Securing DevOps’s invoicer

A simple REST API that manages invoices.

This is the code for Chapter 3 of Securing DevOps. It contains the code and
scripts discussed in chapter 2 to the basic setup of the invoicer application and
infrastructure, plus the improvements implemented in chapter 3.

Get your own copy

To try out the code in this repository, first create a fork in your own github
account. Now before you do anything, edit the file in .circleci/config.yml and
replace the working_directory parameter with your own namespace.

For example:

    working_directory: /go/src/

would become:

    working_directory: /go/src/

Then, sign up for circleci and build the project. The build will initially fail
because it lacks the Docker credentials to push the invoicer’s image to

Head over to, create an account, then create a repository to store
the docker containers into, as explained in chapter 2.

Head back to CircleCi and in the “Project Setting”, add the following
“Environment Variables” with the appropriate values.


These variable will allow CircleCI to upload the docker container of the
invoicer into your own account. Once added, trigger a rebuild of the CircleCI
job and it should succeed and upload the container without issue.

You can then pull and run the container from your repository as follows:

$ docker run -it <MyGitHubUser>/invoicer-chapter3

Build the AWS infrastructure

The script creates a complete AWS infrastructure ready to
host the invoicer. The script first creates a database, then an elastic
beanstalk environment, and finally deploys the docker container of
invoicer-chapter3. All you need to get started is creating an AWS account, then
create a local profile (see chapter 2 for details) and run the following:

$ export AWS_PROFILE=cloudservices-aws-dev

$ export AWS_REGION=eu-west-1

$ ./

The script will outputs resources name and credentials for the new environment.

Creating EBS application ulfr-invoicer-201709231530
default vpc is vpc-c02b81a5
DB security group is sg-fc20478f
RDS Postgres database is being created. username=invoicer; password='i0l2jSQ5WkK_441c8dXwlYods9'
ElasticBeanTalk application created
API environment e-qp2pyjhhma is being created
API security group sg-732d4a00 authorized to connect to database security group sg-fc20478f
make_bucket: ulfr-invoicer-201709231530
upload: ./app-version.json to s3://ulfr-invoicer-201709231530/app-version.json
waiting for environment....................
Environment is being deployed. Public endpoint is

Manual build

Build a statically linked invoicer binary. Requires Go 1.6.

$ mkdir bin
$ go build --ldflags '-extldflags "-static"' -o bin/invoicer .

Then build the container.

$ docker build -t securingdevops/invoicer .

Database Configuration

The invoicer will automatically create a local sqlite database by default, but
if you want to run with postgres, follow these instructions.

Create a postgres database named invoicer and grant user invoicer full
access to it.

CREATE ROLE invoicer;
ALTER DATABASE invoicer OWNER TO invoicer;

When running PG and Docker on the same box, configure pg_hba to allow the
local docker network to connect.

# trust local docker hosts
host    all             all              trust


$ docker run -it \
    -e INVOICER_POSTGRES_USER="invoicer" \
    -e INVOICER_POSTGRES_DB="invoicer" \


Create an invoice

$ curl -X POST \
--data '{"is_paid": false, "amount": 1664, "due_date": "2016-05-07T23:00:00Z", "charges": [ { "type":"blood work", "amount": 1664, "description": "blood work" } ] }' \

Retrieve an invoice

$ curl
work","amount":1664,"description":"blood work"}]}


View Github