Dev live

.ebextensions/https-instance-securitygroup.config

@@ -0,0 +1,9 @@
+Resources:
+  sslSecurityGroupIngress:
+    Type: AWS::EC2::SecurityGroupIngress
+    Properties:
+      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
+      IpProtocol: tcp
+      ToPort: 443
+      FromPort: 443
+      CidrIp: 0.0.0.0/0

.ebignore

@@ -0,0 +1,83 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+env/
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.coverage
+.coverage.*
+.cache
+.setting*
+nosetests.xml
+coverage.xml
+*,cover
+.hypothesis/
+venv/
+.python-version
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+#Ipython Notebook
+.ipynb_checkpoints
+
+# Elastic Beanstalk Files
+# .elasticbeanstalk/*
+# !.elasticbeanstalk/*.cfg.yml
+# !.elasticbeanstalk/*.global.yml
+private.env
+
+# pycharm
+.idea
+
+.pytest_cache
+.vscode/
+
+tests
+db/seed
+.git
+
+frontend

.elasticbeanstalk/config.yml

@@ -1,10 +1,10 @@
 branch-defaults:
   prod-live:
-    environment: Phenopolis-prod
+    environment: phenopolis-production-live
   dev-live:
-    environment: Phenopolisapi-dev-env
+    environment: phenopolis-development-live
 environment-defaults:
-  Phenopolis-prod:
+  phenopolis-production-live:
     branch: null
     repository: null
 global:

.gitattributes

@@ -0,0 +1,4 @@
+# Set default behaviour to automatically normalize line endings.
+* text=auto
+
+views/__init__.py export-subst

.github/workflows/python-app.yml

@@ -1,36 +1,53 @@
 # This workflow will install Python dependencies, run tests and lint with a single version of Python
 # For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
+name: check_app_api
+on:
+   push:
+      branches:
+         - prod-live
+         - dev-live
+   pull_request:
+      branches:
+         - prod-live
+         - dev-live
+jobs:
+   build:
+      runs-on: ubuntu-latest
+      steps:
+         - uses: actions/checkout@v2
 
-name: Python application
+         - name: Set empty Private ENV mock up
+           run: touch private.env
 
-on:
-  push:
-    branches: [ prod-live ]
-  pull_request:
-    branches: [ prod-live ]
+         # https://github.com/marketplace/actions/docker-layer-caching
+         - run: docker-compose pull app db
 
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install flake8 pytest
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-    - name: Lint with flake8
-      run: |
-        # stop the build if there are Python syntax errors or undefined names
-        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
-        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
-    - name: Test with pytest
-      run: |
-        python -m pytest
+         - uses: satackey/[email protected]
+           # Ignore the failure of a step and avoid terminating the job.
+           continue-on-error: true
+
+         - name: Set up Python 3.8
+           uses: actions/setup-python@v2
+           with:
+              python-version: 3.8
+
+         - name: Build docker-compose stack
+           run: docker-compose build app
+
+         - name: Lint with flake8
+           run: docker-compose run app flake8 -v --count
+
+         - name: Check format with black
+           run: docker-compose run app black --diff --check .
+
+         - name: Test with PyTest for S3
+           env:
+              AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+              AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+           run: docker-compose run -e APP_ENV=prod -e VCF_FILE="s3://phenopolis-vcf/August2019/merged2.vcf.gz" -e AWS_SECRET_ACCESS_KEY -e AWS_ACCESS_KEY_ID app pytest --color=yes -k test_variants
+
+         - name: Test with PyTest
+           env:
+              AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+              AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+           run: docker-compose run -e APP_ENV=prod -e AWS_SECRET_ACCESS_KEY -e AWS_ACCESS_KEY_ID app pytest --color=yes

.gitignore

@@ -72,3 +72,9 @@ private.env
 
 # pycharm
 .idea
+
+.pytest_cache
+.vscode/
+
+dc_dev.yml
+/.mypy_cache/

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "nextflow-genome"]
+	path = nextflow-genome
+	url = https://github.com/phenopolis/nextflow-genome.git

.platform/hooks/postdeploy/01_install_ssl_certificates.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [ -f "/etc/pki/tls/certs/server-key.pem" ]; then
+  echo '/etc/pki/tls/certs/server-key.pem already exists'
+else
+  openssl req -x509 -sha256 -nodes -newkey rsa:4096 -days 365 \
+    -keyout /etc/pki/tls/certs/server-key.pem \
+    -out /etc/pki/tls/certs/server-cert.pem \
+    -subj "/C=GB/ST=London/L=London/O=Phenopolis/OU=Org/CN=api-dev.phenopolis.org"
+fi
+
+if [ -f "/etc/nginx/conf.d/webapp-ssl.conf" ]; then
+  echo '/etc/nginx/conf.d/webapp-ssl.conf already exists'
+else
+  mv /etc/nginx/conf.d/webapp-ssl.pre /etc/nginx/conf.d/webapp-ssl.conf
+fi
+
+echo "Restarting nginx"
+nginx -t
+nginx -s reload

.platform/hooks/prebuild/01_install_packages.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
 
-yum install -y libcurl-devel bzip2-devel xz-devel zlib-devel
+yum install -y libcurl-devel bzip2-devel xz-devel zlib-devel openssl-devel
 
 amazon-linux-extras enable postgresql11
 
 yum install -y postgresql
 
 "${PYTHONPATH}/pip3" install cython
-"${PYTHONPATH}/pip3" install pysam==0.15.3
+"${PYTHONPATH}/pip3" install cyvcf2==0.30.12

.platform/nginx/conf.d/webapp-ssl.pre

@@ -0,0 +1,25 @@
+server {
+  listen       443 ssl;
+  server_name _ localhost; # need to listen to localhost for worker tier
+
+  ssl_certificate      /etc/pki/tls/certs/server-cert.pem;
+  ssl_certificate_key  /etc/pki/tls/certs/server-key.pem;
+
+  ssl_session_timeout  5m;
+
+  ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
+  ssl_prefer_server_ciphers   on;
+
+  location / {
+    proxy_pass          http://127.0.0.1:8000;
+    proxy_http_version  1.1;
+
+    proxy_set_header    Connection          $connection_upgrade;
+    proxy_set_header    Upgrade             $http_upgrade;
+    proxy_set_header    Host                $host;
+    proxy_set_header    X-Real-IP           $remote_addr;
+    proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
+    gzip_static on;
+    gzip on;
+  }
+}

.pre-commit-config.yaml

@@ -0,0 +1,35 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.1.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-added-large-files
+      - id: debug-statements
+
+  - repo: local
+    hooks:
+      - id: flake8
+        name: flake8
+        entry: flake8
+        language: system
+        types: [python]
+        require_serial: true
+      - id: black
+        name: black
+        entry: black .
+        language: system
+        types: [python]
+        require_serial: true
+      - id: isort
+        name: isort
+        entry: isort
+        language: system
+        types: [python]
+        require_serial: true
+      - id: pyupgrade
+        name: pyupgrade
+        entry: pyupgrade --py36-plus
+        language: system
+        types: [python]
+        require_serial: true

Dockerfile

@@ -1,19 +1,11 @@
-FROM debian:buster-slim
+FROM amazonlinux:latest
 
 # set work directory
 WORKDIR /app
 
-# set environment variables, to avoid pyc files and flushing buffer
+# Avoid generating .pyc files
 ENV PYTHONDONTWRITEBYTECODE 1
-ENV PYTHONUNBUFFERED 1
 
 COPY ./requirements.txt /app/requirements.txt
-
-RUN apt-get update \
-    && apt-get install --no-install-recommends -y python3-pip=18.1-5 python3-pysam=0.15.2+ds-2 \
-    && pip3 --no-cache-dir install --upgrade pip \
-    && pip --no-cache-dir install setuptools==49.1.0 gunicorn==20.0.4 \
-    && pip --no-cache-dir install -r requirements.txt \
-    && pip uninstall pip -y && apt-get purge python3-pip -y \
-    && apt-get autoremove -y && apt-get autoclean -y && apt-get clean -y \
-    && rm -rf /var/lib/apt/lists/*
+COPY ./scripts/docker_app_packages.sh ./scripts/
+RUN ./scripts/docker_app_packages.sh

LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2017-2021 Nikolas Pontikos and others
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Procfile

@@ -1 +1 @@
-web: gunicorn --bind 127.0.0.1:8000 --workers=1 --threads=15 application:application
+web: gunicorn --bind 127.0.0.1:8000 --workers=1 --threads=15 application:application