token

.deploy/deploy-dev.yaml

@@ -9,6 +9,7 @@ services:
     environment:
       MONGO_HOST: "mongo.develop.sprinthub.ru"
       MONGO_PASSWORD: $MONGO_PASSWORD_DEV
+      QUEUES_TOKEN: $QUEUES_TOKEN_DEV
     deploy:
       mode: replicated
       restart_policy:

.deploy/deploy-prod.yaml

@@ -9,6 +9,7 @@ services:
     environment:
       MONGO_HOST: "mongo.sprinthub.ru"
       MONGO_PASSWORD: $MONGO_PASSWORD_PROD
+      QUEUES_TOKEN: $QUEUES_TOKEN_PROD
     deploy:
       mode: replicated
       restart_policy:

.gitea/workflows/deploy-dev.yaml

@@ -40,4 +40,5 @@ jobs:
       - name: deploy
         env:
           MONGO_PASSWORD_DEV: ${{ secrets.MONGO_PASSWORD_DEV }}
+          QUEUES_TOKEN_DEV: ${{ secrets.QUEUES_TOKEN_DEV }}
         run: docker stack deploy --with-registry-auth -c ./.deploy/deploy-dev.yaml infra

.gitea/workflows/deploy-prod.yaml

@@ -40,4 +40,5 @@ jobs:
       - name: deploy
         env:
           MONGO_PASSWORD_PROD: ${{ secrets.MONGO_PASSWORD_PROD }}
+          QUEUES_TOKEN_PROD: ${{ secrets.QUEUES_TOKEN_PROD }}
         run: docker stack deploy --with-registry-auth -c ./.deploy/deploy-prod.yaml infra

app/middlewares/check_token.py

@@ -0,0 +1,13 @@
+import fastapi
+import os
+
+
+QUEUES_TOKEN = os.getenv('QUEUES_TOKEN')
+
+class CheckToken:
+    async def __call__(self, request: fastapi.Request, call_next):
+        if QUEUES_TOKEN:
+            token = request.headers.get('X-Queues-Token')
+            if not token or token != QUEUES_TOKEN:
+                raise fastapi.HTTPException(403)
+        return await call_next(request)

main.py

@@ -1,15 +1,19 @@
 import fastapi
 import uvicorn
 
-from app.storage import mongo
+from app.middlewares import check_token
 
 from app.routers import take
 from app.routers import put
 from app.routers import finish
 
+from app.storage import mongo
+
 
 app = fastapi.FastAPI()
 
+app.add_middleware(check_token.CheckToken)
+
 app.include_router(take.router)
 app.include_router(put.router)
 app.include_router(finish.router)