FEAT: Discovery Video Service Subscription

docker-compose.yml

@@ -55,7 +55,7 @@ services:
     environment:
       - PULUMI_CONFIG_PASSPHRASE=${PULUMI_CONFIG_PASSPHRASE:-local}
       - PULUMI_SKIP_UPDATE_CHECK=true
-      - DB_PASSWORD=${DB_PASSWORD:?}
+      - DB_PASSWORD=example_password
     volumes:
       - "./infrastructure:/infra"
       - "pulumi-state:/state" # stack state, kept out of the repo
@@ -100,6 +100,9 @@ services:
       # of the process. Pinned by the localstack branch in infrastructure/main.go;
       # LocalStack always uses account 000000000000.
       - MEDIACONVERT_EVENTS_QUEUE_URL=${MEDIACONVERT_EVENTS_QUEUE_URL:-http://localhost.localstack.cloud:4566/000000000000/cms-mediaconvert-events}
+      # The topic ready videos are announced on, which fans out to the read
+      # side's queue. Pinned by the localstack branch in infrastructure/main.go.
+      - CATALOGUE_EVENTS_TOPIC_ARN=${CATALOGUE_EVENTS_TOPIC_ARN:-arn:aws:sns:us-east-1:000000000000:catalogue-events}
       # Where finished HLS output is served from. In AWS this is the CloudFront
       # distribution; there is none under LocalStack, so the encoded bucket is
       # addressed directly — path-style, for the same reason S3 is elsewhere.
@@ -110,7 +113,7 @@ services:
       - DB_PORT=${DB_PORT:-4510}
       - DB_NAME=${DB_NAME:-cms}
       - DB_USER=${DB_USER:-cms}
-      - DB_PASSWORD=${DB_PASSWORD:?}
+      - DB_PASSWORD=example_password
       - DB_SSLMODE=${DB_SSLMODE:-disable}
     depends_on:
       infra:
@@ -131,15 +134,22 @@ services:
     ports:
       - "127.0.0.1:8080:8080" # JSON API + Swagger UI at /swagger/
     environment:
-      # Postgres only — discovery touches no AWS service, which is why it has
-      # no task role in infrastructure/main.go and no AWS_* wiring here. Its
-      # own role and database, provisioned alongside the cms ones by
-      # newServiceDatabase, so the two services share no credentials.
+      # AWS: discovery reaches exactly one AWS API — the queue subscribed to
+      # cms's catalogue topic, which it drains for the lifetime of the process.
+      # That is why it now has a task role in infrastructure/main.go, scoped to
+      # this queue and nothing else.
+      - AWS_REGION=${AWS_REGION:-us-east-1}
+      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-test}
+      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY:-test}
+      - AWS_ENDPOINT_URL=${AWS_ENDPOINT_URL:-http://localhost.localstack.cloud:4566}
+      - CATALOGUE_EVENTS_QUEUE_URL=${CATALOGUE_EVENTS_QUEUE_URL:-http://localhost.localstack.cloud:4566/000000000000/discovery-catalogue-events}
+      # Postgres: its own role and database, provisioned alongside the cms ones
+      # by newServiceDatabase, so the two services share no credentials.
       - DB_HOST=${DISCOVERY_DB_HOST:-localhost.localstack.cloud}
       - DB_PORT=${DISCOVERY_DB_PORT:-4510}
       - DB_NAME=${DISCOVERY_DB_NAME:-discovery}
       - DB_USER=${DISCOVERY_DB_USER:-discovery}
-      - DB_PASSWORD=${DB_PASSWORD:?}
+      - DB_PASSWORD=example_password
       - DB_SSLMODE=${DISCOVERY_DB_SSLMODE:-disable}
     depends_on:
       infra: