Merge pull request #6421 from hotosm/fix/ohsome-envvar-infra

Fix/ohsome envvar infra

Author: ramyaragupathy

.github/pull_request_template.md

@@ -36,5 +36,6 @@ Notes for the reviewer. How to test this change?
 - ✅ Provide tests for your changes.
 - 📝 Use descriptive commit messages.
 - 📗 Update any related documentation and include any relevant screenshots.
+- 🔠 Does this PR introduce or change any environment variables? If so, make sure to specify this change in the description. 
 
 ## [optional] What gif best describes this PR or how it makes you feel?

docs/sysadmins/ci-cd.md

@@ -10,7 +10,7 @@ We use CircleCI to manage Continuous Integration and Continuous Deployment.
 | TeachOSM            | deployment/teachosm-tasking-manager     |
 | Indonesia           | deployment/id-tasking-manager           |
 
-Each environment has its own set of environment variables which are stored as secrets in the CircleCI Organization Settings under Contexts.
+Each environment has its own set of environment variables which are stored as secrets in the CircleCI Organization Settings under Contexts. At the moment, these variables are for the frontend builds only. See the [deployment docs](deployment.md) for updating backend variables. 
 
 - OPSGENIE_API
 - TM_APP_API_URL

docs/sysadmins/deployment.md

@@ -36,7 +36,7 @@ aws s3 sync build/ <TaskingManagerReactBucket> --delete
 When deploying updates to the infrastructure or code, follow the steps below.
 
 #### Backup Database
-Before updating it's always recommended to backup the database. You can make a snapshot in AWS RDS console, or run the database dump directly. Make sure you have set your security group to allow access to the database on your local machine.
+Before updating it's always recommended to backup the database. You can make a snapshot in AWS RDS console, or run the database dump directly. You will need sufficient access to a server on the same VPC as the RDS instance in order to connect to it directly. 
 
 ```
 PGPASSWORD=<PostgresPassword> pg_dump -Fc \
@@ -48,7 +48,7 @@ PGPASSWORD=<PostgresPassword> pg_dump -Fc \
 
 #### Update backend infrastructure
 
-If the deployment contains any changes to the cloudformation template, then we must update the infrastructure prior to deployment. These changes are deliberately outside the CI/CD process to prevent accidental deletion of data.
+If the deployment contains any changes to the cloudformation template, including new or changes to environment variables, then we must update the infrastructure prior to deployment. These changes are deliberately set outside the CI/CD process to prevent accidental deletion of data. For the HOT Tasking Manager, only staff with sufficient AWS privileges have the ability to perform these functions. 
 
 1. Pull the latest changes locally
 2. Run the `cfn-config update` command, keeping in mind to update any new parameters that were added.

scripts/aws/cloudformation/tasking-manager.template.js

@@ -187,6 +187,10 @@ const Parameters = {
   TaskingManagerLogo: {
     Description: "URL for logo",
     Type: "String"
+  },
+  OhsomeStatsToken: {
+    Description: "Ohsome Stats Token (must be same as frontend)",
+    Type: "String"
   }
 };
 
@@ -474,6 +478,7 @@ const Resources = {
           'echo "------------------------------------------------------------"',
           cf.sub('export NEW_RELIC_LICENSE_KEY="${NewRelicLicense}"'),
           cf.sub('export TM_SENTRY_BACKEND_DSN="${SentryBackendDSN}"'),
+          cf.sub('export OHSOME_STATS_TOKEN="${OhsomeStatsToken}"'),
           'export NEW_RELIC_ENVIRONMENT=$TM_ENVIRONMENT',
           cf.sub('NEW_RELIC_CONFIG_FILE=./scripts/aws/cloudformation/newrelic.ini newrelic-admin run-program gunicorn -b 0.0.0.0:8000 --worker-class gevent --workers 5 --timeout 179 --access-logfile ${TaskingManagerLogDirectory}/gunicorn-access.log --access-logformat \'%(h)s %(l)s %(u)s %(t)s \"%(r)s\" %(s)s %(b)s %(T)s \"%(f)s\" \"%(a)s\"\' manage:application &'),
           cf.sub('sudo /usr/local/bin/cfn-init -v --stack ${AWS::StackName} --resource TaskingManagerLaunchTemplate --region ${AWS::Region} --configsets default'),