chore: prod deploy (#478)

* chore: prod deploy

add prod deployment pipeline for otp server

Signed-off-by: jonathan langlois <jonathan.langlois@gov.bc.ca>

* chore: semver

add input to tag images

* chore: typo

update typo oath -> oauth

---------

Signed-off-by: jonathan langlois <jonathan.langlois@gov.bc.ca>

Author: jlangy

.github/workflows/publish-otp-provider-image.yml

@@ -1,6 +1,20 @@
 name: Create and publish Otp Provider Docker image
 
 on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Choose environment'
+        required: true
+        default: 'development'
+        type: choice
+        options:
+          - development
+          - production
+      version:
+        description: 'Image tag (e.g. v1.2.3)'
+        required: true
+        default: 'latest'
   push:
     branches:
       - 'dev'
@@ -16,7 +30,7 @@ jobs:
 
     steps:
       - name: Set env to development
-        if: (github.ref == 'refs/heads/dev' && github.event_name == 'push')
+        if: (github.ref == 'refs/heads/dev' && github.event_name == 'push') || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'development')
         run: |
           cat >> $GITHUB_ENV <<EOF
           APP_ENV=development
@@ -30,21 +44,49 @@ jobs:
           HASH_SALT=${{ secrets.DEV_HASH_SALT }}
 
           GRAFANA_OAUTH_CLIENT_SECRET=${{secrets.DEV_GRAFANA_OAUTH_CLIENT_SECRET}}
-          GRAFANA_OATH_CLIENT_ID=${{secrets.DEV_GRAFANA_OATH_CLIENT_ID}}
+          GRAFANA_OAUTH_CLIENT_ID=${{secrets.DEV_GRAFANA_OAUTH_CLIENT_ID}}
           KEYCLOAK_BASE_URL=${{secrets.DEV_KEYCLOAK_BASE_URL}}
 
+          EOF
+
+      - name: Set env to production
+        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'production')
+        run: |
+          cat >> $GITHUB_ENV <<EOF
+          APP_ENV=production
+          APP_URL=https://otp.loginproxy.gov.bc.ca
+          TF_STATE_BUCKET=xgr00q-prod-sso-otp-provider
+          TF_STATE_BUCKET_KEY=sso-otp-provider.tfstate
+          TF_STATE_DYNAMODB_TABLE=xgr00q-prod-otp-state-locking
+          CUSTOM_DOMAIN_NAME=otp.loginproxy.gov.bc.ca
+          CORS_ORIGINS=https://dev.loginproxy.gov.bc.ca,https://test.loginproxy.gov.bc.ca,https://loginproxy.gov.bc.ca,https://sso-playground.apps.gold.devops.gov.bc.ca
+          NODE_ENV=production
+          HASH_SALT=${{ secrets.PROD_HASH_SALT }}
+
+          GRAFANA_OAUTH_CLIENT_SECRET=${{secrets.PROD_GRAFANA_OAUTH_CLIENT_SECRET}}
+          GRAFANA_OAUTH_CLIENT_ID=${{secrets.PROD_GRAFANA_OAUTH_CLIENT_ID}}
+          KEYCLOAK_BASE_URL=${{secrets.PROD_KEYCLOAK_BASE_URL}}
+
           EOF
       - name: Checkout repository
         uses: actions/checkout@v3
 
       - uses: hashicorp/setup-terraform@v3
 
-      - name: Configure AWS Credentials
+      - name: Configure AWS Dev Credentials
+        if: (github.ref == 'refs/heads/dev' && github.event_name == 'push') || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'development')
         uses: aws-actions/configure-aws-credentials@v4
         with:
           role-to-assume: ${{ secrets.DEV_OTP_TF_DEPLOY_ROLE_ARN }}
           aws-region: ca-central-1
 
+      - name: Configure AWS Prod Credentials
+        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'production')
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.PROD_OTP_TF_DEPLOY_ROLE_ARN }}
+          aws-region: ca-central-1
+
       - name: Login to Amazon ECR
         id: login-ecr
         uses: aws-actions/amazon-ecr-login@v2
@@ -53,7 +95,7 @@ jobs:
         env:
           REGISTRY: ${{ steps.login-ecr.outputs.registry }}
           REPOSITORY: ${{ env.IMAGE_NAME }}
-          IMAGE_TAG: latest
+          IMAGE_TAG: ${{ github.event.inputs.version || 'latest' }}
         run: |
           echo "Building and pushing Docker image to ECR..."
           docker build -t $REGISTRY/$REPOSITORY:$IMAGE_TAG .
@@ -86,12 +128,13 @@ jobs:
           otp_validity_minutes="5"
           otp_attempts_allowed="5"
           otp_resends_allowed_per_day="4"
-          otp_resend_interval_minutes="[1,2,5,60]"
+          otp_resend_interval_minutes="[1,2,5,25]"
           grafana_admin_password="${{env.GRAFANA_ADMIN_PASS}}"
           enable_grafana=true
           grafana_oauth_client_secret="${{env.GRAFANA_OAUTH_CLIENT_SECRET}}"
-          grafana_oath_client_id="${{env.GRAFANA_OATH_CLIENT_ID}}"
+          grafana_oauth_client_id="${{env.GRAFANA_OAUTH_CLIENT_ID}}"
           keycloak_base_url="${{env.KEYCLOAK_BASE_URL}}"
+          image_tag="${{ github.event.inputs.version || 'latest' }}"
 
           EOF
 

docker/otp-provider/terraform/ecs.tf

@@ -377,7 +377,7 @@ resource "aws_ecs_task_definition" "grafana" {
         },
         {
           name  = "GF_AUTH_GENERIC_OAUTH_CLIENT_ID",
-          value = var.grafana_oath_client_id
+          value = var.grafana_oauth_client_id
         },
         {
           name  = "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET",

docker/otp-provider/terraform/variables.tf

@@ -191,7 +191,7 @@ variable "grafana_oauth_client_secret" {
   type      = string
 }
 
-variable "grafana_oath_client_id" {
+variable "grafana_oauth_client_id" {
   type = string
 }