How to Manage Secrets in a chi App

// hooks/hooks.go
package hooks

import (
	"bytes"
	"context"
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net/http"
	"strconv"
	"time"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"

	"encore.dev/storage/sqldb"
)

// Values are set per environment with `encore secret set` and are
// never stored in the repository.
var secrets struct {
	PaymentsWebhookSecret string // shared with the payment provider for signing webhooks
	EmailAPIKey           string // server-side key for the transactional email provider
}

var db = sqldb.NewDatabase("hooks", sqldb.DatabaseConfig{Migrations: "./migrations"})

//encore:service
type Service struct {
	router chi.Router
}

func initService() (*Service, error) {
	if len(secrets.PaymentsWebhookSecret) < 32 {
		return nil, errors.New("PaymentsWebhookSecret must be at least 32 bytes")
	}
	r := chi.NewRouter()
	r.Use(middleware.Recoverer)
	r.With(verifySignature).Post("/webhooks/payments", paymentEvent)
	return &Service{router: r}, nil
}

// Fallback sends every request that no Encore endpoint matches to chi.
//
//encore:api public raw path=/!fallback
func (s *Service) Fallback(w http.ResponseWriter, req *http.Request) {
	s.router.ServeHTTP(w, req)
}

const tolerance = 5 * time.Minute

// verifySignature checks an HMAC-SHA256 over "timestamp.body" and rejects
// requests older than five minutes. Event IDs in the handler then stop
// replays that still fall inside that window.
func verifySignature(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 1<<20))
		if err != nil {
			http.Error(w, "body too large", http.StatusRequestEntityTooLarge)
			return
		}
		ts, err := strconv.ParseInt(r.Header.Get("X-Webhook-Timestamp"), 10, 64)
		if err != nil || time.Since(time.Unix(ts, 0)).Abs() > tolerance {
			http.Error(w, "stale or missing timestamp", http.StatusUnauthorized)
			return
		}
		mac := hmac.New(sha256.New, []byte(secrets.PaymentsWebhookSecret))
		fmt.Fprintf(mac, "%d.", ts)
		mac.Write(body)
		got, err := hex.DecodeString(r.Header.Get("X-Webhook-Signature"))
		if err != nil || !hmac.Equal(got, mac.Sum(nil)) {
			http.Error(w, "invalid signature", http.StatusUnauthorized)
			return
		}
		r.Body = io.NopCloser(bytes.NewReader(body))
		next.ServeHTTP(w, r)
	})
}

type paymentPayload struct {
	ID    string `json:"id"`
	Type  string `json:"type"`
	Email string `json:"email"`
}

func paymentEvent(w http.ResponseWriter, r *http.Request) {
	var p paymentPayload
	if err := json.NewDecoder(r.Body).Decode(&p); err != nil || p.ID == "" {
		http.Error(w, "invalid json", http.StatusBadRequest)
		return
	}

	if _, err := db.Exec(r.Context(), `
		INSERT INTO processed_events (event_id, event_type, email)
		VALUES ($1, $2, $3)
		ON CONFLICT (event_id) DO NOTHING`, p.ID, p.Type, p.Email); err != nil {
		http.Error(w, "could not record event", http.StatusInternalServerError)
		return
	}
	if err := deliverPaymentEmail(r.Context(), p.ID); err != nil {
		http.Error(w, "email provider unavailable", http.StatusBadGateway)
		return
	}
	w.WriteHeader(http.StatusNoContent)
}

func deliverPaymentEmail(ctx context.Context, eventID string) error {
	var typ, email string
	var processedAt *time.Time
	if err := db.QueryRow(ctx, `
		SELECT event_type, email, processed_at
		FROM processed_events WHERE event_id = $1`, eventID).Scan(&typ, &email, &processedAt); err != nil {
		return err
	}
	if processedAt != nil {
		return nil
	}
	if typ == "payment.failed" && email != "" {
		if err := sendEmail(ctx, email, "Your payment did not go through", "payment-failed-"+eventID); err != nil {
			return err
		}
	}
	_, err := db.Exec(ctx, `
		UPDATE processed_events SET processed_at = now()
		WHERE event_id = $1 AND processed_at IS NULL`, eventID)
	return err
}

var client = &http.Client{Timeout: 5 * time.Second}

func sendEmail(ctx context.Context, to, subject, idempotencyKey string) error {
	body, _ := json.Marshal(map[string]string{"to": to, "subject": subject})
	req, err := http.NewRequestWithContext(ctx, http.MethodPost,
		"https://email.example.com/v1/send", bytes.NewReader(body))
	if err != nil {
		return err
	}
	req.Header.Set("Authorization", "Bearer "+secrets.EmailAPIKey)
	req.Header.Set("Idempotency-Key", idempotencyKey)
	req.Header.Set("Content-Type", "application/json")
	resp, err := client.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	if resp.StatusCode >= 300 {
		return fmt.Errorf("email provider returned %d", resp.StatusCode)
	}
	return nil
}

CREATE TABLE processed_events (
    event_id     TEXT PRIMARY KEY,
    event_type   TEXT NOT NULL,
    email        TEXT,
    processed_at TIMESTAMPTZ,
    received_at  TIMESTAMPTZ NOT NULL DEFAULT now()
);

func mustEnv(name string) string {
	v := os.Getenv(name)
	if v == "" {
		log.Fatalf("%s is not set", name)
	}
	return v
}

func main() {
	_ = godotenv.Load() // local only; ECS tasks have no .env file
	webhookSecret := mustEnv("PAYMENTS_WEBHOOK_SECRET")
	emailKey := mustEnv("EMAIL_API_KEY")

	r := chi.NewRouter()
	r.Use(middleware.Recoverer)
	r.With(verifySignature(webhookSecret)).Post("/webhooks/payments", paymentEvent(emailKey))
	log.Fatal(http.ListenAndServe(":8080", r))
}

"secrets": [
  {
    "name": "PAYMENTS_WEBHOOK_SECRET",
    "valueFrom": "arn:aws:secretsmanager:eu-central-1:123456789012:secret:payments-webhook-secret-AbCdEf"
  },
  {
    "name": "EMAIL_API_KEY",
    "valueFrom": "arn:aws:secretsmanager:eu-central-1:123456789012:secret:email-api-key-GhIjKl"
  }
]