mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2026-09-02 05:53:14 +00:00
Test matrix-static-files with Molecule
This commit is contained in:
Slavi Pantaleev
@@ -138,6 +138,7 @@
|
||||
"roles/custom/matrix-bridge-postmoogle/defaults/main.yml",
|
||||
"roles/custom/matrix-client-element/defaults/main.yml",
|
||||
"roles/custom/matrix-ketesa/defaults/main.yml",
|
||||
"roles/custom/matrix-static-files/defaults/main.yml",
|
||||
"roles/custom/matrix-synapse/defaults/main.yml"
|
||||
],
|
||||
"matchUpdateTypes": [
|
||||
|
||||
@@ -0,0 +1,48 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
- name: Include roles for matrix-static-files Molecule tests
|
||||
hosts: all
|
||||
become: true
|
||||
vars_files:
|
||||
- "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
|
||||
gather_facts: true
|
||||
tasks:
|
||||
- name: Include base roles for matrix-static-files Molecule tests
|
||||
ansible.builtin.include_role:
|
||||
name: "{{ role_name }}"
|
||||
public: true
|
||||
loop:
|
||||
- com.devture.ansible.role.playbook_help
|
||||
- com.devture.ansible.role.systemd_docker_base
|
||||
loop_control:
|
||||
loop_var: role_name
|
||||
|
||||
# main.yml also invokes the separately-tagged public self-check. In the full
|
||||
# playbook that runs only after systemd_service_manager has started services.
|
||||
- name: Include matrix-static-files setup task files
|
||||
ansible.builtin.include_role:
|
||||
name: "custom/{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
||||
public: true
|
||||
tasks_from: "{{ role_task_file }}"
|
||||
loop:
|
||||
- validate_config.yml
|
||||
- install.yml
|
||||
loop_control:
|
||||
loop_var: role_task_file
|
||||
|
||||
- name: Ensure matrix-static-files is started
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Ensure systemd daemon is reloaded
|
||||
ansible.builtin.systemd_service:
|
||||
daemon_reload: true
|
||||
|
||||
- name: Ensure matrix-static-files systemd service is started
|
||||
ansible.builtin.systemd_service:
|
||||
name: matrix-static-files.service
|
||||
state: started
|
||||
@@ -0,0 +1,148 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
dependency:
|
||||
name: galaxy
|
||||
options:
|
||||
requirements-file: requirements.yml
|
||||
force: true
|
||||
driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: matrix-static-files-${MOLECULE_DISTRO:-ubuntu2604}-default
|
||||
image: "geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2604}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-""}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
||||
cgroupns_mode: host
|
||||
privileged: true
|
||||
pre_build_image: true
|
||||
provisioner:
|
||||
name: ansible
|
||||
config_options:
|
||||
defaults:
|
||||
callback_result_format: yaml
|
||||
inventory:
|
||||
group_vars:
|
||||
all:
|
||||
# verify.yml is a separate play, so paths and runtime settings it reads are
|
||||
# pinned here rather than relying on role defaults remaining in scope.
|
||||
matrix_static_files_base_path: /matrix/static-files
|
||||
matrix_static_files_config_path: /matrix/static-files/config
|
||||
matrix_static_files_public_path: /matrix/static-files/public
|
||||
matrix_static_files_container_network: matrix-static-files-molecule
|
||||
matrix_static_files_container_http_host_bind_port: ''
|
||||
|
||||
# Exercise the generated environment and prove the server listens on what
|
||||
# the role rendered rather than static-web-server's own port default.
|
||||
matrix_static_files_environment_variable_server_port: 18082
|
||||
matrix_static_files_environment_variable_server_log_level: debug
|
||||
matrix_static_files_environment_variable_server_log_remote_address: true
|
||||
matrix_static_files_environment_variable_server_ignore_hidden_files: false
|
||||
matrix_static_files_environment_variables_additional_variables: |
|
||||
MOLECULE_STATIC_FILES_MARKER=environment-reached
|
||||
matrix_static_files_files_cache_time_hours: 7
|
||||
|
||||
# Render both router families with non-default routing knobs. Traefik does
|
||||
# not need to run: the file and the attached container labels are inspected.
|
||||
matrix_static_files_container_labels_traefik_entrypoints: web
|
||||
matrix_static_files_container_labels_well_known_matrix_endpoint_traefik_hostname: matrix-well-known.molecule.local
|
||||
matrix_static_files_container_labels_well_known_matrix_endpoint_traefik_path_prefix: /molecule-well-known
|
||||
matrix_static_files_container_labels_well_known_matrix_endpoint_traefik_priority: 67
|
||||
matrix_static_files_container_labels_well_known_matrix_endpoint_middleware_compress_minResponseBodyBytes: 321
|
||||
matrix_static_files_container_labels_base_domain_enabled: true
|
||||
matrix_static_files_container_labels_base_domain_traefik_hostname: base.molecule.local
|
||||
matrix_static_files_container_labels_base_domain_traefik_path_prefix: /molecule-base
|
||||
matrix_static_files_container_labels_base_domain_traefik_priority: 43
|
||||
matrix_static_files_container_labels_base_domain_root_path_redirection_enabled: false
|
||||
matrix_static_files_container_labels_additional_labels: |
|
||||
molecule.scenario=matrix-static-files
|
||||
|
||||
matrix_static_files_file_index_html_template: |-
|
||||
<!doctype html>
|
||||
<html>
|
||||
<body>Molecule static-files index marker</body>
|
||||
</html>
|
||||
|
||||
# All URLs are inert data: the static server never contacts them. The mix
|
||||
# exercises optional sections, recursive extensions, lists and mappings.
|
||||
matrix_static_files_file_matrix_client_property_m_homeserver_base_url: https://homeserver.molecule.invalid
|
||||
matrix_static_files_file_matrix_client_property_m_identity_server_base_url: ''
|
||||
matrix_static_files_file_matrix_client_property_m_integrations_managers_api_url: https://integrations.molecule.invalid/api
|
||||
matrix_static_files_file_matrix_client_property_m_integrations_managers_ui_url: https://integrations.molecule.invalid/ui
|
||||
matrix_static_files_file_matrix_client_property_io_element_jitsi_preferred_domain: jitsi.molecule.local
|
||||
matrix_static_files_file_matrix_client_property_org_matrix_msc2965_authentication_enabled: true
|
||||
matrix_static_files_file_matrix_client_property_org_matrix_msc2965_authentication_issuer: https://auth.molecule.invalid/
|
||||
matrix_static_files_file_matrix_client_property_org_matrix_msc2965_authentication_account: https://auth.molecule.invalid/account
|
||||
matrix_static_files_file_matrix_client_property_org_matrix_msc3575_proxy_url: https://sync.molecule.invalid
|
||||
matrix_static_files_file_matrix_client_property_m_tile_server_entries_enabled: true
|
||||
matrix_static_files_file_matrix_client_property_m_tile_server_map_style_url: https://maps.molecule.invalid/style.json
|
||||
matrix_static_files_file_matrix_client_property_io_element_e2ee_default: false
|
||||
matrix_static_files_file_matrix_client_property_io_element_e2ee_force_disable: true
|
||||
matrix_static_files_file_matrix_client_property_cc_etke_ketesa_custom:
|
||||
allow:
|
||||
- molecule-client
|
||||
marker: ketesa-custom
|
||||
matrix_static_files_file_matrix_client_property_org_matrix_msc4143_rtc_foci_custom:
|
||||
- type: livekit
|
||||
livekit_service_url: https://livekit.molecule.invalid
|
||||
matrix_static_files_file_matrix_client_configuration_extension_json: |
|
||||
{
|
||||
"m.homeserver": {
|
||||
"molecule_extension_marker": "recursive-merge-reached"
|
||||
},
|
||||
"org.example.molecule": {
|
||||
"enabled": true,
|
||||
"sequence": 42
|
||||
}
|
||||
}
|
||||
|
||||
matrix_static_files_file_matrix_server_property_m_server: federation.molecule.local:9448
|
||||
matrix_static_files_file_matrix_server_configuration_extension_json: |
|
||||
{
|
||||
"org.example.molecule": "server-extension-reached"
|
||||
}
|
||||
|
||||
matrix_static_files_file_matrix_support_enabled: true
|
||||
matrix_static_files_file_matrix_support_property_m_contacts:
|
||||
- matrix_id: "@support:molecule.local"
|
||||
email_address: support@molecule.invalid
|
||||
role: m.role.admin
|
||||
matrix_static_files_file_matrix_support_property_m_support_page: https://support.molecule.invalid
|
||||
matrix_static_files_file_matrix_support_configuration_extension_json: |
|
||||
{
|
||||
"org.example.molecule": {
|
||||
"channel": "support-extension-reached"
|
||||
}
|
||||
}
|
||||
|
||||
matrix_static_files_file_matrix_mautrix_property_fi_mau_bridges_custom:
|
||||
- https://telegram.molecule.invalid
|
||||
- https://signal.molecule.invalid
|
||||
matrix_static_files_file_matrix_mautrix_configuration_extension_json: |
|
||||
{
|
||||
"fi.mau.external_bridge_servers": [
|
||||
"https://external-bridges.molecule.invalid"
|
||||
],
|
||||
"org.example.molecule": "mautrix-extension-reached"
|
||||
}
|
||||
env:
|
||||
# Workaround for https://github.com/ansible/molecule/issues/4391
|
||||
ANSIBLE_ROLES_PATH: ${MOLECULE_PROJECT_DIRECTORY}/../..:/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:${ANSIBLE_HOME:-~/.ansible}/roles
|
||||
scenario:
|
||||
test_sequence:
|
||||
- dependency
|
||||
- cleanup
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
- prepare
|
||||
- converge
|
||||
- idempotence
|
||||
- verify
|
||||
- cleanup
|
||||
- destroy
|
||||
verifier:
|
||||
name: ansible
|
||||
@@ -0,0 +1,56 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
- name: Prepare matrix-static-files Molecule tests
|
||||
hosts: all
|
||||
become: true
|
||||
vars_files:
|
||||
- "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
|
||||
gather_facts: true
|
||||
tasks:
|
||||
- name: Ensure apt cache is updated
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
cache_valid_time: 600
|
||||
when: ansible_facts['os_family'] == 'Debian'
|
||||
|
||||
- name: Ensure required packages are installed
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
- python3-requests
|
||||
- fuse-overlayfs
|
||||
state: present
|
||||
|
||||
- name: Ensure Docker is installed
|
||||
ansible.builtin.include_role:
|
||||
name: ansible-role-docker
|
||||
vars:
|
||||
docker_daemon_options:
|
||||
storage-driver: fuse-overlayfs
|
||||
|
||||
# The role's file tasks resolve owner and group by name. matrix-base creates
|
||||
# these during a real deployment, so the scenario supplies that prerequisite.
|
||||
- name: Ensure the matrix group exists
|
||||
ansible.builtin.group:
|
||||
name: "{{ matrix_group_name }}"
|
||||
gid: "{{ matrix_user_gid }}"
|
||||
state: present
|
||||
|
||||
- name: Ensure the matrix user exists
|
||||
ansible.builtin.user:
|
||||
name: "{{ matrix_user_name }}"
|
||||
uid: "{{ matrix_user_uid }}"
|
||||
group: "{{ matrix_group_name }}"
|
||||
create_home: false
|
||||
system: true
|
||||
state: present
|
||||
|
||||
- name: Ensure the base data path exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ matrix_base_data_path }}"
|
||||
state: directory
|
||||
owner: "{{ matrix_user_name }}"
|
||||
group: "{{ matrix_group_name }}"
|
||||
mode: "0750"
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../molecule-shared/requirements.yml
|
||||
@@ -0,0 +1,469 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
- name: Verify matrix-static-files
|
||||
hosts: all
|
||||
become: true
|
||||
vars_files:
|
||||
- "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"
|
||||
- "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
# Load the shipped version independently of the scenario. A role version bump
|
||||
# therefore advances the expected image instead of comparing two test pins.
|
||||
- name: Load the role's defaults under a separate name
|
||||
ansible.builtin.include_vars:
|
||||
file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"
|
||||
name: matrix_static_files_role_defaults
|
||||
|
||||
- name: Wait for the matrix-static-files service to become active
|
||||
ansible.builtin.systemd_service:
|
||||
name: matrix-static-files.service
|
||||
register: matrix_static_files_service
|
||||
until: matrix_static_files_service.status.ActiveState == 'active'
|
||||
retries: 30
|
||||
delay: 5
|
||||
failed_when: false
|
||||
|
||||
# Restart=always means ActiveState alone stays green during a crash loop.
|
||||
- name: Assert the service is active and has not restarted
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_service.status.ActiveState == 'active'
|
||||
- matrix_static_files_service.status.NRestarts is defined
|
||||
- matrix_static_files_service.status.NRestarts | int == 0
|
||||
fail_msg: >-
|
||||
matrix-static-files.service is
|
||||
{{ matrix_static_files_service.status.ActiveState | default('unknown') }}
|
||||
after {{ matrix_static_files_service.status.NRestarts | default('?') }} restart(s)
|
||||
success_msg: "matrix-static-files.service is active and has not restarted"
|
||||
|
||||
# Probe over the private container network, matching how Traefik reaches the
|
||||
# service in a deployment. Every document is generated by a different role path.
|
||||
- name: Fetch the generated JSON documents from the running service
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- docker
|
||||
- run
|
||||
- --rm
|
||||
- --network={{ matrix_static_files_container_network }}
|
||||
- "{{ molecule_shared_image_curl }}"
|
||||
- --silent
|
||||
- --show-error
|
||||
- --write-out
|
||||
- "\nMOLECULE_HTTP_STATUS=%{http_code}"
|
||||
- "http://matrix-static-files:{{ matrix_static_files_environment_variable_server_port }}{{ item.path }}"
|
||||
loop:
|
||||
- name: client
|
||||
path: /.well-known/matrix/client
|
||||
- name: server
|
||||
path: /.well-known/matrix/server
|
||||
- name: support
|
||||
path: /.well-known/matrix/support
|
||||
- name: mautrix
|
||||
path: /.well-known/matrix/mautrix
|
||||
register: matrix_static_files_document_responses
|
||||
changed_when: false
|
||||
until: "'MOLECULE_HTTP_STATUS=200' in matrix_static_files_document_responses.stdout"
|
||||
retries: 24
|
||||
delay: 5
|
||||
failed_when: false
|
||||
|
||||
- name: Assert every enabled generated document is served successfully
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "'MOLECULE_HTTP_STATUS=200' in item.stdout"
|
||||
fail_msg: >-
|
||||
{{ item.item.path }} was not served successfully
|
||||
({{ item.stdout | default('no output') }})
|
||||
success_msg: "{{ item.item.path }} is served successfully"
|
||||
loop: "{{ matrix_static_files_document_responses.results }}"
|
||||
loop_control:
|
||||
label: "{{ item.item.name }}"
|
||||
|
||||
- name: Initialize parsed served documents
|
||||
ansible.builtin.set_fact:
|
||||
matrix_static_files_served_documents: {}
|
||||
|
||||
- name: Parse the served JSON documents
|
||||
ansible.builtin.set_fact:
|
||||
matrix_static_files_served_documents: >-
|
||||
{{
|
||||
matrix_static_files_served_documents
|
||||
| combine({item.item.name: item.stdout | regex_replace('\nMOLECULE_HTTP_STATUS=[0-9]+\s*$', '') | from_json})
|
||||
}}
|
||||
loop: "{{ matrix_static_files_document_responses.results }}"
|
||||
loop_control:
|
||||
label: "{{ item.item.name }}"
|
||||
|
||||
# The default server port must be closed. Otherwise a response on the scenario's
|
||||
# port would not prove SERVER_PORT reached the process.
|
||||
- name: Probe static-web-server's default port
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- docker
|
||||
- run
|
||||
- --rm
|
||||
- --network={{ matrix_static_files_container_network }}
|
||||
- "{{ molecule_shared_image_curl }}"
|
||||
- --silent
|
||||
- --output
|
||||
- /dev/null
|
||||
- --write-out
|
||||
- "MOLECULE_HTTP_STATUS=%{http_code}"
|
||||
- --connect-timeout
|
||||
- "2"
|
||||
- http://matrix-static-files:8080/.well-known/matrix/client
|
||||
register: matrix_static_files_default_port_response
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Assert static-web-server's default port is not listening
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "'MOLECULE_HTTP_STATUS=200' not in matrix_static_files_default_port_response.stdout"
|
||||
fail_msg: >-
|
||||
Port 8080 answered, so the live probe does not prove the non-default
|
||||
SERVER_PORT reached static-web-server
|
||||
success_msg: "Only the configured non-default internal port answers"
|
||||
|
||||
- name: Read the generated JSON files from disk
|
||||
ansible.builtin.slurp:
|
||||
src: "{{ matrix_static_files_public_path }}/.well-known/matrix/{{ item }}"
|
||||
loop:
|
||||
- client
|
||||
- server
|
||||
- support
|
||||
- mautrix
|
||||
register: matrix_static_files_rendered_document_files
|
||||
|
||||
- name: Initialize parsed rendered documents
|
||||
ansible.builtin.set_fact:
|
||||
matrix_static_files_rendered_documents: {}
|
||||
|
||||
- name: Parse the generated JSON files
|
||||
ansible.builtin.set_fact:
|
||||
matrix_static_files_rendered_documents: >-
|
||||
{{
|
||||
matrix_static_files_rendered_documents
|
||||
| combine({item.item: item.content | b64decode | from_json})
|
||||
}}
|
||||
loop: "{{ matrix_static_files_rendered_document_files.results }}"
|
||||
loop_control:
|
||||
label: "{{ item.item }}"
|
||||
|
||||
- name: Assert the running service exposes the exact documents the role generated
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_served_documents[item] == matrix_static_files_rendered_documents[item]
|
||||
fail_msg: "The served {{ item }} document differs from the generated file"
|
||||
success_msg: "The served {{ item }} document is the generated file"
|
||||
loop:
|
||||
- client
|
||||
- server
|
||||
- support
|
||||
- mautrix
|
||||
|
||||
- name: Assert the client document carries all configured discovery sections
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_served_documents.client['m.homeserver'].base_url == 'https://homeserver.molecule.invalid'
|
||||
- matrix_static_files_served_documents.client['m.integrations'].managers[0].api_url == 'https://integrations.molecule.invalid/api'
|
||||
- matrix_static_files_served_documents.client['m.integrations'].managers[0].ui_url == 'https://integrations.molecule.invalid/ui'
|
||||
- matrix_static_files_served_documents.client['io.element.jitsi'].preferredDomain == 'jitsi.molecule.local'
|
||||
- matrix_static_files_served_documents.client['org.matrix.msc2965.authentication'].issuer == 'https://auth.molecule.invalid/'
|
||||
- matrix_static_files_served_documents.client['org.matrix.msc2965.authentication'].account == 'https://auth.molecule.invalid/account'
|
||||
- matrix_static_files_served_documents.client['org.matrix.msc3575.proxy'].url == 'https://sync.molecule.invalid'
|
||||
- matrix_static_files_served_documents.client['m.tile_server'].map_style_url == 'https://maps.molecule.invalid/style.json'
|
||||
- matrix_static_files_served_documents.client['io.element.e2ee'].default == false
|
||||
- matrix_static_files_served_documents.client['io.element.e2ee'].force_disable == true
|
||||
- matrix_static_files_served_documents.client['cc.etke.ketesa'].marker == 'ketesa-custom'
|
||||
- matrix_static_files_served_documents.client['org.matrix.msc4143.rtc_foci'][0].livekit_service_url == 'https://livekit.molecule.invalid'
|
||||
fail_msg: "The client document does not carry the configured discovery sections"
|
||||
success_msg: "The client document carries the configured discovery sections"
|
||||
|
||||
- name: Assert recursive extension and omission behavior in the client document
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_served_documents.client['m.homeserver'].molecule_extension_marker == 'recursive-merge-reached'
|
||||
- matrix_static_files_served_documents.client['org.example.molecule'].enabled == true
|
||||
- matrix_static_files_served_documents.client['org.example.molecule'].sequence == 42
|
||||
- "'m.identity_server' not in matrix_static_files_served_documents.client"
|
||||
fail_msg: "The client extension was not merged recursively or an omitted section leaked in"
|
||||
success_msg: "The client extension is merged recursively and disabled identity discovery is omitted"
|
||||
|
||||
- name: Assert the server, support and mautrix documents carry configured data and extensions
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_served_documents.server['m.server'] == 'federation.molecule.local:9448'
|
||||
- matrix_static_files_served_documents.server['org.example.molecule'] == 'server-extension-reached'
|
||||
- matrix_static_files_served_documents.support.contacts[0].matrix_id == '@support:molecule.local'
|
||||
- matrix_static_files_served_documents.support.contacts[0].role == 'm.role.admin'
|
||||
- matrix_static_files_served_documents.support.support_page == 'https://support.molecule.invalid'
|
||||
- matrix_static_files_served_documents.support['org.example.molecule'].channel == 'support-extension-reached'
|
||||
- matrix_static_files_served_documents.mautrix['fi.mau.bridges'] | length == 2
|
||||
- "'https://telegram.molecule.invalid' in matrix_static_files_served_documents.mautrix['fi.mau.bridges']"
|
||||
- matrix_static_files_served_documents.mautrix['fi.mau.external_bridge_servers'][0] == 'https://external-bridges.molecule.invalid'
|
||||
- matrix_static_files_served_documents.mautrix['org.example.molecule'] == 'mautrix-extension-reached'
|
||||
fail_msg: "One or more auxiliary documents lost configured data or extensions"
|
||||
success_msg: "Server, support and mautrix documents carry configured data and extensions"
|
||||
|
||||
- name: Fetch response headers for every generated JSON document
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- docker
|
||||
- run
|
||||
- --rm
|
||||
- --network={{ matrix_static_files_container_network }}
|
||||
- "{{ molecule_shared_image_curl }}"
|
||||
- --silent
|
||||
- --show-error
|
||||
- --head
|
||||
- "http://matrix-static-files:{{ matrix_static_files_environment_variable_server_port }}/.well-known/matrix/{{ item }}"
|
||||
loop:
|
||||
- client
|
||||
- server
|
||||
- support
|
||||
- mautrix
|
||||
register: matrix_static_files_document_headers
|
||||
changed_when: false
|
||||
|
||||
- name: Assert every generated JSON document carries the configured headers
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "'content-type: application/json' in item.stdout_lines"
|
||||
- "'access-control-allow-origin: *' in item.stdout_lines"
|
||||
- "'cache-control: max-age=25200' in item.stdout_lines"
|
||||
fail_msg: >-
|
||||
{{ item.item }} did not carry the configured JSON, CORS and cache headers:
|
||||
{{ item.stdout }}
|
||||
success_msg: "{{ item.item }} carries the configured JSON, CORS and cache headers"
|
||||
loop: "{{ matrix_static_files_document_headers.results }}"
|
||||
loop_control:
|
||||
label: "{{ item.item }}"
|
||||
|
||||
- name: Fetch the generated base-domain index document
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- docker
|
||||
- run
|
||||
- --rm
|
||||
- --network={{ matrix_static_files_container_network }}
|
||||
- "{{ molecule_shared_image_curl }}"
|
||||
- --silent
|
||||
- --show-error
|
||||
- --write-out
|
||||
- "\nMOLECULE_HTTP_STATUS=%{http_code}"
|
||||
- "http://matrix-static-files:{{ matrix_static_files_environment_variable_server_port }}/"
|
||||
register: matrix_static_files_index_response
|
||||
changed_when: false
|
||||
|
||||
- name: Assert the configured base-domain index is served
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "'MOLECULE_HTTP_STATUS=200' in matrix_static_files_index_response.stdout"
|
||||
- "'Molecule static-files index marker' in matrix_static_files_index_response.stdout"
|
||||
fail_msg: >-
|
||||
The configured base-domain index was not served
|
||||
({{ matrix_static_files_index_response.stdout | default('no output') }})
|
||||
success_msg: "The configured base-domain index is served"
|
||||
|
||||
- name: Parse the TOML configuration the role rendered
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- python3
|
||||
- -c
|
||||
- >-
|
||||
import json, sys, tomllib;
|
||||
print(json.dumps(tomllib.load(open(sys.argv[1], 'rb'))))
|
||||
- "{{ matrix_static_files_config_path }}/config.toml"
|
||||
register: matrix_static_files_config_command
|
||||
changed_when: false
|
||||
|
||||
- name: Assert the parsed server configuration carries the header contract
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_config.advanced.headers[0].source == '/.well-known/matrix/*'
|
||||
- matrix_static_files_config.advanced.headers[0].headers['Content-Type'] == 'application/json'
|
||||
- matrix_static_files_config.advanced.headers[0].headers['Access-Control-Allow-Origin'] == '*'
|
||||
- matrix_static_files_config.advanced.headers[0].headers['Cache-Control'] == 'max-age=25200'
|
||||
fail_msg: "The parsed config.toml does not carry the configured header contract"
|
||||
success_msg: "The parsed config.toml carries the configured header contract"
|
||||
vars:
|
||||
matrix_static_files_config: "{{ matrix_static_files_config_command.stdout | from_json }}"
|
||||
|
||||
- name: Read the environment file the role rendered
|
||||
ansible.builtin.slurp:
|
||||
src: "{{ matrix_static_files_base_path }}/env"
|
||||
register: matrix_static_files_env_file
|
||||
|
||||
- name: Initialize the parsed environment
|
||||
ansible.builtin.set_fact:
|
||||
matrix_static_files_env_parsed: {}
|
||||
|
||||
- name: Parse the rendered environment
|
||||
ansible.builtin.set_fact:
|
||||
matrix_static_files_env_parsed: >-
|
||||
{{ matrix_static_files_env_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }}
|
||||
loop: "{{ (matrix_static_files_env_file.content | b64decode).splitlines() | reject('equalto', '') }}"
|
||||
when: "'=' in item"
|
||||
no_log: true
|
||||
|
||||
- name: Assert the rendered environment carries the scenario's settings
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_env_parsed.SERVER_PORT == matrix_static_files_environment_variable_server_port | string
|
||||
- matrix_static_files_env_parsed.SERVER_LOG_LEVEL == 'debug'
|
||||
- matrix_static_files_env_parsed.SERVER_LOG_REMOTE_ADDRESS == 'true'
|
||||
- matrix_static_files_env_parsed.SERVER_IGNORE_HIDDEN_FILES == 'false'
|
||||
- matrix_static_files_env_parsed.MOLECULE_STATIC_FILES_MARKER == 'environment-reached'
|
||||
fail_msg: "The parsed environment file does not carry the scenario's settings"
|
||||
success_msg: "The parsed environment file carries the scenario's settings"
|
||||
|
||||
- name: Read the labels file the role rendered
|
||||
ansible.builtin.slurp:
|
||||
src: "{{ matrix_static_files_base_path }}/labels"
|
||||
register: matrix_static_files_labels_file
|
||||
|
||||
- name: Initialize the parsed labels
|
||||
ansible.builtin.set_fact:
|
||||
matrix_static_files_labels_parsed: {}
|
||||
|
||||
- name: Parse the rendered labels
|
||||
ansible.builtin.set_fact:
|
||||
matrix_static_files_labels_parsed: >-
|
||||
{{ matrix_static_files_labels_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }}
|
||||
loop: "{{ (matrix_static_files_labels_file.content | b64decode).splitlines() | reject('equalto', '') }}"
|
||||
when:
|
||||
- "'=' in item"
|
||||
- not item.startswith('#')
|
||||
no_log: true
|
||||
|
||||
- name: Assert the rendered labels carry both routing contracts
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_labels_parsed['traefik.enable'] == 'true'
|
||||
- matrix_static_files_labels_parsed['traefik.docker.network'] == matrix_static_files_container_network
|
||||
- matrix_static_files_labels_parsed['traefik.http.services.matrix-static-files.loadbalancer.server.port'] == matrix_static_files_environment_variable_server_port | string
|
||||
- "'Host(`matrix-well-known.molecule.local`)' in matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.rule']"
|
||||
- "'PathPrefix(`/molecule-well-known`)' in matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.rule']"
|
||||
- matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.priority'] == '67'
|
||||
- matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.entrypoints'] == 'web'
|
||||
- matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.tls'] == 'false'
|
||||
- matrix_static_files_labels_parsed['traefik.http.middlewares.matrix-static-files-well-known-matrix-compress.compress.minResponseBodyBytes'] == '321'
|
||||
- "'Host(`base.molecule.local`)' in matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-base-domain.rule']"
|
||||
- "'PathPrefix(`/molecule-base`)' in matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-base-domain.rule']"
|
||||
- matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-base-domain.priority'] == '43'
|
||||
- matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-base-domain.tls'] == 'false'
|
||||
- matrix_static_files_labels_parsed['molecule.scenario'] == 'matrix-static-files'
|
||||
fail_msg: "The rendered labels do not carry both routing contracts"
|
||||
success_msg: "The rendered labels carry both routing contracts"
|
||||
|
||||
- name: Inspect the running matrix-static-files container
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- docker
|
||||
- container
|
||||
- inspect
|
||||
- matrix-static-files
|
||||
register: matrix_static_files_container_inspect_command
|
||||
changed_when: false
|
||||
|
||||
- name: Parse the running container inspection
|
||||
ansible.builtin.set_fact:
|
||||
matrix_static_files_container: "{{ (matrix_static_files_container_inspect_command.stdout | from_json)[0] }}"
|
||||
|
||||
- name: Assert the configured environment reached the running container
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "('SERVER_PORT=' ~ (matrix_static_files_environment_variable_server_port | string)) in matrix_static_files_container.Config.Env"
|
||||
- "'SERVER_LOG_LEVEL=debug' in matrix_static_files_container.Config.Env"
|
||||
- "'SERVER_LOG_REMOTE_ADDRESS=true' in matrix_static_files_container.Config.Env"
|
||||
- "'SERVER_IGNORE_HIDDEN_FILES=false' in matrix_static_files_container.Config.Env"
|
||||
- "'MOLECULE_STATIC_FILES_MARKER=environment-reached' in matrix_static_files_container.Config.Env"
|
||||
fail_msg: "The running container environment does not carry the scenario's settings"
|
||||
success_msg: "The configured environment reached the running container"
|
||||
|
||||
- name: Assert the rendered labels reached the running container
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_container.Config.Labels['traefik.enable'] == 'true'
|
||||
- matrix_static_files_container.Config.Labels['traefik.docker.network'] == matrix_static_files_container_network
|
||||
- matrix_static_files_container.Config.Labels['traefik.http.services.matrix-static-files.loadbalancer.server.port'] == matrix_static_files_environment_variable_server_port | string
|
||||
- matrix_static_files_container.Config.Labels['traefik.http.routers.matrix-static-files-well-known-matrix.priority'] == '67'
|
||||
- matrix_static_files_container.Config.Labels['traefik.http.routers.matrix-static-files-base-domain.priority'] == '43'
|
||||
- matrix_static_files_container.Config.Labels['molecule.scenario'] == 'matrix-static-files'
|
||||
fail_msg: "The running container does not carry the labels the role rendered"
|
||||
success_msg: "The rendered labels reached the running container"
|
||||
|
||||
- name: Assert the running container uses the exact image and version the role pins
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_container.Config.Image == matrix_static_files_expected_image
|
||||
fail_msg: >-
|
||||
The running container uses {{ matrix_static_files_container.Config.Image }},
|
||||
expected {{ matrix_static_files_expected_image }}
|
||||
success_msg: "The running container uses the exact image and version defaults/main.yml pins"
|
||||
vars:
|
||||
matrix_static_files_expected_tag: >-
|
||||
{{
|
||||
'latest'
|
||||
if matrix_static_files_role_defaults.matrix_static_files_version == 'latest'
|
||||
else matrix_static_files_role_defaults.matrix_static_files_version ~ '-alpine'
|
||||
}}
|
||||
matrix_static_files_expected_image: >-
|
||||
{{ matrix_static_files_role_defaults.matrix_static_files_container_image_registry_prefix_upstream_default }}joseluisq/static-web-server:{{ matrix_static_files_expected_tag }}
|
||||
|
||||
- name: Assert the running container uses the configured UID and GID
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_container.Config.User == (matrix_user_uid | string) ~ ':' ~ (matrix_user_gid | string)
|
||||
fail_msg: >-
|
||||
The running container uses {{ matrix_static_files_container.Config.User }},
|
||||
expected {{ matrix_user_uid }}:{{ matrix_user_gid }}
|
||||
success_msg: "The running container uses the configured UID and GID"
|
||||
|
||||
- name: Assert the running container has a read-only root filesystem
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_container.HostConfig.ReadonlyRootfs == true
|
||||
fail_msg: "The running container's root filesystem is writable"
|
||||
success_msg: "The running container has a read-only root filesystem"
|
||||
|
||||
- name: Assert the running container drops all capabilities and adds none
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_container.HostConfig.CapDrop == ['ALL']
|
||||
- matrix_static_files_container.HostConfig.CapAdd | default([], true) | length == 0
|
||||
fail_msg: "The running container does not have the expected capability restrictions"
|
||||
success_msg: "The running container drops all capabilities and adds none"
|
||||
|
||||
- name: Assert both bind mounts are read-only
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_container.Mounts | selectattr('Destination', 'equalto', '/var/public') | list | length == 1
|
||||
- (matrix_static_files_container.Mounts | selectattr('Destination', 'equalto', '/var/public') | first).RW == false
|
||||
- matrix_static_files_container.Mounts | selectattr('Destination', 'equalto', '/config') | list | length == 1
|
||||
- (matrix_static_files_container.Mounts | selectattr('Destination', 'equalto', '/config') | first).RW == false
|
||||
fail_msg: "The running container is missing a read-only content or configuration mount"
|
||||
success_msg: "Both bind mounts are present and read-only"
|
||||
|
||||
- name: Assert the running container is attached only to its dedicated network
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_container.NetworkSettings.Networks.keys() | list | length == 1
|
||||
- matrix_static_files_container_network in matrix_static_files_container.NetworkSettings.Networks
|
||||
fail_msg: >-
|
||||
The running container is attached to unexpected networks:
|
||||
{{ matrix_static_files_container.NetworkSettings.Networks.keys() | list }}
|
||||
success_msg: "The running container is attached only to its dedicated network"
|
||||
|
||||
- name: Assert the running container publishes no host ports
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- matrix_static_files_container.HostConfig.PortBindings | default({}, true) | length == 0
|
||||
fail_msg: "The running container unexpectedly publishes a host port"
|
||||
success_msg: "The running container publishes no host ports"
|
||||
Reference in New Issue
Block a user