[DT-4348][risk=no] Render the local config in the Dev Container (5/5)

.devcontainer/devcontainer-lock.json

@@ -9,6 +9,11 @@
       "version": "1.8.0",
       "resolved": "ghcr.io/devcontainers/features/java@sha256:9663ce0219ff85786e87901ce5f0a59f488edd5f99b46015192cda48468b233a",
       "integrity": "sha256:9663ce0219ff85786e87901ce5f0a59f488edd5f99b46015192cda48468b233a"
+    },
+    "ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {
+      "version": "1.3.1",
+      "resolved": "ghcr.io/devcontainers/features/kubectl-helm-minikube@sha256:bbe8adf6b37fff8c67412ab0a4579f4c2f30bbaba1d9a5cebd9e38bade54025b",
+      "integrity": "sha256:bbe8adf6b37fff8c67412ab0a4579f4c2f30bbaba1d9a5cebd9e38bade54025b"
     }
   }
 }

.devcontainer/devcontainer.json

@@ -9,7 +9,13 @@
         },
         "ghcr.io/devcontainers/features/docker-in-docker:2": {
             "moby": false
+        },
+        "ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {
+            "helm": "4.2.3",
+            "minikube": "none"
         }
     },
+    "postCreateCommand": "./scripts/setup-devcontainer.sh",
+    "forwardPorts": [27443, 7777, 9200],
     "remoteUser": "vscode"
 }

DEVNOTES.md

@@ -35,6 +35,39 @@ docker build . -t consent
 
 This image can then be run with the proper configuration files provided.
 
+### Dev Container
+
+If you use Visual Studio Code (VSCode) and Docker, you can use the Dev Container configuration. The
+container makes the local config files for you, the same way as the `duos-ui` Dev Container. When
+the container is created, it runs [setup-devcontainer.sh](scripts/setup-devcontainer.sh), which
+installs `gcloud`, asks for a `gcloud` login, and runs [render-configs.sh](scripts/render-configs.sh)
+with `--all true`.
+
+1. Connect the host to the non-split Broad VPN. Make sure that the host's git credentials can read
+   `broadinstitute/terra-helmfile`. VSCode shares them with the container.
+
+2. Open the project in VSCode. When the notification in the bottom right corner asks about the Dev
+   Container, click "Reopen in container".
+
+3. When the setup script asks for the `gcloud` login, complete it in the browser that opens.
+
+4. If the setup fails (for example, the VPN is down), fix the issue. Then rebuild the container,
+   or run the script again. Every 3 months the certs rotate. Run the script again to make the
+   files again. It does not make a new database dump when one exists.
+
+   ```sh
+   ./scripts/setup-devcontainer.sh
+   ```
+
+5. To run the stack in the container, the app also needs Application Default Credentials. Run
+   `gcloud auth application-default login` in the container.
+
+You can run the stack in the container (Docker-in-Docker) or on the host. Both use the same
+`config/` files. The container forwards ports 27443, 7777 and 9200 to the host. Run
+`./scripts/index-es.sh` where the stack runs.
+
+If you do not use the Dev Container, run `render-configs.sh` yourself. See the next section.
+
 ### Render Configs
 
 [render-configs.sh](scripts/render-configs.sh) makes the files in `config/` (git-ignored) that the

scripts/render-configs.sh

@@ -4,7 +4,8 @@
 # ("Render Configs") and docs/plans/render-local-configs-plan.md.
 #
 # A run with no options writes only the certs, which rotate every 3 months. Other options turn
-# on the other files. --all turns on all of them.
+# on the other files. --all turns on all of them. In the Dev Container,
+# scripts/setup-devcontainer.sh runs this script.
 #
 # You MUST be on the non-split Broad VPN for the steps that read the dev cluster: the certs, and
 # the .env values that an old .env does not have. You MUST be logged in with gcloud. The chart

scripts/setup-devcontainer.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+#
+# Runs after the Dev Container is created. Installs gcloud, asks for a gcloud login, then makes
+# the local config files with render-configs.sh --all true. This follows the duos-ui script. Each
+# step can run again safely, so run this script again after a failure or when the certs rotate.
+#
+# Developers who do not use the Dev Container run render-configs.sh directly.
+
+set -eu
+set -o pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+# On failure, tell the developer how to recover. Most failures come from a missing VPN
+# connection, which blocks kubectl.
+on_exit() {
+  local status=$?
+  if ((status != 0)); then
+    echo >&2
+    echo "Dev Container setup failed. Are you connected to the non-split Broad VPN?" >&2
+    echo "Fix the issue, then rebuild the container or run: ./scripts/setup-devcontainer.sh" >&2
+  fi
+}
+trap on_exit EXIT
+
+# gcloud and the GKE auth plugin come from Google's own apt repository, as in duos-ui. jq,
+# openssl and gzip are for the local config scripts.
+install_tools() {
+  curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg \
+    | sudo gpg --batch --yes --dearmor -o /usr/share/keyrings/cloud.google.gpg
+  echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" \
+    | sudo tee /etc/apt/sources.list.d/google-cloud-sdk.list > /dev/null
+  sudo apt-get update
+  sudo apt-get install -y google-cloud-cli google-cloud-cli-gke-gcloud-auth-plugin jq openssl gzip
+}
+
+install_consent_config() {
+  if [[ -z "$(gcloud auth list --filter=status:ACTIVE --format='value(account)' 2> /dev/null)" ]]; then
+    printf "\n"
+    gcloud auth login
+  fi
+  ./scripts/render-configs.sh --all true
+  # The compose template mounts this file into the app. Only the container mode needs it here:
+  # a developer who runs compose on the host uses the file on the host.
+  if [[ ! -f "$HOME/.config/gcloud/application_default_credentials.json" ]]; then
+    echo
+    echo "To run the stack in this container, run: gcloud auth application-default login"
+  fi
+}
+
+install_tools
+install_consent_config