feat(health-check): Next.js health checks

[connordoman]

Welcome to PrivacyPal! 👋

Fixes: #350
Depends on #22

Description of the change:

This change adds endpoints at /health and /heath/liveness for polling the status of the application and its dependencies.

Simple connect or list operations are used to assess the status of:

• The video processing server
• The database
• Access to S3

Motivation for the change:

This allows us to coordinate modules of the system and improve up time.

TODO

• Update health checks to poll Lambda

[tthvo]

@connordoman rebase first pls.

[tthvo]

Looks good so far. Some more comments to address. Tho, this is blocked until lambda is done.

[tthvo]

I might have overlooked the security risk that this endpoint poses. Without auth, any one can keep triggering connections to services.

This can be solved by auth proxy setup but an easier way would be skipping auth for request coming from localhost. How is this implemented on the nodejs/nextjs side @connordoman ?

Would extracting the header X-Forwarded-For a good option?

[github-actions]

This PR/issue depends on:

• [Task] S3/Lambda/Rekognition integration #22
  By Dependent Issues (🤖). Happy coding!

[MyStackOverflows]

I might have overlooked the security risk that this endpoint poses. Without auth, any one can keep triggering connections to services.

It's not fantastic to have direct access to these endpoints without auth, true, but realistically many services have non-authorized access to server health pages (discord for instance)

[tthvo]

It's not fantastic to have direct access to these endpoints without auth, true, but realistically many services have non-authorized access to server health pages (discord for instance)

Ahh i see. Thanks for the info. I suppose we can just move forward with non-auth, at least for simplicity for now.

[MyStackOverflows]

Good idea! Not sure what's the best practice out there. Though, our priority is to get health check ready so that could be another later work.

if rate limiting/securing this endpoint isn't part of the scope of this PR, is it ready to go?

[tthvo]

I am not sure it's ready tho.

• Image tags are not still 0.1.0-alpha.3, it should be 0.1.0-dev.
• S3 buckets still need checking for existence and permissions (GetBucket + Send a small blob to both buckets)
• Lambda needs checking if deployed (ListLambda)

[MyStackOverflows]

didn't add the upload blob functionality yet because it seems from this that if we get a response at all, we are verified to own that bucket @tthvo

[tthvo]

Hmm tho I think the application will be set to have limited scope to the S3 bucket. Only read/write bucket content. So not sure if that would work.

Our token locally has quite a broad scope. Can u check if there is anything like GetBucket?

Or perhaps just blindly write a blob to both buckets.

[MyStackOverflows]

Hmm tho I think the application will be set to have limited scope to the S3 bucket. Only read/write bucket content. So not sure if that would work.

why would the application have limited scope? doesn't it have access to our sso token?

[tthvo]

why would the application have limited scope? doesn't it have access to our sso token?

When deployed, the application will receive a JWT that it could exchange for a short-term credentials. This is a feature called IAM role for service account (IRSA) for EKS and ROSA. The role ARN is annotated on the Service Account. For best practice, it should have minimal permissions as possible.

I find this article very helpful: https://medium.com/@ankit.wal/the-how-of-iam-roles-for-service-accounts-irsa-on-aws-eks-3d76badb8942

[tthvo]

With that being said, a production app cannot use our SSO token. Thus, must reply on this IRSA or other methods. Whatever way, the scope should be minimal as suggested from AWS docs.

[tthvo]

There are currently couple scopes that I think needed:

• S3 read/write/delete content to tmp (input) and videos (output) bucket. Only those buckets. The owner should be one provisioning the app (not the app itself).
• Lambda get for health check.

I think that's pretty much it.

[MyStackOverflows]

fingers crossed I didn't goof the merge, link this comment in the future if it turns out I did

[tthvo]

Very nice!

HTTP/1.1 200 OK
Connection: keep-alive
Date: Tue, 30 Jan 2024 04:07:30 GMT
Keep-Alive: timeout=5
Transfer-Encoding: chunked
content-type: application/json
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Url

{
    "data": {
        "app_version": "0.1.0-dev",
        "database_available": true,
        "video_processor_available": true,
        "video_storage_available": true
    }
}