From ee175a464424718c57648afdd8321bcb01164518 Mon Sep 17 00:00:00 2001 From: Gregory Rushton Date: Fri, 23 Oct 2026 10:32:32 -0400 Subject: [PATCH] [DT-4348][risk=no] Render the local config in the Dev Container (5/5) Co-Authored-By: Claude Opus 5.5 --- .devcontainer/devcontainer-lock.json | 5 +++ .devcontainer/devcontainer.json | 6 ++++ DEVNOTES.md | 33 ++++++++++++++++++ scripts/render-configs.sh | 3 +- scripts/setup-devcontainer.sh | 52 ++++++++++++++++++++++++++++ 5 files changed, 98 insertions(+), 1 deletion(-) create mode 100755 scripts/setup-devcontainer.sh diff --git a/.devcontainer/devcontainer-lock.json b/.devcontainer/devcontainer-lock.json index 4c9be4bf48..b8deed7220 100644 --- a/.devcontainer/devcontainer-lock.json +++ b/.devcontainer/devcontainer-lock.json @@ -9,6 +9,11 @@ "version": "1.8.0", "resolved": "ghcr.io/devcontainers/features/java@sha256:9663ce0219ff85786e87901ce5f0a59f488edd5f99b46015192cda48468b233a", "integrity": "sha256:9663ce0219ff85786e87901ce5f0a59f488edd5f99b46015192cda48468b233a" + }, + "ghcr.io/devcontainers/features/kubectl-helm-minikube:1": { + "version": "1.3.1", + "resolved": "ghcr.io/devcontainers/features/kubectl-helm-minikube@sha256:bbe8adf6b37fff8c67412ab0a4579f4c2f30bbaba1d9a5cebd9e38bade54025b", + "integrity": "sha256:bbe8adf6b37fff8c67412ab0a4579f4c2f30bbaba1d9a5cebd9e38bade54025b" } } } diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index ac8092f20e..a5421b63ca 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -9,7 +9,13 @@ }, "ghcr.io/devcontainers/features/docker-in-docker:2": { "moby": false + }, + "ghcr.io/devcontainers/features/kubectl-helm-minikube:1": { + "helm": "4.2.3", + "minikube": "none" } }, + "postCreateCommand": "./scripts/setup-devcontainer.sh", + "forwardPorts": [27443, 7777, 9200], "remoteUser": "vscode" } diff --git a/DEVNOTES.md b/DEVNOTES.md index 71b036b4c9..fe1a3813c8 100644 --- a/DEVNOTES.md +++ b/DEVNOTES.md @@ -35,6 +35,39 @@ docker build . -t consent This image can then be run with the proper configuration files provided. +### Dev Container + +If you use Visual Studio Code (VSCode) and Docker, you can use the Dev Container configuration. The +container makes the local config files for you, the same way as the `duos-ui` Dev Container. When +the container is created, it runs [setup-devcontainer.sh](scripts/setup-devcontainer.sh), which +installs `gcloud`, asks for a `gcloud` login, and runs [render-configs.sh](scripts/render-configs.sh) +with `--all true`. + +1. Connect the host to the non-split Broad VPN. Make sure that the host's git credentials can read + `broadinstitute/terra-helmfile`. VSCode shares them with the container. + +2. Open the project in VSCode. When the notification in the bottom right corner asks about the Dev + Container, click "Reopen in container". + +3. When the setup script asks for the `gcloud` login, complete it in the browser that opens. + +4. If the setup fails (for example, the VPN is down), fix the issue. Then rebuild the container, + or run the script again. Every 3 months the certs rotate. Run the script again to make the + files again. It does not make a new database dump when one exists. + + ```sh + ./scripts/setup-devcontainer.sh + ``` + +5. To run the stack in the container, the app also needs Application Default Credentials. Run + `gcloud auth application-default login` in the container. + +You can run the stack in the container (Docker-in-Docker) or on the host. Both use the same +`config/` files. The container forwards ports 27443, 7777 and 9200 to the host. Run +`./scripts/index-es.sh` where the stack runs. + +If you do not use the Dev Container, run `render-configs.sh` yourself. See the next section. + ### Render Configs [render-configs.sh](scripts/render-configs.sh) makes the files in `config/` (git-ignored) that the diff --git a/scripts/render-configs.sh b/scripts/render-configs.sh index 1b0b0aad77..b4a07dfdd4 100755 --- a/scripts/render-configs.sh +++ b/scripts/render-configs.sh @@ -4,7 +4,8 @@ # ("Render Configs") and docs/plans/render-local-configs-plan.md. # # A run with no options writes only the certs, which rotate every 3 months. Other options turn -# on the other files. --all turns on all of them. +# on the other files. --all turns on all of them. In the Dev Container, +# scripts/setup-devcontainer.sh runs this script. # # You MUST be on the non-split Broad VPN for the steps that read the dev cluster: the certs, and # the .env values that an old .env does not have. You MUST be logged in with gcloud. The chart diff --git a/scripts/setup-devcontainer.sh b/scripts/setup-devcontainer.sh new file mode 100755 index 0000000000..77ee12887a --- /dev/null +++ b/scripts/setup-devcontainer.sh @@ -0,0 +1,52 @@ +#!/bin/bash +# +# Runs after the Dev Container is created. Installs gcloud, asks for a gcloud login, then makes +# the local config files with render-configs.sh --all true. This follows the duos-ui script. Each +# step can run again safely, so run this script again after a failure or when the certs rotate. +# +# Developers who do not use the Dev Container run render-configs.sh directly. + +set -eu +set -o pipefail + +cd "$(dirname "${BASH_SOURCE[0]}")/.." + +# On failure, tell the developer how to recover. Most failures come from a missing VPN +# connection, which blocks kubectl. +on_exit() { + local status=$? + if ((status != 0)); then + echo >&2 + echo "Dev Container setup failed. Are you connected to the non-split Broad VPN?" >&2 + echo "Fix the issue, then rebuild the container or run: ./scripts/setup-devcontainer.sh" >&2 + fi +} +trap on_exit EXIT + +# gcloud and the GKE auth plugin come from Google's own apt repository, as in duos-ui. jq, +# openssl and gzip are for the local config scripts. +install_tools() { + curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg \ + | sudo gpg --batch --yes --dearmor -o /usr/share/keyrings/cloud.google.gpg + echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" \ + | sudo tee /etc/apt/sources.list.d/google-cloud-sdk.list > /dev/null + sudo apt-get update + sudo apt-get install -y google-cloud-cli google-cloud-cli-gke-gcloud-auth-plugin jq openssl gzip +} + +install_consent_config() { + if [[ -z "$(gcloud auth list --filter=status:ACTIVE --format='value(account)' 2> /dev/null)" ]]; then + printf "\n" + gcloud auth login + fi + ./scripts/render-configs.sh --all true + # The compose template mounts this file into the app. Only the container mode needs it here: + # a developer who runs compose on the host uses the file on the host. + if [[ ! -f "$HOME/.config/gcloud/application_default_credentials.json" ]]; then + echo + echo "To run the stack in this container, run: gcloud auth application-default login" + fi +} + +install_tools +install_consent_config