feat(queue-worker): fips

Author: cardoso

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ env:
   DOCKER_BUILD_ARCHES_JSON: '["arm64","amd64"]'
   DOCKER_BUILD_SERVICES_JSON: '["authorization-service","queue-worker-service","ddp-streamer-service","account-service","presence-service","omnichannel-transcript-service","rocketchat"]'
   DOCKER_BUILD_EXTRA_COVERAGE_JSON: '[{"arch":"amd64","service":"rocketchat","type":"coverage"},{"arch":"arm64","service":"rocketchat","type":"coverage"}]'
-  DOCKER_BUILD_FIPS_SERVICES_JSON: '["authorization-service","ddp-streamer-service","presence-service"]'
+  DOCKER_BUILD_FIPS_SERVICES_JSON: '["authorization-service","queue-worker-service","ddp-streamer-service","presence-service"]'
 
 jobs:
   release-versions:

docker-compose-ci.fips.yml

@@ -13,3 +13,8 @@ services:
     build:
       target: release-fips
     image: ghcr.io/${LOWERCASE_REPOSITORY}/ddp-streamer-service:${DOCKER_TAG}-fips
+
+  queue-worker-service:
+    build:
+      target: release-fips
+    image: ghcr.io/${LOWERCASE_REPOSITORY}/queue-worker-service:${DOCKER_TAG}-fips

docker-compose-ci.yml

@@ -137,6 +137,7 @@ services:
     build:
       dockerfile: ee/apps/queue-worker/Dockerfile
       context: .
+      target: release-standard
       x-bake:
         platforms:
           - linux/amd64

ee/apps/queue-worker/Dockerfile

@@ -101,7 +101,7 @@ WORKDIR /app/ee/apps/${SERVICE}
 
 RUN yarn workspaces focus --production
 
-FROM node:22.16.0-alpine3.21
+FROM node:22.16.0-alpine3.21 AS release-standard
 
 ARG SERVICE
 
@@ -127,3 +127,14 @@ USER rocketchat
 EXPOSE 3000 9458
 
 CMD ["node", "src/service.js"]
+
+# FIPS RELEASE STAGE
+FROM rocketchatfips140/dhi-node:22-fips AS release-fips
+ARG SERVICE
+ENV NODE_ENV=production \
+    PORT=3000
+COPY --chown=node:node --from=builder /app /app
+WORKDIR /app/ee/apps/${SERVICE}
+USER node
+EXPOSE 3000 9458
+CMD ["node", "--require", "./src/fips.js", "src/service.js"]

ee/apps/queue-worker/src/fips.ts

@@ -0,0 +1,11 @@
+import crypto from 'crypto';
+
+crypto.setFips(true);
+
+if (crypto.getFips() !== 1) {
+	throw new Error('FIPS mode was not enabled after crypto.setFips(true)');
+}
+
+console.log('=========================================');
+console.log('FIPS COMPLIANCE CHECK: YES');
+console.log('=========================================');

ee/apps/queue-worker/tsconfig.json

@@ -4,7 +4,7 @@
 		"strictPropertyInitialization": false,
 		"outDir": "./dist/ee/apps/queue-worker/src",
 	},
-	"files": ["./src/service.ts"],
+	"files": ["./src/service.ts", "./src/fips.ts"],
 	"include": ["../../../apps/meteor/definition/externals/meteor"],
 	"exclude": ["./dist"]
 }