@chimoney.io/iaas-k8s-deployment/dist/src/utils/secrets.js

Kubernetes Infrastructure as a Service deployment package for streamlined multi-cloud environments

import * as pulumi from "@pulumi/pulumi";
import * as crypto from "crypto";
/**
 * Generate a cryptographically secure random string
 */
export function generateSecureSecret(config = {}) {
    const { length = 32, includeSpecialChars = true, prefix = "" } = config;
    const charset = includeSpecialChars
        ? "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*"
        : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
    let result = prefix;
    for (let i = 0; i < length; i++) {
        result += charset.charAt(Math.floor(Math.random() * charset.length));
    }
    return result;
}
/**
 * Generate secure database URL with random credentials
 */
export function generateDatabaseCredentials(dbHost, dbName) {
    const user = `rafiki_${generateSecureSecret({ length: 8, includeSpecialChars: false })}`;
    const password = pulumi.secret(generateSecureSecret({ length: 24 }));
    const connectionString = pulumi.interpolate `postgresql://${user}:${password}@${dbHost}:5432/${dbName}?ssl=true`;
    return {
        user,
        password,
        connectionString
    };
}
/**
 * Generate secure API keys and secrets for Rafiki services
 */
export function generateRafikiSecrets() {
    return {
        authCookieKey: generateSecureSecret({ length: 32 }),
        authIdentityServerSecret: generateSecureSecret({ length: 24 }),
        streamSecret: crypto.randomBytes(32).toString('base64'),
        adminKey: generateSecureSecret({ length: 16, includeSpecialChars: false }),
        nonceRedisKey: generateSecureSecret({ length: 16, includeSpecialChars: false })
    };
}
/**
 * Create secure environment variables configuration
 */
export function createSecureEnvironmentConfig(companyName, environment, databaseUrl) {
    const secrets = generateRafikiSecrets();
    const baseUrl = `https://${companyName.toLowerCase()}-rafiki-${environment}.com`;
    return {
        auth: {
            AUTH_PORT: 3006,
            AUTH_ADMIN_PORT: 3008,
            AUTH_INTROSPECTION_PORT: 3007,
            AUTH_COOKIE_KEY: secrets.authCookieKey,
            AUTH_DATABASE_URL: databaseUrl,
            AUTH_IDENTITY_SERVER_URL: `${baseUrl}/auth/interledger/app?next=/consent`,
            AUTH_IDENTITY_SERVER_SECRET: secrets.authIdentityServerSecret,
            AUTH_SERVER_URL: `${baseUrl}/auth`,
            AUTH_WAIT_SECONDS: 5,
            AUTH_REDIS_URL: "redis://redis:6379/0"
        },
        backend: {
            LOG_LEVEL: environment === "production" ? "info" : "debug",
            ADMIN_PORT: 3001,
            CONNECTOR_PORT: 3002,
            OPEN_PAYMENTS_PORT: 80,
            DATABASE_URL: databaseUrl,
            USE_TIGERBEETLE: false,
            TIGERBEETLE_CLUSTER_ID: 0,
            TIGERBEETLE_REPLICA_ADDRESSES: "",
            NONCE_REDIS_KEY: secrets.nonceRedisKey,
            AUTH_SERVER_GRANT_URL: `${baseUrl}/auth`,
            AUTH_SERVER_INTROSPECTION_URL: "http://rafiki-auth:3007",
            ILP_ADDRESS: `test.${companyName.toLowerCase()}-rafiki`,
            STREAM_SECRET: secrets.streamSecret,
            ADMIN_KEY: secrets.adminKey,
            PUBLIC_HOST: baseUrl,
            OPEN_PAYMENTS_URL: baseUrl,
            REDIS_URL: "redis://redis:6379/1",
            WALLET_ADDRESS_URL: `${baseUrl}/.well-known/pay`,
            WEBHOOK_URL: `${baseUrl}/webhook/rafiki`,
            WEBHOOK_TIMEOUT: 60000,
            EXCHANGE_RATES_URL: `${baseUrl}/rates`,
            AUTOPEERING_PORT: 3005,
            ILP_CONNECTOR_URL: `${baseUrl}/connector`,
            INSTANCE_NAME: companyName,
            SLIPPAGE: 0.01
        }
    };
}
//# sourceMappingURL=secrets.js.map