fix(transaction): add RABBITMQ_TLS env var for Amazon MQ connections#1958
Merged
ClaraTersi merged 1 commit intodevelopfrom Mar 22, 2026
Merged
fix(transaction): add RABBITMQ_TLS env var for Amazon MQ connections#1958ClaraTersi merged 1 commit intodevelopfrom
ClaraTersi merged 1 commit intodevelopfrom
Conversation
Amazon MQ requires TLS (amqps:// on port 5671). The multi-tenant RabbitMQ manager was connecting without TLS because WithTLS() was not being passed. Add RABBITMQ_TLS env var to enable TLS globally for tenant vhost connections. X-Lerian-Ref: 0x1
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (300)
WalkthroughThis pull request introduces multi-tenant support across the CRM, Ledger, and Onboarding components; upgrades lib-commons from v2 to v4; restructures git hooks and GitHub Actions workflows to use reusable shared workflows; changes the repository license from Apache 2.0 to Elastic License 2.0; adds ledger settings and balance history endpoints; and updates API schemas, container configurations, and dependency management. It includes new MongoDB tenant context resolution, circuit breaker configurations for tenant operations, and simplified CI/CD through external shared workflow references. Sequence Diagram(s)sequenceDiagram
participant Client
participant Middleware as Tenant Middleware
participant TenantMgr as Tenant Manager
participant MongoMgr as Mongo Manager
participant Database as MongoDB
participant Handler as HTTP Handler
participant Service as Service Logic
Client->>Middleware: HTTP Request<br/>(with X-Tenant-ID)
Middleware->>TenantMgr: Resolve Tenant Config
TenantMgr->>MongoMgr: Get Tenant-specific DB
MongoMgr->>Database: Connect to Tenant DB
Database-->>MongoMgr: Tenant DB Instance
MongoMgr-->>Middleware: Tenant Context Set
Middleware->>Handler: Pass Request + Context
Handler->>Service: Execute with Tenant Context
Service->>Database: Query Tenant Data
Database-->>Service: Tenant-scoped Results
Service-->>Handler: Response
Handler-->>Client: HTTP 200 + Data
Suggested reviewers
|
lerian-studio
previously requested changes
Mar 22, 2026
Contributor
lerian-studio
left a comment
lerian-studio
left a comment
There was a problem hiding this comment.
Pull requests to main can only come from:
developrelease-candidatehotfix/*
Your source branch: fix/rabbitmq-tls-amazon-mq
Please change the base branch or create a PR from an allowed branch.
Contributor
|
This PR is very large (878 files, 108454 lines changed). Consider breaking it into smaller PRs for easier review. |
gandalf-at-lerian
approved these changes
Mar 22, 2026
gandalf-at-lerian
left a comment
gandalf-at-lerian
left a comment
There was a problem hiding this comment.
Clean fix for Amazon MQ TLS requirement. The env var gives control over TLS without hardcoding assumptions about the broker.
Pattern follows the same approach used in PostgreSQL and MongoDB managers — conditional option based on config. LGTM.
ClaraTersi
approved these changes
Mar 22, 2026
gandalf-at-lerian
approved these changes
Mar 22, 2026
gandalf-at-lerian
left a comment
gandalf-at-lerian
left a comment
There was a problem hiding this comment.
Clean fix for Amazon MQ TLS requirement. The env var gives control over TLS without hardcoding assumptions about the broker.
Pattern follows the same approach used in PostgreSQL and MongoDB managers — conditional option based on config. LGTM.
Contributor
📊 Unit Test Coverage Report:
|
| Metric | Value |
|---|---|
| Overall Coverage | 87.1% ✅ PASS |
| Threshold | 85% |
Coverage by Package
| Package | Coverage |
|---|---|
github.com/LerianStudio/midaz/v3/components/ledger/internal/adapters/http/in |
86.8% |
Generated by Go PR Analysis workflow
Contributor
📊 Unit Test Coverage Report:
|
| Metric | Value |
|---|---|
| Overall Coverage | 85.2% ✅ PASS |
| Threshold | 85% |
Coverage by Package
| Package | Coverage |
|---|---|
github.com/LerianStudio/midaz/v3/components/transaction/internal/adapters/grpc/in |
100.0% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/adapters/http/in |
78.5% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/adapters/mongodb |
66.7% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/adapters/postgres/assetrate |
100.0% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/adapters/postgres/balance |
100.0% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/adapters/postgres/operation |
90.0% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/adapters/postgres/operationroute |
100.0% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/adapters/postgres/transaction |
97.4% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/adapters/postgres/transactionroute |
100.0% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/adapters/rabbitmq |
93.1% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/adapters/redis/balance |
100.0% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/services/command |
90.4% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/services/query |
95.2% |
github.com/LerianStudio/midaz/v3/components/transaction/internal/services |
100.0% |
Generated by Go PR Analysis workflow
Contributor
📊 Unit Test Coverage Report:
|
| Metric | Value |
|---|---|
| Overall Coverage | 87.7% ✅ PASS |
| Threshold | 85% |
Coverage by Package
| Package | Coverage |
|---|---|
github.com/LerianStudio/midaz/v3/components/crm/internal/adapters/http/in |
86.2% |
github.com/LerianStudio/midaz/v3/components/crm/internal/adapters/mongodb/alias |
92.1% |
github.com/LerianStudio/midaz/v3/components/crm/internal/adapters/mongodb/holder |
87.1% |
github.com/LerianStudio/midaz/v3/components/crm/internal/services |
95.2% |
Generated by Go PR Analysis workflow
Contributor
🔒 Security Scan Results —
|
| Policy | Status |
|---|---|
| Default non-root user | ✅ Passed |
| No fixable critical/high CVEs | ✅ Passed |
| No high-profile vulnerabilities | ✅ Passed |
| No AGPL v3 licenses | ✅ Passed |
Contributor
📊 Unit Test Coverage Report:
|
| Metric | Value |
|---|---|
| Overall Coverage | 87.5% ✅ PASS |
| Threshold | 85% |
Coverage by Package
| Package | Coverage |
|---|---|
github.com/LerianStudio/midaz/v3/components/onboarding/internal/adapters/grpc/out |
11.1% |
github.com/LerianStudio/midaz/v3/components/onboarding/internal/adapters/http/in |
95.0% |
github.com/LerianStudio/midaz/v3/components/onboarding/internal/adapters/mongodb |
66.7% |
github.com/LerianStudio/midaz/v3/components/onboarding/internal/adapters/postgres/account |
100.0% |
github.com/LerianStudio/midaz/v3/components/onboarding/internal/adapters/postgres/accounttype |
66.7% |
github.com/LerianStudio/midaz/v3/components/onboarding/internal/adapters/postgres/asset |
100.0% |
github.com/LerianStudio/midaz/v3/components/onboarding/internal/adapters/postgres/ledger |
100.0% |
github.com/LerianStudio/midaz/v3/components/onboarding/internal/adapters/postgres/organization |
100.0% |
github.com/LerianStudio/midaz/v3/components/onboarding/internal/adapters/postgres/portfolio |
100.0% |
github.com/LerianStudio/midaz/v3/components/onboarding/internal/adapters/postgres/segment |
100.0% |
github.com/LerianStudio/midaz/v3/components/onboarding/internal/services/command |
88.6% |
github.com/LerianStudio/midaz/v3/components/onboarding/internal/services/query |
90.9% |
github.com/LerianStudio/midaz/v3/components/onboarding/internal/services |
0.0% |
Generated by Go PR Analysis workflow
gandalf-at-lerian
approved these changes
Mar 22, 2026
gandalf-at-lerian
left a comment
gandalf-at-lerian
left a comment
There was a problem hiding this comment.
Clean fix for Amazon MQ TLS requirement. The env var gives control over TLS without hardcoding assumptions about the broker.
Pattern follows the same approach used in PostgreSQL and MongoDB managers. LGTM.
Contributor
🔒 Security Scan Results —
|
| Policy | Status |
|---|---|
| Default non-root user | ✅ Passed |
| No fixable critical/high CVEs | ✅ Passed |
| No high-profile vulnerabilities | ✅ Passed |
| No AGPL v3 licenses | ✅ Passed |
Merged
Contributor
🔒 Security Scan Results —
|
| Policy | Status |
|---|---|
| Default non-root user | ✅ Passed |
| No fixable critical/high CVEs | ✅ Passed |
| No high-profile vulnerabilities | ✅ Passed |
| No AGPL v3 licenses | ✅ Passed |
Contributor
🔒 Security Scan Results —
|
| Policy | Status |
|---|---|
| Default non-root user | ✅ Passed |
| No fixable critical/high CVEs | ✅ Passed |
| No high-profile vulnerabilities | ✅ Passed |
| No AGPL v3 licenses | ✅ Passed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RABBITMQ_TLSenv var (bool) to enable TLS for multi-tenant RabbitMQ connectionstrue, passestmrabbitmq.WithTLS()to the manager, usingamqps://scheme instead ofamqp://Root Cause
Amazon MQ (managed RabbitMQ) requires TLS on port 5671. The
tmrabbitmq.Managerwas created withoutWithTLS(), so it connected via plaintextamqp://— which Amazon MQ rejects.Log evidence:
Changes
components/transaction/internal/bootstrap/config.goRabbitMQTLS boolfield withenv:"RABBITMQ_TLS"components/transaction/internal/bootstrap/config.rabbitmq.goWithTLS()whencfg.RabbitMQTLSis trueUsage
RABBITMQ_TLS=true # Enable for Amazon MQ / any TLS-enabled brokerTest plan
RABBITMQ_TLS=truetls=trueon connection🤖 Generated with Claude Code