[rushtong]

Addresses

https://broadworkbench.atlassian.net/browse/DT-4348

Stacked PRs (merge in order):

1. [DT-4348][risk=no] Render the local certs with render-configs.sh (1/5) #3177 Base and certs
2. [DT-4348][risk=no] Render consent.yaml, site.conf and oauth2.conf from terra-helmfile (2/5) #3178 Chart configs
3. [DT-4348][risk=no] Render the local compose files and .env (3/5) #3179 Compose ← this PR
4. [DT-4348][risk=no] Export the dev database and fill the local index (4/5) #3180 Dump and index
5. [DT-4348][risk=no] Render the local config in the Dev Container (5/5) #3181 Dev Container

Summary

Writes config/docker-compose.yaml from a tracked template, and config/.env with the local secrets.

• scripts/templates/docker-compose.yaml: the proxy shares the app network (network_mode: service:app), as in the pod, so the rendered site.conf works with no change. The app gets the -Ddw.* flags for the chart placeholders, -Ddw.liquibase.runOnStartup=true, and no Sentry DSN. Postgres has a healthcheck in place of wait-for-it.sh. Elasticsearch has X-Pack security on, as in DEVNOTES.md. The ADC path follows GCLOUD_ADC_FILE, as in duos-ui.
• .env: POSTGRES_USER and POSTGRES_PASSWORD come from consent-secrets in terra-dev, the same values that duos-ui writes to its .env.local. B2C_APPLICATION_ID comes from consent-proxy-b2c-secrets. The SendGrid key is a placeholder unless --fetch_sendgrid true. Each old value carries forward, and each line that the script does not manage is copied with no change, as in duos-ui. The file has mode 600.
• Proxy image: the chart step now sets PROXY_IMAGE to the consent-proxy image of the rendered deployment. The image moved to proxy.image.* in the chart values, so helm applies all overrides.
• render-configs.sh: adds --write_compose, --fetch_sendgrid and --all. It writes an empty docker-compose.override.yaml once, and never changes an override that exists.
• DEVNOTES.md: each compose command names both compose files. Removes the hand-made compose stanzas.

Until PR 4, set CONSENT_DB_DUMP in config/.env to a dump file in config/ by hand.

Testing

• A stub run of --all true writes the compose files and .env. A second run reads no secrets and keeps .env unchanged, extra lines included.
• docker compose config accepts the output. Without CONSENT_DB_DUMP, Compose stops with the template message.
• Not tested: the real cluster secrets, and whether databaseUser in consent-secrets is consent.

---

Have you read CONTRIBUTING.md lately? If not, do that first.

• Label PR with a Jira ticket number and include a link to the ticket
• Label PR with a security risk modifier [no, low, medium, high]
• PR describes scope of changes
• Get a minimum of one thumbs worth of review, preferably two if enough team members are available
• Get PO sign-off for all non-trivial UI or workflow changes
• Verify all tests go green
• Test this change deployed correctly and works on dev environment after deployment

🤖 Generated with Claude Code