[develop] fix: metrics db connection ca certificate

.env.example

@@ -16,22 +16,20 @@ REMOTE_REDIS_ENDPOINT=cache:6379
 LOCAL_REDIS_ENDPOINT=local-cache:6379
 REDIS_LOCAL_TTL_FACTOR=1
 
-# tsdb env
-PG_CONNECTION=postgres://pguser:pgpassword@metricsdb:5432/gateway
-PG_CERTIFICATE=PG_PRODUCTION_CERTIFICATE
-
 # Influx DB
 INFLUX_URL=http://influxdb:8086
 INFLUX_TOKEN=mytoken
 INFLUX_ORG=myorg
 
+# Metrics DB
+PSQL_CONNECTION=postgres://pguser:pgpassword@metricsdb:5432/gateway
+PSQL_CERTIFICATE=https://s3.amazonaws.com/
+
 # logz
 LOGZ_TOKEN=12345
 
 # pocket protocol dispatch and fallback nodes
 DISPATCH_URL=https://node1.mainnet.pokt.network,https://node2.mainnet.pokt.network,https://node3.mainnet.pokt.network,https://node4.mainnet.pokt.network,https://node5.mainnet.pokt.network,https://node6.mainnet.pokt.network,https://node7.mainnet.pokt.network,https://node8.mainnet.pokt.network,https://node9.mainnet.pokt.network,https://node10.mainnet.pokt.network,https://node11.mainnet.pokt.network,https://node12.mainnet.pokt.network,https://node13.mainnet.pokt.network,https://node14.mainnet.pokt.network,https://node15.mainnet.pokt.network,https://node16.mainnet.pokt.network,https://node17.mainnet.pokt.network,https://node18.mainnet.pokt.network,https://node19.mainnet.pokt.network,https://node20.mainnet.pokt.network
-ALTRUISTS={"0001":"https://user:[email protected]:18081","0003":"https://user:[email protected]:19650","0004":"https://user:[email protected]:18552","0005":"https://user:[email protected]:18553","0009":"https://user:[email protected]:18554","0010":"https://user:[email protected]:18552","0021":"https://user:[email protected]:18545","0022":"https://user:[email protected]:18545","0023":"https://user:[email protected]:18557","0024":"https://user:[email protected]:18548","0025":"https://user:[email protected]:18555","0026":"https://user:[email protected]:18556","0027":"https://user:[email protected]:18546","0028":"https://user:[email protected]:18545","000A":"https://user:[email protected]:18553"}
-POCKET_NETWORK_NODE_URL="https://user:[email protected]:18081"
 POCKET_SESSION_BLOCK_FREQUENCY=4
 POCKET_BLOCK_TIME=1038000
 POCKET_RELAY_RETRIES=0
@@ -46,12 +44,12 @@ AAT_PLAN=freemium
 WATCH=true
 NODE_ENV=development
 REGION=localhost
+ARCHIVAL_CHAINS="0022,0028,0010,000A,000B,000C"
 
 # For connection to the metrics db using self-signed cert
 NODE_TLS_REJECT_UNAUTHORIZED=0
 
 LOG_TO_CLOUDWATCH=false
-REDIRECTS=[{"domain":"ethereum.example.com","blockchain":"ethereum-mainnet","loadBalancerID":"1234567890"},]
 
 # Datadog logging
 LOG_TO_DATADOG=false

.github/workflows/canary-ap-northeast-2.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/canary-ca-central-1.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/canary-eu-central-1.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/canary-us-west-2.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-ap-east-1.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-ap-northeast-1.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-ap-northeast-2.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-ap-south-1.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-ap-southeast-1.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-ca-central-1.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-eu-central-1.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-eu-north-1.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-eu-south-1.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-eu-west-1.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-eu-west-2.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-eu-west-3.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-us-east-1.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-us-east-2.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/production-us-west-2.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/staging-us-west-2.yml

@@ -51,6 +51,7 @@ jobs:
           envkey_INFLUX_ORG: pocket
           envkey_INFLUX_TOKEN: ${{ secrets.INFLUX_TOKEN }}
           envkey_PSQL_CONNECTION: ${{ secrets.PSQL_CONNECTION }}
+          envkey_PSQL_CERTIFICATE: https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
           envkey_LOG_TO_CLOUDWATCH: false
           envkey_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           envkey_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

pocket-gateway/tasks/shared-envs.json

@@ -88,6 +88,10 @@
       "key": "PSQL_CONNECTION",
       "value": "${{ secrets.PSQL_CONNECTION }}"
     },
+    {
+      "key": "PSQL_CERTIFICATE",
+      "value": "https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem"
+    },
     {
       "key": "LOG_TO_CLOUDWATCH",
       "value": false

src/application.ts

@@ -15,6 +15,7 @@ import AatPlans from './config/aat-plans.json'
 import { getPocketInstance } from './config/pocket-config'
 import { GatewaySequence } from './sequence'
 import { Cache } from './services/cache'
+import { getRDSCertificate } from './utils/cache'
 const logger = require('./services/logger')
 
 require('log-timestamp')
@@ -54,6 +55,7 @@ export class PocketGatewayApplication extends BootMixin(ServiceMixin(RepositoryM
       REMOTE_REDIS_ENDPOINT,
       LOCAL_REDIS_ENDPOINT,
       PSQL_CONNECTION,
+      PSQL_CERTIFICATE,
       DISPATCH_URL,
       POCKET_RELAY_RETRIES,
       DEFAULT_SYNC_ALLOWANCE,
@@ -144,10 +146,25 @@ export class PocketGatewayApplication extends BootMixin(ServiceMixin(RepositoryM
 
     // New metrics postgres for error recording
     const psqlConnection: string = PSQL_CONNECTION || ''
+    const psqlCertificate: string = PSQL_CERTIFICATE || ''
+
+    let rdsCertificate: string
+
+    if (environment === 'production') {
+      rdsCertificate = await getRDSCertificate(remoteRedis as Redis.Redis, psqlCertificate)
+    }
 
     const pgPool = new pg.Pool({
+      // Do not include ssl settings in the connectionString
       connectionString: psqlConnection,
-      ssl: environment === 'production' || environment === 'staging' ? true : false,
+      ssl:
+        environment === 'production' || environment === 'staging'
+          ? {
+              ca: rdsCertificate,
+              requestCert: true,
+              rejectUnauthorized: false,
+            }
+          : false,
     })
 
     this.bind('pgPool').to(pgPool)

src/observers/environment.observer.ts

@@ -23,6 +23,7 @@ export class EnvironmentObserver implements LifeCycleObserver {
     'REMOTE_REDIS_ENDPOINT',
     'LOCAL_REDIS_ENDPOINT',
     'PSQL_CONNECTION',
+    'PSQL_CERTIFICATE',
     'INFLUX_URL',
     'INFLUX_TOKEN',
     'INFLUX_ORG',

src/utils/cache.ts

@@ -1,4 +1,6 @@
 import { Node, Session } from '@pokt-foundation/pocketjs-types'
+import axios, { AxiosRequestConfig } from 'axios'
+import { Redis } from 'ioredis'
 import { Cache } from '../services/cache'
 
 const logger = require('../services/logger')
@@ -49,3 +51,29 @@ export async function removeChecksCache(cache: Cache, sessionKey: string, nodes:
   await cache.del(`sync-check-${sessionKey}`)
   await cache.del(`chain-check-${sessionKey}`)
 }
+
+export async function getRDSCertificate(redis: Redis, certificateUrl: string): Promise<string> {
+  const cachedCertificate = await redis.get('psqlCertificate')
+  let publicCertificate
+
+  if (!cachedCertificate) {
+    try {
+      const axiosConfig = {
+        method: 'GET',
+        url: certificateUrl,
+      } as AxiosRequestConfig
+
+      const { data: rdsCertificate } = await axios(axiosConfig)
+
+      publicCertificate = rdsCertificate
+    } catch (e) {
+      throw new Error('Invalid Certificate')
+    }
+
+    await redis.set('psqlCertificate', publicCertificate, 'EX', 600)
+  } else {
+    publicCertificate = cachedCertificate
+  }
+
+  return publicCertificate
+}

tests/acceptance/test-helper.ts

@@ -14,9 +14,8 @@ export const DUMMY_ENV = {
   REDIS_PORT: '6379',
   REMOTE_REDIS_ENDPOINT: 'cache:6379',
   LOCAL_REDIS_ENDPOINT: 'local-cache:6380',
-  PG_CONNECTION: 'postgres://pguser:pgpassword@metricsdb:5432/gateway',
-  PG_CERTIFICATE: 'PG_PRODUCTION_CERTIFICATE',
   PSQL_CONNECTION: 'postgres://pguser:pgpassword@metricsdb:5432/gateway',
+  PSQL_CERTIFICATE: 'PG_PRODUCTION_CERTIFICATE',
   INFLUX_URL: 'http://influxdb:8086',
   INFLUX_TOKEN: 'abcde',
   INFLUX_ORG: 'myorg',