Add mail support for kratos using sendgrid (#165)

* Add mail support for kratos using sendgrid

Fixed ClusterIssuer API version
Sendgrid key is no longer templated into secret creation terraform

(closes #156)

* Pass in user auth mail from address to k8s module

Author: bmonkman

templates/Makefile

@@ -28,7 +28,7 @@ apply-secrets:
 	aws secretsmanager describe-secret --secret-id "$(PROJECT)-$(ENVIRONMENT)-rds-<% index .Params `randomSeed` %>" > /dev/null 2>&1 || ( \
 	cd terraform/bootstrap/secrets && \
 	terraform init && \
-	terraform apply $(AUTO_APPROVE) && \
+	terraform apply $(AUTO_APPROVE) --var "sendgrid_api_key=${sendgridApiKey}" && \
 	rm ./terraform.tfstate )
 
 apply-shared-env:

templates/kubernetes/terraform/environments/prod/main.tf

@@ -74,9 +74,11 @@ module "kubernetes" {
     ["Carter L", "10.10.99.202/32", "h2jMuaXNIlx7Z0a3owWFjPsAA8B+ZpQH3FbZK393+08="],
   ]
 
-  auth_enabled            = <% if eq (index .Params `userAuth`) "yes" %>true<% else %>false<% end %>
-  auth_domain             = "auth.${local.domain_name}"
-  backend_service_domain  = "<% index .Params `productionBackendSubdomain` %>${local.domain_name}"
-  frontend_service_domain = "<% index .Params `productionFrontendSubdomain` %>${local.domain_name}"
-
+  domain_name                 = local.domain_name
+  auth_enabled                = <% if eq (index .Params `userAuth`) "yes" %>true<% else %>false<% end %>
+  auth_domain                 = "auth.${local.domain_name}"
+  backend_service_domain      = "<% index .Params `productionBackendSubdomain` %>${local.domain_name}"
+  frontend_service_domain     = "<% index .Params `productionFrontendSubdomain` %>${local.domain_name}"
+  # This domain or address must be verified by the mail provider (Sendgrid, SES, etc.)
+  user_auth_mail_from_address = "noreply@${local.domain_name}"
 }

templates/kubernetes/terraform/environments/stage/main.tf

@@ -73,8 +73,11 @@ module "kubernetes" {
     ["Carter L", "10.10.199.202/32", "h2jMuaXNIlx7Z0a3owWFjPsAA8B+ZpQH3FbZK393+08="],
   ]
 
-  auth_enabled            = <% if eq (index .Params `userAuth`) "yes" %>true<% else %>false<% end %>
-  auth_domain             = "auth.${local.domain_name}"
-  backend_service_domain  = "<% index .Params `stagingBackendSubdomain` %>${local.domain_name}"
-  frontend_service_domain = "<% index .Params `stagingFrontendSubdomain` %>${local.domain_name}"
+  domain_name                 = local.domain_name
+  auth_enabled                = <% if eq (index .Params `userAuth`) "yes" %>true<% else %>false<% end %>
+  auth_domain                 = "auth.${local.domain_name}"
+  backend_service_domain      = "<% index .Params `stagingBackendSubdomain` %>${local.domain_name}"
+  frontend_service_domain     = "<% index .Params `stagingFrontendSubdomain` %>${local.domain_name}"
+  # This domain or address must be verified by the mail provider (Sendgrid, SES, etc.)
+  user_auth_mail_from_address = "noreply@${local.domain_name}"
 }

templates/kubernetes/terraform/modules/kubernetes/files/cert_manager_issuer.yaml.tpl

@@ -1,4 +1,4 @@
-apiVersion: cert-manager.io/v1alpha2
+apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
   name: "${name}"
@@ -18,7 +18,7 @@ spec:
 
 ---
 
-apiVersion: cert-manager.io/v1alpha2
+apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
   name: "${name}-dns"

templates/kubernetes/terraform/modules/kubernetes/user_auth.tf

@@ -96,6 +96,11 @@ resource "helm_release" "kratos" {
   #   # value = "${local.db_type}://${kubernetes_service.app_db.metadata[0].name}.${kubernetes_service.app_db.metadata[0].namespace}"
   # }
 
+  set {
+    name  = "kratos.config.courier.smtp.from_address"
+    value = var.user_auth_mail_from_address
+  }
+
   set {
     name  = "kratos.config.serve.public.base_url"
     value = "https://${var.backend_service_domain}/.ory/kratos/public"

templates/kubernetes/terraform/modules/kubernetes/variables.tf

@@ -88,6 +88,12 @@ variable "cf_signing_enabled" {
   description = "Enable CloudFront signed URLs"
 }
 
+variable "domain_name" {
+  description = "Root domain name"
+  type        = string
+  default     = ""
+}
+
 variable "internal_domain" {
   description = "Internal domain to create records in"
   type        = string
@@ -117,3 +123,9 @@ variable "frontend_service_domain" {
   type        = string
   default     = ""
 }
+
+variable "user_auth_mail_from_address" {
+  description = "Mail from the user management system will come from this address"
+  type        = string
+  default     = ""
+}

templates/scripts/db-ops/secret-user-auth.yml.tpl

@@ -9,4 +9,4 @@ stringData:
   dsn: $DB_TYPE://$DB_APP_USERNAME:$DB_APP_PASSWORD@$DB_ENDPOINT_FOR_DSN/$DB_NAME
   secretsCookie: cookie-secret-$PROJECT_NAME-$SEED
   secretsDefault: default-secret-$PROJECT_NAME-$SEED
-  smtpConnectionURI: http://mail-server-todo:1234
+  smtpConnectionURI: $SMTP_URI

templates/scripts/pre-k8s.sh

@@ -33,16 +33,21 @@ fi
 
 kubectl --context ${KUBE_CONTEXT} -n user-auth get secrets ${PROJECT} > /dev/null 2>&1
 if [[ $? -ne 0 ]]; then
-	REGION=${AWS_DEFAULT_REGION} \
-	SEED=${RANDOM_SEED} \
-	PROJECT_NAME=${PROJECT} \
-	ENVIRONMENT=${ENVIRONMENT} \
-	NAMESPACE=user-auth \
-	DATABASE_TYPE=<% index .Params `database` %> \
-	DATABASE_NAME=user_auth \
-	USER_NAME=kratos \
-	CREATE_SECRET=secret-user-auth.yml.tpl \
-	sh ./create-db-user.sh
+    REGION=${AWS_DEFAULT_REGION} \
+    SEED=${RANDOM_SEED} \
+    PROJECT_NAME=${PROJECT} \
+    ENVIRONMENT=${ENVIRONMENT} \
+    NAMESPACE=user-auth \
+    DATABASE_TYPE=<% index .Params `database` %> \
+    DATABASE_NAME=user_auth \
+    USER_NAME=kratos \
+    CREATE_SECRET=secret-user-auth.yml.tpl \
+    <%- if ne (index .Params `sendgridApiKey`) "" %>
+    SMTP_URI=smtps://apikey:${sendgridApiKey}@smtp.sendgrid.net:465 \
+    <%- else %>
+    SMTP_URI=smtps://no-value-specified:25 \
+    <%- end %>
+    sh ./create-db-user.sh
 fi
 
 <% end %>

templates/terraform/bootstrap/secrets/main.tf

@@ -40,6 +40,6 @@ module "sendgrid_api_key" {
 
   name  = "${local.project}-sendgrid-<% index .Params `randomSeed` %>"
   type  = "string"
-  value = "<% index .Params `sendgridApiKey` %>"
+  value = var.sendgrid_api_key
   tags  = map("sendgrid", local.project)
 }

templates/terraform/bootstrap/secrets/variables.tf

@@ -0,0 +1,4 @@
+variable "sendgrid_api_key" {
+  description = "The Sendgrid API key to use for mailing, if necessary"
+  default     = ""
+}