mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2026-08-29 12:03:14 +00:00
Slavi PantaleevandClaude Opus 5
7e8b3466b6
Hookshot is the widest HTTP surface of the bridges here - an appservice port
plus a `listeners` list whose entries appear or vanish with independent
switches - so the scenario asserts on that surface rather than on "it started".
The scenario configures NO third-party service. GitHub, GitLab, Jira and Figma
each need an account and a credential somewhere else, which is where a scenario
stops testing this repository (docs/molecule-testing.md). GitLab, which the role
turns on by default, is switched off and its absence from both config.yml and
the registration's namespaces is asserted. The generic webhooks listener needs
no credential from anyone, and is what gets exercised live: a POST to an unknown
hook id comes back as `{"ok":false,"error":"Webhook not found"}`, which only
Hookshot's own generic-webhook handler produces - an Express "Cannot POST" page
there would mean the port is Hookshot's but the service was never mounted on it.
Every port the scenario sets differs from both the role's default and Hookshot's
own, and the run asserts both halves: the webhooks, metrics and appservice ports
it chose all answer, and 9000/9001/9003/9993 - what the role would have used
instead - all refuse. Metrics are off in the role's defaults, so that listener
exists only because the scenario asked for it, and /metrics answers with
`hookshot_*` series that nothing else could have produced.
config.yml and registration.yml are parsed as YAML and asserted structurally, so
a value landing under the wrong key cannot pass as a substring match.
Two things the role made necessary:
- `tasks/main.yml` opens with a block tagged `reset-hookshot-encryption`, and
Ansible runs tagged tasks unless tags are actually selected - so any tagless
play hits it, and it stops `matrix-hookshot.service` before that service
exists. The scenario skips the tag, which is what the playbook effectively
does by always running with `--tags=setup-all,start`.
- The role reads `matrix_host_command_openssl`, which matrix-base defines.
matrix-bridge-appservice-irc reads it too, so it goes in the shared playbook
context rather than into this scenario.
Falsified by pointing the webhooks listener at 127.0.0.1 in the role's config
template - a change no file-level assertion can see. Every config and
registration assertion still passed, and the run failed at "Assert the generic
webhooks service is mounted on that listener" with "Port 9741 did not answer as
Hookshot's generic webhooks service". Reverted afterwards.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SEH3vxYSQ5SV4N5z61eyGT
91 lines
3.8 KiB
YAML
91 lines
3.8 KiB
YAML
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
---
|
|
# The variables a role here reads from its surroundings rather than from its own
|
|
# defaults. In a real run `matrix-base` and `group_vars/matrix_servers` provide
|
|
# them; in a scenario they have to come from somewhere, and including
|
|
# `matrix-base` itself does far more than a role scenario needs.
|
|
#
|
|
# Include from a scenario's prepare.yml, converge.yml and verify.yml:
|
|
#
|
|
# vars_files:
|
|
# - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
|
|
#
|
|
# A scenario can override any of these in its own group_vars - that is the point
|
|
# of testing a role with values it would not have chosen for itself.
|
|
#
|
|
# Keep this to variables that come from OUTSIDE the role under test. Anything the
|
|
# role defines belongs in the scenario, not here.
|
|
|
|
# --- Identity and paths (matrix-base) --------------------------------------
|
|
|
|
matrix_base_data_path: /matrix
|
|
matrix_domain: molecule.local
|
|
|
|
matrix_user_name: matrix
|
|
matrix_group_name: matrix
|
|
|
|
# Deliberately not 1000: the base images already have a user there, so a distinct
|
|
# id is what proves a role used the one it was given rather than coinciding with
|
|
# the image's own.
|
|
matrix_user_uid: 1234
|
|
matrix_user_gid: 1234
|
|
|
|
# Empty in the playbook's own defaults too. Components that would invite an
|
|
# administrator into a room skip doing so when it is empty, which is what a
|
|
# scenario wants.
|
|
matrix_admin: ''
|
|
|
|
# --- Host commands (matrix-base) -------------------------------------------
|
|
#
|
|
# Some roles shell out to a host binary through this indirection instead of
|
|
# naming it directly (matrix-bridge-hookshot and matrix-bridge-appservice-irc
|
|
# both generate a key with it). matrix-base's defaults are what supplies the
|
|
# value in a real run; those roles install the binary themselves, by including
|
|
# matrix-base's `ensure_openssl_installed` tasks.
|
|
|
|
matrix_host_command_openssl: "/usr/bin/env openssl"
|
|
|
|
# --- Bridge-wide switches (matrix-base) ------------------------------------
|
|
#
|
|
# Every bridge role reads these, so they live here rather than in each bridge's
|
|
# scenario. The values match the playbook's own defaults: encryption off, no
|
|
# relay, no MSC4190. A bridge scenario that wants to prove one of these reaches
|
|
# the rendered configuration should override it in its own group_vars.
|
|
|
|
matrix_bridges_encryption_enabled: false
|
|
matrix_bridges_encryption_default: false
|
|
matrix_bridges_msc4190_enabled: false
|
|
matrix_bridges_self_sign_enabled: false
|
|
matrix_bridges_relay_enabled: false
|
|
|
|
matrix_bridges_exposure_enabled: true
|
|
matrix_bridges_exposure_hostname: molecule.local
|
|
matrix_bridges_exposure_path_prefix: /bridges
|
|
|
|
# --- Public hostnames (matrix-base) ----------------------------------------
|
|
#
|
|
# 18 of the roles here read one of these. Rendered against the scenario's
|
|
# matrix_domain rather than left as Jinja, so a scenario can read them in
|
|
# verify.yml without the role's defaults being in scope.
|
|
|
|
matrix_server_fqn_matrix: matrix.molecule.local
|
|
matrix_server_fqn_matrix_federation: matrix.molecule.local
|
|
matrix_server_fqn_element: element.molecule.local
|
|
matrix_server_fqn_hydrogen: hydrogen.molecule.local
|
|
matrix_server_fqn_cinny: cinny.molecule.local
|
|
matrix_server_fqn_sable: sable.molecule.local
|
|
matrix_server_fqn_schildichat: schildichat.molecule.local
|
|
matrix_server_fqn_fluffychat: fluffychat.molecule.local
|
|
matrix_server_fqn_buscarron: buscarron.molecule.local
|
|
matrix_server_fqn_etherpad: etherpad.molecule.local
|
|
matrix_server_fqn_jitsi: jitsi.molecule.local
|
|
matrix_server_fqn_grafana: stats.molecule.local
|
|
matrix_server_fqn_sygnal: sygnal.molecule.local
|
|
matrix_server_fqn_mautrix_wsproxy: wsproxy.molecule.local
|
|
matrix_server_fqn_ntfy: ntfy.molecule.local
|
|
matrix_server_fqn_rageshake: rageshake.molecule.local
|
|
matrix_server_fqn_matrixto: mt.molecule.local
|