Schemes

Prerequisites

1. Install Python 3.11
2. Install Node 18
3. Install Docker and Compose plugin
4. Install Google Cloud CLI and authenticate using ADCs:

   gcloud auth application-default login
5. Install Terraform 1.6

Configure the app

Find the secure note in the password manager called Schemes Secrets (Localhost) and copy the contents to .env.

The application can also be configured with the following environment variables:

Name	Value
FLASK_ENV	Application environment name (dev / test)
FLASK_SQLALCHEMY_DATABASE_URI	SQLAlchemy database URI
FLASK_SECRET_KEY	Flask session secret key
FLASK_BASIC_AUTH_USERNAME	HTTP Basic Auth username
FLASK_BASIC_AUTH_PASSWORD	HTTP Basic Auth password
FLASK_API_KEY	API key (unset to disable)
FLASK_GOVUK_CLIENT_ID	OIDC client id
FLASK_GOVUK_CLIENT_SECRET	OIDC client secret
FLASK_GOVUK_SERVER_METADATA_URL	OIDC discovery endpoint
FLASK_GOVUK_TOKEN_ENDPOINT	OIDC token endpoint
FLASK_GOVUK_PROFILE_URL	OIDC profile URL
FLASK_GOVUK_END_SESSION_ENDPOINT	OIDC end session endpoint

Running locally

1. Create a virtual environment:

   python3.11 -m venv --prompt . .venv

2. Activate the virtual environment:

   source .venv/bin/activate

3. Build the web assets:

   npm install && npm run build

4. Install the dependencies:

   pip install -e .[dev]

5. Run the server:

   flask --app schemes run

6. Open http://127.0.0.1:5000

Running locally using Docker

To run the server as a container using an in-memory SQLite database:

1. Build the web assets:

   npm install && npm run build

2. Build the Docker image:

   docker build -t schemes .

3. Run the Docker image:

   docker run --rm -it -p 5000:5000 --env-file ./.env schemes

4. Open http://127.0.0.1:5000

The server can also be run on a different port by specifying the PORT environment variable:

docker run --rm -it -e PORT=8000 -p 8000:8000 --env-file ./.env schemes

Running locally using Compose

To run the server as a container using a PostgreSQL database:

1. Build the web assets:

   npm install && npm run build

2. Run the services:

   docker compose up

3. Open http://127.0.0.1:5000

Running formatters and linters

1. Install the dependencies:

   pip install -e .[dev]

2. Run the formatters:

   make format

3. Run the linters:

   make lint

Running tests

1. Install the dependencies:

   pip install -e .[dev]

2. Install the browsers:

   playwright install chromium

3. Run the tests:

   make test

Provisioning infrastructure

Provision the Terraform backend

1. Change directory:

   cd cloud/tf-backend

2. Initialise Terraform:

   terraform init

3. Apply the changes:

   terraform apply

Provision the Docker repository

1. Change directory:

   cd cloud/docker-repository

2. Initialise Terraform:

   terraform init

3. Apply the changes:

   terraform apply

4. Obtain the Docker repository service account private key:

   terraform output -raw github_action_private_key

5. Set the GitHub Actions repository secret GCP_CREDENTIALS_CI to the private key

Provision the application

For each environment required (dev, test, prod):

1. Change directory:

   cd cloud/schemes

2. Initialise Terraform:

   terraform init

3. Create a Terraform workspace for the environment:

   terraform workspace new $ENVIRONMENT

4. Apply the changes:

   terraform apply

5. This will fail due to missing secrets. Find the secure note in the password manager called Schemes Secrets ($ENVIRONMENT) and execute the script. Then repeat the previous step.

6. Obtain the Cloud Run service account private key:

   terraform output -raw github_action_private_key

7. Set the GitHub Actions repository secret GCP_CREDENTIALS_DEPLOY_$ENVIRONMENT to the private key

8. Open the output url

Authentication

We have registered the following two services with GOV.UK One Login:

Dev

• Service name: ATE Schemes (Dev)
• Service redirect URLs: https://schemes-ijnazoz5mq-ew.a.run.app/auth, http://127.0.0.1:5000/auth
• Service contact email address: mark.hobson@activetravelengland.gov.uk
• Scopes: openid email
• Public key: (see "Schemes GOV.UK One Login Public Key (Dev)" in Bitwarden)
• Logout URL: https://schemes-ijnazoz5mq-ew.a.run.app/, http://127.0.0.1:5000/
• Sector identifier URI: https://schemes-ijnazoz5mq-ew.a.run.app/

Test

• Service name: ATE Schemes (Test)
• Service redirect URLs: https://schemes-dcmtqc7uca-ew.a.run.app/auth
• Service contact email address: mark.hobson@activetravelengland.gov.uk
• Scopes: openid email
• Public key: (see "Schemes GOV.UK One Login Public Key (Test)" in Bitwarden)
• Logout URL: https://schemes-dcmtqc7uca-ew.a.run.app/
• Sector identifier URI: https://schemes-dcmtqc7uca-ew.a.run.app/