matrix-docker-ansible-deploy/roles/custom/matrix-static-files/molecule/default/verify.yml

# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
#
# SPDX-License-Identifier: AGPL-3.0-or-later

---
- name: Verify matrix-static-files
  hosts: all
  become: true
  vars_files:
    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"
    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
  gather_facts: false

  tasks:
    # Load the shipped version independently of the scenario. A role version bump
    # therefore advances the expected image instead of comparing two test pins.
    - name: Load the role's defaults under a separate name
      ansible.builtin.include_vars:
        file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"
        name: matrix_static_files_role_defaults

    - name: Wait for the matrix-static-files service to become active
      ansible.builtin.systemd_service:
        name: matrix-static-files.service
      register: matrix_static_files_service
      until: matrix_static_files_service.status.ActiveState == 'active'
      retries: 30
      delay: 5
      failed_when: false

    # Restart=always means ActiveState alone stays green during a crash loop.
    - name: Assert the service is active and has not restarted
      ansible.builtin.assert:
        that:
          - matrix_static_files_service.status.ActiveState == 'active'
          - matrix_static_files_service.status.NRestarts is defined
          - matrix_static_files_service.status.NRestarts | int == 0
        fail_msg: >-
          matrix-static-files.service is
          {{ matrix_static_files_service.status.ActiveState | default('unknown') }}
          after {{ matrix_static_files_service.status.NRestarts | default('?') }} restart(s)
        success_msg: "matrix-static-files.service is active and has not restarted"

    # Probe over the private container network, matching how Traefik reaches the
    # service in a deployment. Every document is generated by a different role path.
    - name: Fetch the generated JSON documents from the running service
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_static_files_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --show-error
          - --write-out
          - "\nMOLECULE_HTTP_STATUS=%{http_code}"
          - "http://matrix-static-files:{{ matrix_static_files_environment_variable_server_port }}{{ item.path }}"
      loop:
        - name: client
          path: /.well-known/matrix/client
        - name: server
          path: /.well-known/matrix/server
        - name: support
          path: /.well-known/matrix/support
        - name: mautrix
          path: /.well-known/matrix/mautrix
      register: matrix_static_files_document_responses
      changed_when: false
      until: "'MOLECULE_HTTP_STATUS=200' in matrix_static_files_document_responses.stdout"
      retries: 24
      delay: 5
      failed_when: false

    - name: Assert every enabled generated document is served successfully
      ansible.builtin.assert:
        that:
          - "'MOLECULE_HTTP_STATUS=200' in item.stdout"
        fail_msg: >-
          {{ item.item.path }} was not served successfully
          ({{ item.stdout | default('no output') }})
        success_msg: "{{ item.item.path }} is served successfully"
      loop: "{{ matrix_static_files_document_responses.results }}"
      loop_control:
        label: "{{ item.item.name }}"

    - name: Initialize parsed served documents
      ansible.builtin.set_fact:
        matrix_static_files_served_documents: {}

    - name: Parse the served JSON documents
      ansible.builtin.set_fact:
        matrix_static_files_served_documents: >-
          {{
            matrix_static_files_served_documents
            | combine({item.item.name: item.stdout | regex_replace('\nMOLECULE_HTTP_STATUS=[0-9]+\s*$', '') | from_json})
          }}
      loop: "{{ matrix_static_files_document_responses.results }}"
      loop_control:
        label: "{{ item.item.name }}"

    # The default server port must be closed. Otherwise a response on the scenario's
    # port would not prove SERVER_PORT reached the process.
    - name: Probe static-web-server's default port
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_static_files_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --output
          - /dev/null
          - --write-out
          - "MOLECULE_HTTP_STATUS=%{http_code}"
          - --connect-timeout
          - "2"
          - http://matrix-static-files:8080/.well-known/matrix/client
      register: matrix_static_files_default_port_response
      changed_when: false
      failed_when: false

    - name: Assert static-web-server's default port is not listening
      ansible.builtin.assert:
        that:
          - "'MOLECULE_HTTP_STATUS=200' not in matrix_static_files_default_port_response.stdout"
        fail_msg: >-
          Port 8080 answered, so the live probe does not prove the non-default
          SERVER_PORT reached static-web-server
        success_msg: "Only the configured non-default internal port answers"

    - name: Read the generated JSON files from disk
      ansible.builtin.slurp:
        src: "{{ matrix_static_files_public_path }}/.well-known/matrix/{{ item }}"
      loop:
        - client
        - server
        - support
        - mautrix
      register: matrix_static_files_rendered_document_files

    - name: Initialize parsed rendered documents
      ansible.builtin.set_fact:
        matrix_static_files_rendered_documents: {}

    - name: Parse the generated JSON files
      ansible.builtin.set_fact:
        matrix_static_files_rendered_documents: >-
          {{
            matrix_static_files_rendered_documents
            | combine({item.item: item.content | b64decode | from_json})
          }}
      loop: "{{ matrix_static_files_rendered_document_files.results }}"
      loop_control:
        label: "{{ item.item }}"

    - name: Assert the running service exposes the exact documents the role generated
      ansible.builtin.assert:
        that:
          - matrix_static_files_served_documents[item] == matrix_static_files_rendered_documents[item]
        fail_msg: "The served {{ item }} document differs from the generated file"
        success_msg: "The served {{ item }} document is the generated file"
      loop:
        - client
        - server
        - support
        - mautrix

    - name: Assert the client document carries all configured discovery sections
      ansible.builtin.assert:
        that:
          - matrix_static_files_served_documents.client['m.homeserver'].base_url == 'https://homeserver.molecule.invalid'
          - matrix_static_files_served_documents.client['m.integrations'].managers[0].api_url == 'https://integrations.molecule.invalid/api'
          - matrix_static_files_served_documents.client['m.integrations'].managers[0].ui_url == 'https://integrations.molecule.invalid/ui'
          - matrix_static_files_served_documents.client['io.element.jitsi'].preferredDomain == 'jitsi.molecule.local'
          - matrix_static_files_served_documents.client['org.matrix.msc2965.authentication'].issuer == 'https://auth.molecule.invalid/'
          - matrix_static_files_served_documents.client['org.matrix.msc2965.authentication'].account == 'https://auth.molecule.invalid/account'
          - matrix_static_files_served_documents.client['org.matrix.msc3575.proxy'].url == 'https://sync.molecule.invalid'
          - matrix_static_files_served_documents.client['m.tile_server'].map_style_url == 'https://maps.molecule.invalid/style.json'
          - matrix_static_files_served_documents.client['io.element.e2ee'].default == false
          - matrix_static_files_served_documents.client['io.element.e2ee'].force_disable == true
          - matrix_static_files_served_documents.client['cc.etke.ketesa'].marker == 'ketesa-custom'
          - matrix_static_files_served_documents.client['org.matrix.msc4143.rtc_foci'][0].livekit_service_url == 'https://livekit.molecule.invalid'
        fail_msg: "The client document does not carry the configured discovery sections"
        success_msg: "The client document carries the configured discovery sections"

    - name: Assert recursive extension and omission behavior in the client document
      ansible.builtin.assert:
        that:
          - matrix_static_files_served_documents.client['m.homeserver'].molecule_extension_marker == 'recursive-merge-reached'
          - matrix_static_files_served_documents.client['org.example.molecule'].enabled == true
          - matrix_static_files_served_documents.client['org.example.molecule'].sequence == 42
          - "'m.identity_server' not in matrix_static_files_served_documents.client"
        fail_msg: "The client extension was not merged recursively or an omitted section leaked in"
        success_msg: "The client extension is merged recursively and disabled identity discovery is omitted"

    - name: Assert the server, support and mautrix documents carry configured data and extensions
      ansible.builtin.assert:
        that:
          - matrix_static_files_served_documents.server['m.server'] == 'federation.molecule.local:9448'
          - matrix_static_files_served_documents.server['org.example.molecule'] == 'server-extension-reached'
          - matrix_static_files_served_documents.support.contacts[0].matrix_id == '@support:molecule.local'
          - matrix_static_files_served_documents.support.contacts[0].role == 'm.role.admin'
          - matrix_static_files_served_documents.support.support_page == 'https://support.molecule.invalid'
          - matrix_static_files_served_documents.support['org.example.molecule'].channel == 'support-extension-reached'
          - matrix_static_files_served_documents.mautrix['fi.mau.bridges'] | length == 2
          - "'https://telegram.molecule.invalid' in matrix_static_files_served_documents.mautrix['fi.mau.bridges']"
          - matrix_static_files_served_documents.mautrix['fi.mau.external_bridge_servers'][0] == 'https://external-bridges.molecule.invalid'
          - matrix_static_files_served_documents.mautrix['org.example.molecule'] == 'mautrix-extension-reached'
        fail_msg: "One or more auxiliary documents lost configured data or extensions"
        success_msg: "Server, support and mautrix documents carry configured data and extensions"

    - name: Fetch response headers for every generated JSON document
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_static_files_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --show-error
          - --head
          - "http://matrix-static-files:{{ matrix_static_files_environment_variable_server_port }}/.well-known/matrix/{{ item }}"
      loop:
        - client
        - server
        - support
        - mautrix
      register: matrix_static_files_document_headers
      changed_when: false

    - name: Assert every generated JSON document carries the configured headers
      ansible.builtin.assert:
        that:
          - "'content-type: application/json' in item.stdout_lines"
          - "'access-control-allow-origin: *' in item.stdout_lines"
          - "'cache-control: max-age=25200' in item.stdout_lines"
        fail_msg: >-
          {{ item.item }} did not carry the configured JSON, CORS and cache headers:
          {{ item.stdout }}
        success_msg: "{{ item.item }} carries the configured JSON, CORS and cache headers"
      loop: "{{ matrix_static_files_document_headers.results }}"
      loop_control:
        label: "{{ item.item }}"

    - name: Fetch the generated base-domain index document
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_static_files_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --show-error
          - --write-out
          - "\nMOLECULE_HTTP_STATUS=%{http_code}"
          - "http://matrix-static-files:{{ matrix_static_files_environment_variable_server_port }}/"
      register: matrix_static_files_index_response
      changed_when: false

    - name: Assert the configured base-domain index is served
      ansible.builtin.assert:
        that:
          - "'MOLECULE_HTTP_STATUS=200' in matrix_static_files_index_response.stdout"
          - "'Molecule static-files index marker' in matrix_static_files_index_response.stdout"
        fail_msg: >-
          The configured base-domain index was not served
          ({{ matrix_static_files_index_response.stdout | default('no output') }})
        success_msg: "The configured base-domain index is served"

    - name: Parse the TOML configuration the role rendered
      ansible.builtin.command:
        argv:
          - python3
          - -c
          - >-
            import json, sys, tomllib;
            print(json.dumps(tomllib.load(open(sys.argv[1], 'rb'))))
          - "{{ matrix_static_files_config_path }}/config.toml"
      register: matrix_static_files_config_command
      changed_when: false

    - name: Assert the parsed server configuration carries the header contract
      ansible.builtin.assert:
        that:
          - matrix_static_files_config.advanced.headers[0].source == '/.well-known/matrix/*'
          - matrix_static_files_config.advanced.headers[0].headers['Content-Type'] == 'application/json'
          - matrix_static_files_config.advanced.headers[0].headers['Access-Control-Allow-Origin'] == '*'
          - matrix_static_files_config.advanced.headers[0].headers['Cache-Control'] == 'max-age=25200'
        fail_msg: "The parsed config.toml does not carry the configured header contract"
        success_msg: "The parsed config.toml carries the configured header contract"
      vars:
        matrix_static_files_config: "{{ matrix_static_files_config_command.stdout | from_json }}"

    - name: Read the environment file the role rendered
      ansible.builtin.slurp:
        src: "{{ matrix_static_files_base_path }}/env"
      register: matrix_static_files_env_file

    - name: Initialize the parsed environment
      ansible.builtin.set_fact:
        matrix_static_files_env_parsed: {}

    - name: Parse the rendered environment
      ansible.builtin.set_fact:
        matrix_static_files_env_parsed: >-
          {{ matrix_static_files_env_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }}
      loop: "{{ (matrix_static_files_env_file.content | b64decode).splitlines() | reject('equalto', '') }}"
      when: "'=' in item"
      no_log: true

    - name: Assert the rendered environment carries the scenario's settings
      ansible.builtin.assert:
        that:
          - matrix_static_files_env_parsed.SERVER_PORT == matrix_static_files_environment_variable_server_port | string
          - matrix_static_files_env_parsed.SERVER_LOG_LEVEL == 'debug'
          - matrix_static_files_env_parsed.SERVER_LOG_REMOTE_ADDRESS == 'true'
          - matrix_static_files_env_parsed.SERVER_IGNORE_HIDDEN_FILES == 'false'
          - matrix_static_files_env_parsed.MOLECULE_STATIC_FILES_MARKER == 'environment-reached'
        fail_msg: "The parsed environment file does not carry the scenario's settings"
        success_msg: "The parsed environment file carries the scenario's settings"

    - name: Read the labels file the role rendered
      ansible.builtin.slurp:
        src: "{{ matrix_static_files_base_path }}/labels"
      register: matrix_static_files_labels_file

    - name: Initialize the parsed labels
      ansible.builtin.set_fact:
        matrix_static_files_labels_parsed: {}

    - name: Parse the rendered labels
      ansible.builtin.set_fact:
        matrix_static_files_labels_parsed: >-
          {{ matrix_static_files_labels_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }}
      loop: "{{ (matrix_static_files_labels_file.content | b64decode).splitlines() | reject('equalto', '') }}"
      when:
        - "'=' in item"
        - not item.startswith('#')
      no_log: true

    - name: Assert the rendered labels carry both routing contracts
      ansible.builtin.assert:
        that:
          - matrix_static_files_labels_parsed['traefik.enable'] == 'true'
          - matrix_static_files_labels_parsed['traefik.docker.network'] == matrix_static_files_container_network
          - matrix_static_files_labels_parsed['traefik.http.services.matrix-static-files.loadbalancer.server.port'] == matrix_static_files_environment_variable_server_port | string
          - "'Host(`matrix-well-known.molecule.local`)' in matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.rule']"
          - "'PathPrefix(`/molecule-well-known`)' in matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.rule']"
          - matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.priority'] == '67'
          - matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.entrypoints'] == 'web'
          - matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.tls'] == 'false'
          - matrix_static_files_labels_parsed['traefik.http.middlewares.matrix-static-files-well-known-matrix-compress.compress.minResponseBodyBytes'] == '321'
          - "'Host(`base.molecule.local`)' in matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-base-domain.rule']"
          - "'PathPrefix(`/molecule-base`)' in matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-base-domain.rule']"
          - matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-base-domain.priority'] == '43'
          - matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-base-domain.tls'] == 'false'
          - matrix_static_files_labels_parsed['molecule.scenario'] == 'matrix-static-files'
        fail_msg: "The rendered labels do not carry both routing contracts"
        success_msg: "The rendered labels carry both routing contracts"

    - name: Inspect the running matrix-static-files container
      ansible.builtin.command:
        argv:
          - docker
          - container
          - inspect
          - matrix-static-files
      register: matrix_static_files_container_inspect_command
      changed_when: false

    - name: Parse the running container inspection
      ansible.builtin.set_fact:
        matrix_static_files_container: "{{ (matrix_static_files_container_inspect_command.stdout | from_json)[0] }}"

    - name: Assert the configured environment reached the running container
      ansible.builtin.assert:
        that:
          - "('SERVER_PORT=' ~ (matrix_static_files_environment_variable_server_port | string)) in matrix_static_files_container.Config.Env"
          - "'SERVER_LOG_LEVEL=debug' in matrix_static_files_container.Config.Env"
          - "'SERVER_LOG_REMOTE_ADDRESS=true' in matrix_static_files_container.Config.Env"
          - "'SERVER_IGNORE_HIDDEN_FILES=false' in matrix_static_files_container.Config.Env"
          - "'MOLECULE_STATIC_FILES_MARKER=environment-reached' in matrix_static_files_container.Config.Env"
        fail_msg: "The running container environment does not carry the scenario's settings"
        success_msg: "The configured environment reached the running container"

    - name: Assert the rendered labels reached the running container
      ansible.builtin.assert:
        that:
          - matrix_static_files_container.Config.Labels['traefik.enable'] == 'true'
          - matrix_static_files_container.Config.Labels['traefik.docker.network'] == matrix_static_files_container_network
          - matrix_static_files_container.Config.Labels['traefik.http.services.matrix-static-files.loadbalancer.server.port'] == matrix_static_files_environment_variable_server_port | string
          - matrix_static_files_container.Config.Labels['traefik.http.routers.matrix-static-files-well-known-matrix.priority'] == '67'
          - matrix_static_files_container.Config.Labels['traefik.http.routers.matrix-static-files-base-domain.priority'] == '43'
          - matrix_static_files_container.Config.Labels['molecule.scenario'] == 'matrix-static-files'
        fail_msg: "The running container does not carry the labels the role rendered"
        success_msg: "The rendered labels reached the running container"

    - name: Assert the running container uses the exact image and version the role pins
      ansible.builtin.assert:
        that:
          - matrix_static_files_container.Config.Image == matrix_static_files_expected_image
        fail_msg: >-
          The running container uses {{ matrix_static_files_container.Config.Image }},
          expected {{ matrix_static_files_expected_image }}
        success_msg: "The running container uses the exact image and version defaults/main.yml pins"
      vars:
        matrix_static_files_expected_tag: >-
          {{
            'latest'
            if matrix_static_files_role_defaults.matrix_static_files_version == 'latest'
            else matrix_static_files_role_defaults.matrix_static_files_version ~ '-alpine'
          }}
        matrix_static_files_expected_image: >-
          {{ matrix_static_files_role_defaults.matrix_static_files_container_image_registry_prefix_upstream_default }}joseluisq/static-web-server:{{ matrix_static_files_expected_tag }}

    - name: Assert the running container uses the configured UID and GID
      ansible.builtin.assert:
        that:
          - matrix_static_files_container.Config.User == (matrix_user_uid | string) ~ ':' ~ (matrix_user_gid | string)
        fail_msg: >-
          The running container uses {{ matrix_static_files_container.Config.User }},
          expected {{ matrix_user_uid }}:{{ matrix_user_gid }}
        success_msg: "The running container uses the configured UID and GID"

    - name: Assert the running container has a read-only root filesystem
      ansible.builtin.assert:
        that:
          - matrix_static_files_container.HostConfig.ReadonlyRootfs == true
        fail_msg: "The running container's root filesystem is writable"
        success_msg: "The running container has a read-only root filesystem"

    - name: Assert the running container drops all capabilities and adds none
      ansible.builtin.assert:
        that:
          - matrix_static_files_container.HostConfig.CapDrop == ['ALL']
          - matrix_static_files_container.HostConfig.CapAdd | default([], true) | length == 0
        fail_msg: "The running container does not have the expected capability restrictions"
        success_msg: "The running container drops all capabilities and adds none"

    - name: Assert both bind mounts are read-only
      ansible.builtin.assert:
        that:
          - matrix_static_files_container.Mounts | selectattr('Destination', 'equalto', '/var/public') | list | length == 1
          - (matrix_static_files_container.Mounts | selectattr('Destination', 'equalto', '/var/public') | first).RW == false
          - matrix_static_files_container.Mounts | selectattr('Destination', 'equalto', '/config') | list | length == 1
          - (matrix_static_files_container.Mounts | selectattr('Destination', 'equalto', '/config') | first).RW == false
        fail_msg: "The running container is missing a read-only content or configuration mount"
        success_msg: "Both bind mounts are present and read-only"

    - name: Assert the running container is attached only to its dedicated network
      ansible.builtin.assert:
        that:
          - matrix_static_files_container.NetworkSettings.Networks.keys() | list | length == 1
          - matrix_static_files_container_network in matrix_static_files_container.NetworkSettings.Networks
        fail_msg: >-
          The running container is attached to unexpected networks:
          {{ matrix_static_files_container.NetworkSettings.Networks.keys() | list }}
        success_msg: "The running container is attached only to its dedicated network"

    - name: Assert the running container publishes no host ports
      ansible.builtin.assert:
        that:
          - matrix_static_files_container.HostConfig.PortBindings | default({}, true) | length == 0
        fail_msg: "The running container unexpectedly publishes a host port"
        success_msg: "The running container publishes no host ports"