Enable auth-service/api-gateway on production, build their images in CI

2026-08-18 14:11:00 +07:00
parent e5afedfa2f
commit b68005be1c
70 changed files with 6781 additions and 263 deletions
@@ -0,0 +1,37 @@
+/** Minimal env-var settings — mirrors the style of `apps/ai-service/config.py`
+ * (plain, explicit fields, no framework-specific config module) rather than
+ * pulling in `@nestjs/config` for four variables. */
+export interface Settings {
+  port: number;
+  postgresDsn: string;
+  jwtSecret: string;
+  jwtExpiresIn: string;
+  adminSeedPassword: string;
+  demoSeedPassword: string;
+}
+
+export function loadSettings(): Settings {
+  const jwtSecret = process.env.JWT_SECRET ?? "";
+  if (!jwtSecret) {
+    // Fail closed at startup, not at the first login attempt — the same
+    // posture as ai-service's manifest check in bootstrap.py: a service that
+    // would sign tokens with an empty/guessable secret must not start at all.
+    throw new Error(
+      "JWT_SECRET is required and must not be empty. Refusing to start with " +
+        "no secret rather than silently signing tokens no one can trust."
+    );
+  }
+  return {
+    port: Number(process.env.PORT ?? 3010),
+    postgresDsn:
+      process.env.POSTGRES_DSN ??
+      "postgresql://duoc_thu:duoc_thu@localhost:5432/duoc_thu",
+    jwtSecret,
+    jwtExpiresIn: process.env.JWT_EXPIRES_IN ?? "12h",
+    // Default "1" only exists for local/Compose dev, which never sets these.
+    // A real deployment sets them via the Helm Secret — see
+    // secret.adminSeedPassword in infra/helm/medical-chatbot/values.yaml.
+    adminSeedPassword: process.env.ADMIN_SEED_PASSWORD ?? "1",
+    demoSeedPassword: process.env.DEMO_SEED_PASSWORD ?? "1",
+  };
+}