adds envconsul to inject secrets into container. allows container to …

…be run in "sidekiq" mode

Dockerfile

@@ -12,6 +12,11 @@ RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.34.0/install.sh | b
 ENV NODE_PATH $NVM_DIR/v$NODE_VERSION/lib/node_modules
 ENV PATH $NVM_DIR/versions/node/v$NODE_VERSION/bin:$PATH
 
+### Envconsul
+RUN curl -Lo /tmp/envconsul.zip https://releases.hashicorp.com/envconsul/0.9.0/envconsul_0.9.0_linux_amd64.zip && \
+    unzip /tmp/envconsul.zip -d /bin && \
+    rm /tmp/envconsul.zip
+
 RUN . $NVM_DIR/nvm.sh \
     && nvm install $NODE_VERSION \
     && nvm alias default $NODE_VERSION \
@@ -35,6 +40,6 @@ RUN bundle install
 
 COPY . /app
 
-RUN aws_bucket=bucket aws_access_key_id=key aws_secret_access_key=access aws_region=us-east-1 rails assets:precompile
+RUN RAILS_ENV=production SECRET_KEY_BASE=$(bundle exec rails secret) aws_bucket=bucket aws_access_key_id=key aws_secret_access_key=access aws_region=us-east-1 rails assets:precompile
 
 CMD ["./entrypoint.sh"]

app/assets/stylesheets/application.css

@@ -16,4 +16,3 @@
 
  /* uppy styles from https://transloadit.edgly.net/releases/uppy/v1.4.0/uppy.min.css placed in ./uppy/uppy.css
  */
- require 'uppy'

config/environments/production.rb

@@ -25,7 +25,8 @@
   config.public_file_server.enabled = ENV['RAILS_SERVE_STATIC_FILES'].present?
 
   # Compress JavaScripts and CSS.
-  config.assets.js_compressor = :uglifier
+  # config.assets.js_compressor = :uglifier
+  config.assets.js_compressor = Uglifier.new(harmony: true)
   # config.assets.css_compressor = :sass
 
   # Do not fallback to assets pipeline if a precompiled asset is missed.

entrypoint.sh

@@ -1,6 +1,28 @@
 #!/bin/bash
+set -e 
 
-rails db:create
-rails db:migrate
+# Vault init container will drop the token in /etc/vault/token; alternatively we can set the VAULT_TOKEN env variable 
+if [ -f /vault/token ]; then
+    export VAULT_TOKEN=$(cat /vault/token)
+fi
 
-rails s -b '0.0.0.0'
+function start_envconsul() {
+    set -u 
+    envconsul \
+        -vault-addr=${VAULT_ADDR} \
+        -secret=${VAULT_PATH} \
+        -vault-token=${VAULT_TOKEN} \
+        -no-prefix=true \
+        -vault-renew-token=false \
+        -once \
+        -exec='bash start.sh'
+}
+
+
+if [ -n "${VAULT_TOKEN}" ]; then
+    echo "have token. starting envconsul"
+    start_envconsul
+else
+    echo "starting the app"
+    bash start.sh
+fi

start.sh

@@ -0,0 +1,11 @@
+
+
+if [ ${APP_ROLE:-app} == "sidekiq" ]; then
+    echo "starting sidekiq"
+    bundle exec sidekiq
+else
+    echo "starting rails"
+    rails db:create
+    rails db:migrate
+    rails s -b '0.0.0.0'
+fi