the same exit 0
+      [ "$FIRST" = "$INSTANCE_ID" ]
+
+  "/usr/local/bin/laravel_cron.sh":
+    mode: "000755"
+    owner: root
+    group: root
+    content: |
+      #!/bin/bash
+      /usr/local/bin/is_first_instance.sh || exit
+      cd /var/app/current && echo $(date -u) $(php artisan schedule:run)
+
+  "/etc/cron.d/laravel_cron":
+    mode: "000644"
+    owner: root
+    group: root
+    content: |
+      * * * * * root bash -l /usr/local/bin/laravel_cron.sh >> /var/log/laravel_cron.log 2>&1
+
+commands:
+  rm_old_cron:
+    command: "rm -f /etc/cron.d/laravel_cron.bak"
+    ignoreErrors: true

package/commands/create/templates/elasticbeanstalk/.ebextensions/laravel/queue-worker.config

@@ -0,0 +1,29 @@
+files:
+  "/etc/systemd/system/queue-worker.service":
+    mode: "000644"
+    owner: root
+    group: root
+    content: |
+      [Unit]
+      Description=Laravel Queue Worker
+      After=network.target php-fpm.service
+
+      [Service]
+      User=webapp
+      Group=webapp
+      WorkingDirectory=/var/app/current
+      EnvironmentFile=/etc/sysconfig/env
+      ExecStart=/usr/bin/php /var/app/current/artisan queue:work database --queue=streaming,default --timeout=620 --tries=1
+      Restart=always
+      RestartSec=5
+      StandardOutput=append:/var/log/queue-worker.log
+      StandardError=append:/var/log/queue-worker.log
+
+      [Install]
+      WantedBy=multi-user.target
+
+commands:
+  01_systemd_reload:
+    command: systemctl daemon-reload
+  02_enable_queue:
+    command: systemctl enable queue-worker

package/commands/create/templates/elasticbeanstalk/.ebextensions/laravel/software.config

@@ -1,4 +1,16 @@
+packages:
+  yum:
+    jq: []
+    mariadb105: []
+
+commands:
+  01_install_phpredis:
+    command: "yum install -y php$(php -r 'echo PHP_MAJOR_VERSION.\".\".PHP_MINOR_VERSION;')-pecl-redis6"
+    test: "! php -m | grep -q redis"
+
 option_settings:
+  aws:elasticbeanstalk:application:environment:
+    BASH_ENV: /etc/profile.d/sh.local
   aws:elasticbeanstalk:container:php:phpini:
     document_root: /public
   aws:elasticbeanstalk:environment:proxy:

package/commands/create/templates/elasticbeanstalk/.ebextensions/misc/setvars.config

@@ -5,22 +5,8 @@ option_settings:
 commands:
   setvars:
     command: |
-      ENV_NAME=$(/opt/elasticbeanstalk/bin/get-config container -k environment_name)
-      REGION=$(TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") && curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region)
-
-      > /etc/profile.d/sh.local
-      > /etc/sysconfig/env
-
-      for GROUP in app storage database; do
-        SECRET_JSON=$(aws secretsmanager get-secret-value \
-          --secret-id "${ENV_NAME}-${GROUP}" \
-          --region "$REGION" \
-          --query SecretString \
-          --output text 2>/dev/null) || continue
-
-        echo "$SECRET_JSON" | jq -r 'to_entries | .[] | "export \(.key)=\u0027\(.value)\u0027"' >> /etc/profile.d/sh.local
-        echo "$SECRET_JSON" | jq -r 'to_entries | .[] | "\(.key)=\"\(.value)\""' >> /etc/sysconfig/env
-      done
+      /opt/elasticbeanstalk/bin/get-config environment | jq -r "to_entries | .[] | \"export \(.key)='\(.value)'\"" > /etc/profile.d/sh.local
+      /opt/elasticbeanstalk/bin/get-config environment | jq -r 'to_entries | .[] | "\(.key)=\"\(.value)\""' > /etc/sysconfig/env
 
 packages:
   yum:

package/commands/create/templates/elasticbeanstalk/.platform/confighooks/postdeploy/rewrite-flush.sh

@@ -1,4 +1,4 @@
 #!/bin/bash
 
 # Flush rewrites to recreate .htaccess files for existing permalink structure
-wp rewrite flush --hard || true
+wp rewrite flush --hard || true

package/commands/create/templates/elasticbeanstalk/.platform/confighooks/postdeploy/setvars.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+ENV_NAME=$(/opt/elasticbeanstalk/bin/get-config container -k environment_name)
+SECRET_ENV=${SECRET_MIRROR_ENV:-$ENV_NAME}
+REGION=$(TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") && curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region)
+
+> /etc/profile.d/sh.local
+> /etc/sysconfig/env
+
+for GROUP in <%= SECRET_GROUPS %>; do
+  SECRET_JSON=$(aws secretsmanager get-secret-value \
+    --secret-id "${SECRET_ENV}-${GROUP}" \
+    --region "$REGION" \
+    --query SecretString \
+    --output text 2>/dev/null) || continue
+
+  echo "$SECRET_JSON" | jq -r 'to_entries | .[] | "export \(.key)='"'"'\(.value)'"'"'"' >> /etc/profile.d/sh.local
+  echo "$SECRET_JSON" | jq -r 'to_entries | .[] | "\(.key)=\"\(.value)\""' >> /etc/sysconfig/env
+done

package/commands/create/templates/elasticbeanstalk/.platform/hooks/postdeploy/restart_queue.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+set -e
+
+systemctl restart queue-worker

package/commands/create/templates/elasticbeanstalk/.platform/hooks/prebuild/setvars.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+ENV_NAME=$(/opt/elasticbeanstalk/bin/get-config container -k environment_name)
+SECRET_ENV=${SECRET_MIRROR_ENV:-$ENV_NAME}
+REGION=$(TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") && curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region)
+
+> /etc/profile.d/sh.local
+> /etc/sysconfig/env
+
+for GROUP in <%= SECRET_GROUPS %>; do
+  SECRET_JSON=$(aws secretsmanager get-secret-value \
+    --secret-id "${SECRET_ENV}-${GROUP}" \
+    --region "$REGION" \
+    --query SecretString \
+    --output text 2>/dev/null) || continue
+
+  echo "$SECRET_JSON" | jq -r 'to_entries | .[] | "export \(.key)='"'"'\(.value)'"'"'"' >> /etc/profile.d/sh.local
+  echo "$SECRET_JSON" | jq -r 'to_entries | .[] | "\(.key)=\"\(.value)\""' >> /etc/sysconfig/env
+done

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fishawack/lab-env",
-    "version": "5.7.0-beta.2",
+    "version": "5.7.0-beta.3",
     "description": "Docker manager for FW",
     "main": "cli.js",
     "scripts": {
@@ -25,12 +25,14 @@
         "@aws-sdk/client-cloudfront": "^3.141.0",
         "@aws-sdk/client-ec2": "^3.399.0",
         "@aws-sdk/client-elastic-beanstalk": "^3.395.0",
+        "@aws-sdk/client-elasticache": "^3.1075.0",
         "@aws-sdk/client-iam": "^3.150.0",
         "@aws-sdk/client-opensearch": "^3.1065.0",
         "@aws-sdk/client-rds": "^3.395.0",
         "@aws-sdk/client-s3": "^3.141.0",
         "@aws-sdk/client-secrets-manager": "^3.395.0",
-        "@aws-sdk/credential-providers": "^3.1011.0",
+        "@aws-sdk/client-ses": "^3.1075.0",
+        "@aws-sdk/credential-providers": "^3.1075.0",
         "apache-md5": "^1.1.8",
         "axios": "^0.21.4",
         "chalk": "4.1.0",
@@ -44,6 +46,7 @@
         "glob": "^13.0.6",
         "inquirer": "8.1.2",
         "lodash": "^4.17.21",
+        "log-update": "^4.0.0",
         "nodemailer": "^6.9.15",
         "ora": "5.4.1",
         "p-limit": "^7.3.0",