From 287fd46db034419efd43ffbe2fb913ef2a351e3a Mon Sep 17 00:00:00 2001
From: Rui Lopes <rgl@ruilopes.com>
Date: Wed, 1 May 2024 19:10:51 +0100
Subject: [PATCH] init

---
 .github/workflows/build.yml |  30 ++++++
 .gitignore                  |   1 +
 .vscode/settings.json       |   8 ++
 Dockerfile                  |  43 ++++++++
 README.md                   |   9 ++
 build.sh                    |   8 ++
 go.mod                      |  35 +++++++
 go.sum                      |  78 +++++++++++++++
 main.go                     | 189 ++++++++++++++++++++++++++++++++++++
 release.sh                  |  24 +++++
 10 files changed, 425 insertions(+)
 create mode 100644 .github/workflows/build.yml
 create mode 100644 .gitignore
 create mode 100644 .vscode/settings.json
 create mode 100644 Dockerfile
 create mode 100644 README.md
 create mode 100755 build.sh
 create mode 100644 go.mod
 create mode 100644 go.sum
 create mode 100644 main.go
 create mode 100755 release.sh

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..9321467
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,30 @@
+name: build
+on:
+  - push
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Build
+        run: ./build.sh
+  release:
+    if: startsWith(github.ref, 'refs/tags/v')
+    name: Release
+    needs: build
+    runs-on: ubuntu-22.04
+    permissions:
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Release
+        run: ./release.sh
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..c052c68
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+aws-docdb-example
diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 0000000..35f2286
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,8 @@
+{
+    "cSpell.words": [
+        "bson",
+        "DOCDB",
+        "terramate",
+        "Upsert"
+    ]
+}
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..12eeedf
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,43 @@
+# syntax=docker.io/docker/dockerfile:1.7
+FROM golang:1.22-bookworm as builder
+WORKDIR /app
+COPY go.* ./
+RUN go mod download
+COPY *.go .
+ARG APP_VERSION='0.0.0-dev'
+ARG APP_REVISION='0000000000000000000000000000000000000000'
+RUN CGO_ENABLED=0 go build -ldflags="-s -X main.version=${APP_VERSION} -X main.revision=${APP_REVISION}"
+
+# NB we use the bookworm-slim (instead of scratch) image so we can enter the container to execute bash etc.
+FROM debian:bookworm-slim
+RUN <<EOF
+#!/bin/bash
+set -euxo pipefail
+apt-get update
+apt-get install -y --no-install-recommends \
+    wget \
+    openssl \
+    iproute2 \
+    bind9-dnsutils \
+    ca-certificates
+rm -rf /var/lib/apt/lists/*
+EOF
+WORKDIR /
+# see https://docs.aws.amazon.com/documentdb/latest/developerguide/connect_programmatically.html#connect_programmatically-tls_enabled
+ADD --chmod=444 https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem .
+COPY --from=builder /app/aws-docdb-example .
+EXPOSE 8000
+# NB 65534:65534 is the uid:gid of the nobody:nogroup user:group.
+# NB we use a numeric uid:gid to easy the use in kubernetes securityContext.
+#    k8s will only be able to infer the runAsUser and runAsGroup values when
+#    the USER intruction has a numeric uid:gid. otherwise it will fail with:
+#       kubelet Error: container has runAsNonRoot and image has non-numeric
+#       user (nobody), cannot verify user is non-root
+USER 65534:65534
+ENTRYPOINT ["/aws-docdb-example"]
+ARG APP_SOURCE_URL
+ARG APP_REVISION
+LABEL org.opencontainers.image.source="$APP_SOURCE_URL"
+LABEL org.opencontainers.image.revision="$APP_REVISION"
+LABEL org.opencontainers.image.description="AWS DocumentDB example application using Go"
+LABEL org.opencontainers.image.licenses="MIT"
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..340f0ac
--- /dev/null
+++ b/README.md
@@ -0,0 +1,9 @@
+# About
+
+[![Build](https://github.com/rgl/aws-docdb-example/actions/workflows/build.yml/badge.svg)](https://github.com/rgl/aws-docdb-example/actions/workflows/build.yml)
+
+AWS DocumentDB example Go application.
+
+This is used in:
+
+* [rgl/terramate-aws-eks-example](https://github.com/rgl/terramate-aws-eks-example)
diff --git a/build.sh b/build.sh
new file mode 100755
index 0000000..fdd1aef
--- /dev/null
+++ b/build.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+set -euxo pipefail
+
+APP_REVISION="${GITHUB_SHA:-0000000000000000000000000000000000000000}"
+
+docker build \
+    --build-arg "APP_REVISION=$APP_REVISION" \
+    .
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..d0acc1b
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,35 @@
+module aws-docdb-example
+
+go 1.22.2
+
+require (
+	github.com/aws/aws-sdk-go-v2/config v1.27.11
+	github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.28.6
+	go.mongodb.org/mongo-driver v1.15.0
+)
+
+require (
+	github.com/aws/aws-sdk-go-v2 v1.26.1 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.11 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.20.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.28.6 // indirect
+	github.com/aws/smithy-go v1.20.2 // indirect
+	github.com/golang/snappy v0.0.1 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/klauspost/compress v1.13.6 // indirect
+	github.com/montanaflynn/stats v0.7.0 // indirect
+	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
+	github.com/xdg-go/scram v1.1.2 // indirect
+	github.com/xdg-go/stringprep v1.0.4 // indirect
+	github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d // indirect
+	golang.org/x/crypto v0.22.0 // indirect
+	golang.org/x/sync v0.1.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+)
diff --git a/go.sum b/go.sum
new file mode 100644
index 0000000..f89f73a
--- /dev/null
+++ b/go.sum
@@ -0,0 +1,78 @@
+github.com/aws/aws-sdk-go-v2 v1.26.1 h1:5554eUqIYVWpU0YmeeYZ0wU64H2VLBs8TlhRB2L+EkA=
+github.com/aws/aws-sdk-go-v2 v1.26.1/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
+github.com/aws/aws-sdk-go-v2/config v1.27.11 h1:f47rANd2LQEYHda2ddSCKYId18/8BhSRM4BULGmfgNA=
+github.com/aws/aws-sdk-go-v2/config v1.27.11/go.mod h1:SMsV78RIOYdve1vf36z8LmnszlRWkwMQtomCAI0/mIE=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.11 h1:YuIB1dJNf1Re822rriUOTxopaHHvIq0l/pX3fwO+Tzs=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.11/go.mod h1:AQtFPsDH9bI2O+71anW6EKL+NcD7LG3dpKGMV4SShgo=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 h1:FVJ0r5XTHSmIHJV6KuDmdYhEpvlHpiSd38RQWhut5J4=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1/go.mod h1:zusuAeqezXzAB24LGuzuekqMAEgWkVYukBec3kr3jUg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 h1:aw39xVGeRWlWx9EzGVnhOR4yOjQDHPQ6o6NmBlscyQg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5/go.mod h1:FSaRudD0dXiMPK2UjknVwwTYyZMRsHv3TtkabsZih5I=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 h1:PG1F3OD1szkuQPzDw3CIQsRIrtTlUC3lP84taWzHlq0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5/go.mod h1:jU1li6RFryMz+so64PpKtudI+QzbKoIEivqdf6LNpOc=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 h1:Ji0DY1xUsUr3I8cHps0G+XM3WWU16lP6yG8qu1GAZAs=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2/go.mod h1:5CsjAbs3NlGQyZNFACh+zztPDI7fU6eW9QsxjfnuBKg=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 h1:ogRAwT1/gxJBcSWDMZlgyFUM962F51A5CRhDLbxLdmo=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7/go.mod h1:YCsIZhXfRPLFFCl5xxY+1T9RKzOKjCut+28JSX2DnAk=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.28.6 h1:TIOEjw0i2yyhmhRry3Oeu9YtiiHWISZ6j/irS1W3gX4=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.28.6/go.mod h1:3Ba++UwWd154xtP4FRX5pUK3Gt4up5sDHCve6kVfE+g=
+github.com/aws/aws-sdk-go-v2/service/sso v1.20.5 h1:vN8hEbpRnL7+Hopy9dzmRle1xmDc7o8tmY0klsr175w=
+github.com/aws/aws-sdk-go-v2/service/sso v1.20.5/go.mod h1:qGzynb/msuZIE8I75DVRCUXw3o3ZyBmUvMwQ2t/BrGM=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4 h1:Jux+gDDyi1Lruk+KHF91tK2KCuY61kzoCpvtvJJBtOE=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4/go.mod h1:mUYPBhaF2lGiukDEjJX2BLRRKTmoUSitGDUgM4tRxak=
+github.com/aws/aws-sdk-go-v2/service/sts v1.28.6 h1:cwIxeBttqPN3qkaAjcEcsh8NYr8n2HZPkcKgPAi1phU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.28.6/go.mod h1:FZf1/nKNEkHdGGJP/cI2MoIMquumuRK6ol3QQJNDxmw=
+github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
+github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/golang/snappy v0.0.1 h1:Qgr9rKW7uDUkrbSmQeiDsGa8SjGyCOGtuasMWwvp2P4=
+github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/klauspost/compress v1.13.6 h1:P76CopJELS0TiO2mebmnzgWaajssP/EszplttgQxcgc=
+github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
+github.com/montanaflynn/stats v0.7.0 h1:r3y12KyNxj/Sb/iOE46ws+3mS1+MZca1wlHQFPsY/JU=
+github.com/montanaflynn/stats v0.7.0/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
+github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
+github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
+github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
+github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
+github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d h1:splanxYIlg+5LfHAM6xpdFEAYOk8iySO56hMFq6uLyA=
+github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.mongodb.org/mongo-driver v1.15.0 h1:rJCKC8eEliewXjZGf0ddURtl7tTVy1TK3bfl0gkUSLc=
+go.mongodb.org/mongo-driver v1.15.0/go.mod h1:Vzb0Mk/pa7e6cWw85R4F/endUC3u0U9jGcNU603k65c=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
+golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/main.go b/main.go
new file mode 100644
index 0000000..341fdaf
--- /dev/null
+++ b/main.go
@@ -0,0 +1,189 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"log"
+	"log/slog"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
+	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/mongo"
+	"go.mongodb.org/mongo-driver/mongo/options"
+)
+
+var (
+	version  string = "0.0.0-dev"
+	revision string = "0000000000000000000000000000000000000000"
+)
+
+func logRequest(handler http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		slog.Info("begin handling request", "method", r.Method, "host", r.Host, "url", r.URL)
+		handler.ServeHTTP(w, r)
+		slog.Info("end handling request", "method", r.Method, "host", r.Host, "url", r.URL)
+	}
+}
+
+func main() {
+	logger := slog.New(slog.NewTextHandler(os.Stdout, nil))
+
+	slog.SetDefault(logger)
+
+	var showVersion = flag.Bool("version", false, "Show version and exit.")
+	var listenAddress = flag.String("listen", ":8000", "Listen address.")
+
+	flag.Parse()
+
+	if *showVersion {
+		fmt.Printf("v%s+%s\n", version, revision)
+		return
+	}
+
+	if flag.NArg() != 0 {
+		flag.Usage()
+		log.Fatalf("\nERROR You MUST NOT pass any positional arguments")
+	}
+
+	http.HandleFunc("/health/ready", func(w http.ResponseWriter, r *http.Request) {
+	})
+
+	http.HandleFunc("/", logRequest(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/" {
+			http.Error(w, "Not Found", http.StatusNotFound)
+			return
+		}
+
+		ctx := r.Context()
+
+		ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+		defer cancel()
+
+		client, err := connectToMongoDB(ctx)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		database := client.Database("counters")   // NB this also creates the database if it does not exist.
+		collection := database.Collection("hits") // NB this also creates the collection if it does not exist.
+
+		hitsCounter, err := incrementCounter(ctx, collection)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		data := map[string]interface{}{
+			"appVersion":  fmt.Sprintf("%s+%s", version, revision),
+			"hitsCounter": hitsCounter,
+		}
+		body, err := json.Marshal(data)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		w.Write(body)
+	}))
+
+	slog.Info("listening", "addr", fmt.Sprintf("http://%s", *listenAddress))
+
+	err := http.ListenAndServe(*listenAddress, nil)
+	if err != nil {
+		log.Fatalf("Failed to ListenAndServe: %v", err)
+	}
+}
+
+// see Connecting Programmatically to Amazon DocumentDB at https://docs.aws.amazon.com/documentdb/latest/developerguide/connect_programmatically.html#connect_programmatically-tls_enabled
+func connectToMongoDB(ctx context.Context) (*mongo.Client, error) {
+	connectionString := ""
+
+	connectionStringSecretID := os.Getenv("DOCDB_EXAMPLE_CONNECTION_STRING_SECRET_ID")
+	if connectionStringSecretID != "" {
+		connectionStringSecretRegion := os.Getenv("DOCDB_EXAMPLE_CONNECTION_STRING_SECRET_REGION")
+		if connectionStringSecretRegion == "" {
+			return nil, fmt.Errorf("the DOCDB_EXAMPLE_CONNECTION_STRING_SECRET_REGION environment variable is not set")
+		}
+
+		cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(connectionStringSecretRegion))
+		if err != nil {
+			return nil, fmt.Errorf("failed to load default config: %w", err)
+		}
+		client := secretsmanager.NewFromConfig(cfg)
+		secret, err := client.GetSecretValue(ctx, &secretsmanager.GetSecretValueInput{
+			SecretId: &connectionStringSecretID,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to get secret value: %w", err)
+		}
+		connectionString = *secret.SecretString
+	}
+
+	if connectionString == "" {
+		connectionString = os.Getenv("DOCDB_EXAMPLE_CONNECTION_STRING")
+	}
+
+	if connectionString == "" {
+		return nil, fmt.Errorf("the DOCDB_EXAMPLE_CONNECTION_STRING_SECRET_ID or DOCDB_EXAMPLE_CONNECTION_STRING environment variable is not set")
+	}
+
+	client, err := mongo.Connect(ctx, options.Client().ApplyURI(connectionString))
+	if err != nil {
+		return nil, fmt.Errorf("failed to connect: %w", err)
+	}
+
+	err = client.Ping(ctx, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to ping: %w", err)
+	}
+
+	// log the existing databases and their collections.
+	databaseNames, err := client.ListDatabaseNames(ctx, bson.M{})
+	if err != nil {
+		return nil, fmt.Errorf("failed to list databases: %w", err)
+	}
+	for _, databaseName := range databaseNames {
+		log.Printf("mongo database: %s", databaseName)
+	}
+	for _, databaseName := range databaseNames {
+		database := client.Database(databaseName)
+		collectionNames, err := database.ListCollectionNames(ctx, bson.M{})
+		if err != nil {
+			return nil, fmt.Errorf("failed to list database %s collections: %w", databaseName, err)
+		}
+		for _, collectionName := range collectionNames {
+			log.Printf("mongo database %s collection: %s", databaseName, collectionName)
+		}
+	}
+
+	return client, nil
+}
+
+func incrementCounter(ctx context.Context, collection *mongo.Collection) (int, error) {
+	filter := bson.M{"_id": "counter"}
+	update := bson.M{"$inc": bson.M{"value": 1}}
+	result := collection.FindOneAndUpdate(
+		ctx,
+		filter,
+		update,
+		options.FindOneAndUpdate().SetUpsert(true).SetReturnDocument(options.After))
+	if result.Err() != nil {
+		return 0, fmt.Errorf("failed to increment counter: %w", result.Err())
+	}
+	var counter struct {
+		Value int `bson:"value"`
+	}
+	err := result.Decode(&counter)
+	if err != nil {
+		return 0, fmt.Errorf("failed to decode increment counter response: %w", result.Err())
+	}
+	return counter.Value, nil
+}
diff --git a/release.sh b/release.sh
new file mode 100755
index 0000000..099fc7f
--- /dev/null
+++ b/release.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+set -euxo pipefail
+
+APP_SOURCE_URL="https://github.com/$GITHUB_REPOSITORY"
+
+if [[ "$GITHUB_REF" =~ \/v([0-9]+(\.[0-9]+)+(-.+)?) ]]; then
+    APP_VERSION="${BASH_REMATCH[1]}"
+else
+    echo "ERROR: Unable to extract semver version from GITHUB_REF."
+    exit 1
+fi
+
+APP_REVISION="$GITHUB_SHA"
+
+IMAGE="ghcr.io/$GITHUB_REPOSITORY:$APP_VERSION"
+
+docker build \
+    --build-arg "APP_SOURCE_URL=$APP_SOURCE_URL" \
+    --build-arg "APP_VERSION=$APP_VERSION" \
+    --build-arg "APP_REVISION=$APP_REVISION" \
+    -t "$IMAGE" \
+    .
+
+docker push "$IMAGE"