Integrate service mesh and API gateway

echo -e "${_COL}Clean previous configurations.${_NC}"

# Remove route for NGINX
consul config delete -kind http-route -name hashicups-http-route

# Remove Inline certificate
consul config delete -kind inline-certificate -name api-gw-certicate

# Remove API Gateway Listener
consul config delete -kind api-gateway -name api-gateway

# Remove all existing binding rules
# WARNING: if you have existing binding rules you want to maintain, modify this behavior
for i in `consul acl binding-rule list -format json | jq -r .[].ID`; do
  consul acl binding-rule delete -id=$i
done

# Delete Nomad namespace
nomad namespace delete ingress

# Delete Consul auth-method
consul acl auth-method delete -name nomad-workloads

if [ "$1 " == "-clean " ]; then

  echo -e "${_ERR}Only cleaning selected...Exiting.${_NC}"
  exit 0
  
fi
# ...

# ...
tee ${_JWT_FILE} > /dev/null << EOF
{
  # ...
}
EOF
# This auth method creates an endpoint for generating Consul ACL tokens 
#  from Nomad workload identities.
consul acl auth-method create \
            -name 'nomad-workloads' \
            -type 'jwt' \
            -description 'JWT auth-method for Nomad services and workloads' \
            -config "@${_JWT_FILE}"
# ...
# The 'ingress' namespace will be used to deploy the API Gateway and to identify
#   Nomad Jobs that require a token to be generated automatically.

nomad namespace apply \
    -description "namespace for Consul API Gateways" \
    ingress

# The binding-rule identifies all Nomad Jobs in the 'ingress' namespaces and 
#  uses the 'builtin/api-gateway' policy to generate a Consul ACL token for them.
# ...

tee ${_BR_FILE} > /dev/null << EOF
{
  # ...
}
EOF

curl --silent \
  --header "X-Consul-Token: $CONSUL_HTTP_TOKEN" \
  --connect-to ${CONSUL_TLS_SERVER_NAME}:8443:${_consul_addr} \
  --cacert ${CONSUL_CACERT} \
  --data @${_BR_FILE} \
  --request PUT \
  https://${CONSUL_TLS_SERVER_NAME}:8443/v1/acl/binding-rule | jq

# ...
# Generate TLS certificates
tee ${_ssl_conf_FILE} > /dev/null << EOF
# ...
EOF

openssl genrsa -out ${_ssl_key_file}  4096 2>/dev/null

openssl req -new \
  -key ${_ssl_key_file} \
  -out ${_ssl_csr_file} \
  -config ${_ssl_conf_FILE} 2>/dev/null

openssl x509 -req -days 3650 \
  -in ${_ssl_csr_file} \
  -signkey ${_ssl_key_file} \
  -out ${_ssl_crt_file} 2>/dev/null

export API_GW_KEY=`cat ${_ssl_key_file}`
export API_GW_CERT=`cat ${_ssl_crt_file}`

# Create 'api-gateway-certificate' inline-certificate"
tee ${_GW_certificate_FILE} > /dev/null << EOF
# ...
EOF

consul config write ${_GW_certificate_FILE}

# Create 'api-gateway' HTTP listener on port 8443
tee ${_GW_config_FILE} > /dev/null << EOF
# ...
EOF

consul config write ${_GW_config_FILE}

# Create 'hashicups-http-route' HTTP route "/" > "nginx"
tee ${_GW_route_FILE} > /dev/null << EOF
# ...
EOF

consul config write ${_GW_route_FILE}

## ...

##-------------------------------------------------------------------------------
## Clean previous configurations
##-------------------------------------------------------------------------------

echo -e "${_COL}Clean previous configurations.${_NC}"

consul config delete -kind service-intentions -name database
consul config delete -kind service-intentions -name product-api
consul config delete -kind service-intentions -name payments-api
consul config delete -kind service-intentions -name public-api
consul config delete -kind service-intentions -name frontend
consul config delete -kind service-intentions -name nginx

## ...

### ----------------------------------------------------------------------------
### Configure Consul Intentions
### ----------------------------------------------------------------------------

## References:
## - https://developer.hashicorp.com/consul/docs/connect/config-entries/service-intentions

echo -e "${_COL}Create Consul intentions for Hashicups and API Gateway${_NC}"

tee ${_int_DB_FILE} > /dev/null << EOF
Kind = "service-intentions"
Name = "database"
Sources = [
  {
    Name   = "product-api"
    Action = "allow"
  }
]
EOF

tee ${_int_PROD_API_FILE} > /dev/null << EOF
Kind = "service-intentions"
Name = "product-api"
Sources = [
  {
    Name   = "public-api"
    Action = "allow"
  }
]
EOF

tee ${_int_PAY_API_FILE} > /dev/null << EOF
Kind = "service-intentions"
Name = "payments-api"
Sources = [
  {
    Name   = "public-api"
    Action = "allow"
  }
]
EOF


tee ${_int_PUB_API_FILE} > /dev/null << EOF
Kind = "service-intentions"
Name = "public-api"
Sources = [
  {
    Name   = "nginx"
    Action = "allow"
  }
]
EOF

tee ${_int_FE_FILE} > /dev/null << EOF
Kind = "service-intentions"
Name = "frontend"
Sources = [
  {
    Name   = "nginx"
    Action = "allow"
  }
]
EOF

tee ${_int_NGINX_FILE} > /dev/null << EOF
Kind = "service-intentions"
Name = "nginx"
Sources = [
  {
    Name   = "api-gateway"
    Action = "allow"
  }
]
EOF

consul config write ${_int_DB_FILE}
consul config write ${_int_PROD_API_FILE}
consul config write ${_int_PAY_API_FILE}
consul config write ${_int_PUB_API_FILE}
consul config write ${_int_FE_FILE}
consul config write ${_int_NGINX_FILE}