From 61cd97c10571f2705234b6f14ed7d9e64178f3c1 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sat, 29 Aug 2026 16:45:23 +0300 Subject: [PATCH] Test matrix-bot-draupnir with Molecule --- .github/renovate.json | 1 + molecule-shared/homeserver-stub.py | 30 +- molecule-shared/tasks/homeserver-stub.yml | 3 + .../molecule/default/converge.yml | 37 +++ .../molecule/default/molecule.yml | 110 +++++++ .../molecule/default/prepare.yml | 119 +++++++ .../molecule/default/requirements.yml | 1 + .../molecule/default/verify.yml | 298 ++++++++++++++++++ 8 files changed, 596 insertions(+), 3 deletions(-) create mode 100644 roles/custom/matrix-bot-draupnir/molecule/default/converge.yml create mode 100644 roles/custom/matrix-bot-draupnir/molecule/default/molecule.yml create mode 100644 roles/custom/matrix-bot-draupnir/molecule/default/prepare.yml create mode 120000 roles/custom/matrix-bot-draupnir/molecule/default/requirements.yml create mode 100644 roles/custom/matrix-bot-draupnir/molecule/default/verify.yml diff --git a/.github/renovate.json b/.github/renovate.json index 0aedfd55e..bdcb28405 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -85,6 +85,7 @@ "matchFileNames": [ "roles/custom/matrix-alertmanager-receiver/defaults/main.yml", "roles/custom/matrix-bot-baibot/defaults/main.yml", + "roles/custom/matrix-bot-draupnir/defaults/main.yml", "roles/custom/matrix-bot-maubot/defaults/main.yml", "roles/custom/matrix-bot-matrix-reminder-bot/defaults/main.yml", "roles/custom/matrix-bridge-heisenbridge/defaults/main.yml", diff --git a/molecule-shared/homeserver-stub.py b/molecule-shared/homeserver-stub.py index 635339191..16477e048 100644 --- a/molecule-shared/homeserver-stub.py +++ b/molecule-shared/homeserver-stub.py @@ -14,8 +14,8 @@ a 200 rather than a 404, because the goal is to get the component past its start What it is NOT: an authentication check, a room state machine, or anything a scenario should assert *about*. Assert on what the role rendered and what the component reports about itself. -A scenario that needs this stub to behave like a real homeserver has outgrown what these -tests are for. +Scenarios may supply a small static room-state fixture when startup requires it, but the stub +does not model state changes. """ import json @@ -24,7 +24,7 @@ import re import sys import time from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer -from urllib.parse import parse_qs, urlparse +from urllib.parse import parse_qs, unquote, urlparse SERVER_NAME = os.environ.get("STUB_SERVER_NAME", "molecule.local") PORT = int(os.environ.get("STUB_PORT", "8008")) @@ -35,6 +35,7 @@ PORT = int(os.environ.get("STUB_PORT", "8008")) JOINED_ROOMS = [r for r in os.environ.get("STUB_JOINED_ROOMS", "").split(",") if r] USER_ID = os.environ.get("STUB_USER_ID", f"@stub:{SERVER_NAME}") +ROOM_STATE = json.loads(os.environ.get("STUB_ROOM_STATE", "[]")) # Longest a /sync call is held open. Long-polling clients ask for a 30s timeout and # immediately ask again when the call returns, so answering instantly spins them into a hot @@ -120,6 +121,10 @@ class Handler(BaseHTTPRequestHandler): if path.endswith("/createRoom"): return {"room_id": f"!stub-room:{SERVER_NAME}"} + join_match = re.search(r"/join/([^/]+)$", path) + if join_match: + return {"room_id": unquote(join_match.group(1))} + if re.search(r"/rooms/[^/]+/join$", path) or path.endswith("/join"): return {"room_id": f"!stub-room:{SERVER_NAME}"} @@ -154,6 +159,25 @@ class Handler(BaseHTTPRequestHandler): return {} def do_GET(self): + path = urlparse(self.path).path + + if ROOM_STATE: + if re.search(r"/rooms/[^/]+/state$", path): + self._send(ROOM_STATE) + return + + if "/account_data/" in path or re.search( + r"/rooms/[^/]+/state/[^/]+(?:/[^/]+)?$", path + ): + self._send( + { + "errcode": "M_NOT_FOUND", + "error": "Molecule stub state not found", + }, + status=404, + ) + return + self._send(self._route()) def do_POST(self): diff --git a/molecule-shared/tasks/homeserver-stub.yml b/molecule-shared/tasks/homeserver-stub.yml index 118d3f744..03d4dc063 100644 --- a/molecule-shared/tasks/homeserver-stub.yml +++ b/molecule-shared/tasks/homeserver-stub.yml @@ -53,6 +53,9 @@ # the bot user they were configured as, so a scenario bridging anything has to tell # the stub who it should claim to be. - --env=STUB_USER_ID={{ molecule_shared_stub_user_id | default('@stub:' + (molecule_shared_stub_server_name | default('molecule.local'))) }} + # Some components need to inspect an existing management room before they can start. + # This optional static fixture does not attempt to model subsequent state changes. + - --env=STUB_ROOM_STATE={{ (molecule_shared_stub_room_state | default([])) | to_json }} # Set molecule_shared_stub_verbose to "1" to log every request the stub is asked for. # How you find out why a component will not start, and for a component with no port of # its own, the only place to observe it acting on what the role configured. diff --git a/roles/custom/matrix-bot-draupnir/molecule/default/converge.yml b/roles/custom/matrix-bot-draupnir/molecule/default/converge.yml new file mode 100644 index 000000000..2654c9e8c --- /dev/null +++ b/roles/custom/matrix-bot-draupnir/molecule/default/converge.yml @@ -0,0 +1,37 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +- name: Include roles for matrix-bot-draupnir Molecule tests + hosts: all + become: true + vars_files: + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml" + gather_facts: true + tasks: + - name: Include roles for matrix-bot-draupnir Molecule tests + ansible.builtin.include_role: + name: "{{ role_name }}" + public: true + loop: + - com.devture.ansible.role.playbook_help + - com.devture.ansible.role.systemd_docker_base + - "custom/{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}" + loop_control: + loop_var: role_name + +# Component roles install their unit; the complete playbook's service manager starts it. +- name: Ensure matrix-bot-draupnir is started + hosts: all + become: true + gather_facts: false + tasks: + - name: Ensure systemd daemon is reloaded + ansible.builtin.systemd_service: + daemon_reload: true + + - name: Ensure matrix-bot-draupnir systemd service is started + ansible.builtin.systemd_service: + name: matrix-bot-draupnir.service + state: started diff --git a/roles/custom/matrix-bot-draupnir/molecule/default/molecule.yml b/roles/custom/matrix-bot-draupnir/molecule/default/molecule.yml new file mode 100644 index 000000000..bb1e26ad9 --- /dev/null +++ b/roles/custom/matrix-bot-draupnir/molecule/default/molecule.yml @@ -0,0 +1,110 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +dependency: + name: galaxy + options: + requirements-file: requirements.yml + force: true +driver: + name: docker +platforms: + - name: matrix-bot-draupnir-${MOLECULE_DISTRO:-ubuntu2604}-default + image: "geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2604}-ansible:latest" + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + pre_build_image: true +provisioner: + name: ansible + config_options: + defaults: + callback_result_format: yaml + inventory: + group_vars: + all: + matrix_bot_draupnir_container_network: matrix-bot-draupnir-molecule + + # verify.yml is a separate play where the role's defaults are out of scope. Pin + # only paths it reads; the component version is loaded from defaults/main.yml. + matrix_bot_draupnir_base_path: /matrix/draupnir + matrix_bot_draupnir_config_path: /matrix/draupnir/config + matrix_bot_draupnir_data_path: /matrix/draupnir/data + + # Full-playbook context supplies the companion role's switch. It is deliberately + # absent here: this scenario tests the standalone bot, not the appservice variant. + matrix_appservice_draupnir_for_all_enabled: false + + # A local homeserver stub accepts this fake token. No real Matrix or third-party + # account is involved. The pre-existing room avoids zero-touch room creation. + matrix_bot_draupnir_config_accessToken: molecule_draupnir_access_token_48c1e7 + matrix_bot_draupnir_config_homeserverUrl: http://matrix.molecule.local:8008 + matrix_bot_draupnir_config_rawHomeserverUrl: http://matrix.molecule.local:8008 + matrix_bot_draupnir_config_managementRoom: "!draupnir-control:molecule.local" + matrix_bot_draupnir_zero_touch_deploy: false + matrix_bot_draupnir_pantalaimon_use: false + matrix_bot_draupnir_login_native: false + matrix_bot_draupnir_config_experimentalRustCrypto: false + + # Values differ from both role and upstream defaults. The extension also disables + # recovery safe mode: otherwise Draupnir can become healthy after a recoverable + # bootstrap failure without entering its normal moderation mode. + matrix_bot_draupnir_config_disableServerACL: true + matrix_bot_draupnir_config_roomStateBackingStore_enabled: false + matrix_bot_draupnir_config_web_abuseReporting: true + matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled: false + matrix_bot_draupnir_config_web_port: 18082 + matrix_bot_draupnir_config_displayReports: false + matrix_bot_draupnir_configuration_extension_yaml: | + logLevel: DEBUG + verifyPermissionsOnStartup: false + noop: true + backgroundDelayMS: 137 + commands: + allowNoPrefix: true + safeMode: + bootOption: Never + health: + healthz: + enabled: true + port: 18081 + address: 0.0.0.0 + endpoint: /molecule-ready + healthyStatus: 201 + unhealthyStatus: 503 + + # Traefik itself is not deployed. The role still renders these labels and Docker + # consumes them, proving the public-report routing contract and the derived network. + matrix_bot_draupnir_container_labels_traefik_enabled: true + matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_hostname: draupnir-reports.molecule.local + matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_path_regexp: ^/molecule-report/(v1)/rooms/([^/]*)/event/(.*)$$ + matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_priority: 743 + matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_entrypoints: web + matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_tls: false + matrix_bot_draupnir_container_labels_traefik_labels_additional_labels: | + molecule.draupnir.coverage=enabled + + # Match the production-like no-host-port path; probes join the Docker network. + matrix_bot_draupnir_container_http_host_bind_port: '' + env: + # Workaround for https://github.com/ansible/molecule/issues/4391 + ANSIBLE_ROLES_PATH: ${MOLECULE_PROJECT_DIRECTORY}/../..:/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:${ANSIBLE_HOME:-~/.ansible}/roles +scenario: + test_sequence: + - dependency + - cleanup + - destroy + - syntax + - create + - prepare + - converge + - idempotence + - verify + - cleanup + - destroy +verifier: + name: ansible diff --git a/roles/custom/matrix-bot-draupnir/molecule/default/prepare.yml b/roles/custom/matrix-bot-draupnir/molecule/default/prepare.yml new file mode 100644 index 000000000..771a8eeee --- /dev/null +++ b/roles/custom/matrix-bot-draupnir/molecule/default/prepare.yml @@ -0,0 +1,119 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +- name: Prepare matrix-bot-draupnir Molecule tests + hosts: all + become: true + vars_files: + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml" + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml" + gather_facts: true + tasks: + - name: Ensure apt cache is updated + ansible.builtin.apt: + update_cache: true + cache_valid_time: 600 + when: ansible_facts['os_family'] == 'Debian' + + - name: Ensure required packages are installed + ansible.builtin.package: + name: + - python3-requests + - fuse-overlayfs + state: present + + - name: Ensure Docker is installed + ansible.builtin.include_role: + name: ansible-role-docker + vars: + docker_daemon_options: + storage-driver: fuse-overlayfs + + # matrix-base creates this identity in the complete playbook. The component role's file + # tasks resolve owner/group by name, so the role-scoped scenario supplies that side effect. + - name: Ensure the matrix group exists + ansible.builtin.group: + name: "{{ matrix_group_name }}" + gid: "{{ matrix_user_gid }}" + state: present + + - name: Ensure the matrix user exists + ansible.builtin.user: + name: "{{ matrix_user_name }}" + uid: "{{ matrix_user_uid }}" + group: "{{ matrix_group_name }}" + create_home: false + system: true + state: present + + - name: Ensure the base data path exists + ansible.builtin.file: + path: "{{ matrix_base_data_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + mode: "0750" + + # Draupnir and the stub need the network before the role's converge creates it. + - name: Ensure the container network the role attaches to exists + ansible.builtin.command: + argv: + - docker + - network + - create + - "{{ matrix_bot_draupnir_container_network }}" + register: matrix_bot_draupnir_molecule_network + changed_when: matrix_bot_draupnir_molecule_network.rc == 0 + failed_when: + - matrix_bot_draupnir_molecule_network.rc != 0 + - "'already exists' not in matrix_bot_draupnir_molecule_network.stderr" + + # The bot must see itself joined to an existing management room. The create, member and + # power-level events are the minimum state Draupnir needs to validate that room and prove + # its own user can send state. No real homeserver or account is involved. + - name: Ensure the homeserver stub is running with Draupnir management-room state + ansible.builtin.include_tasks: + file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/tasks/homeserver-stub.yml" + vars: + molecule_shared_stub_network: "{{ matrix_bot_draupnir_container_network }}" + molecule_shared_stub_user_id: "@draupnir:molecule.local" + molecule_shared_stub_joined_rooms: + - "{{ matrix_bot_draupnir_config_managementRoom }}" + molecule_shared_stub_verbose: "1" + molecule_shared_stub_room_state: + - type: m.room.create + state_key: '' + room_id: "{{ matrix_bot_draupnir_config_managementRoom }}" + sender: "@draupnir:molecule.local" + event_id: "$molecule-create" + origin_server_ts: 1 + content: + creator: "@draupnir:molecule.local" + room_version: "10" + - type: m.room.member + state_key: "@draupnir:molecule.local" + room_id: "{{ matrix_bot_draupnir_config_managementRoom }}" + sender: "@draupnir:molecule.local" + event_id: "$molecule-member" + origin_server_ts: 2 + content: + displayname: Molecule Draupnir + membership: join + - type: m.room.power_levels + state_key: '' + room_id: "{{ matrix_bot_draupnir_config_managementRoom }}" + sender: "@draupnir:molecule.local" + event_id: "$molecule-power" + origin_server_ts: 3 + content: + ban: 50 + events_default: 0 + invite: 50 + kick: 50 + redact: 50 + state_default: 50 + users: + "@draupnir:molecule.local": 100 + users_default: 0 diff --git a/roles/custom/matrix-bot-draupnir/molecule/default/requirements.yml b/roles/custom/matrix-bot-draupnir/molecule/default/requirements.yml new file mode 120000 index 000000000..1567a5392 --- /dev/null +++ b/roles/custom/matrix-bot-draupnir/molecule/default/requirements.yml @@ -0,0 +1 @@ +../../../../../molecule-shared/requirements.yml \ No newline at end of file diff --git a/roles/custom/matrix-bot-draupnir/molecule/default/verify.yml b/roles/custom/matrix-bot-draupnir/molecule/default/verify.yml new file mode 100644 index 000000000..258f429b7 --- /dev/null +++ b/roles/custom/matrix-bot-draupnir/molecule/default/verify.yml @@ -0,0 +1,298 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +# Health with safe mode disabled is the main readiness gate. Stub request evidence closes +# Draupnir's remaining blind spot: its health turns green after launching, but not awaiting, +# the SDK's first sync request. +- name: Verify matrix-bot-draupnir + hosts: all + become: true + vars_files: + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml" + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml" + vars: + matrix_bot_draupnir_rendered_config: "{{ matrix_bot_draupnir_config_file.content | b64decode | from_yaml }}" + matrix_bot_draupnir_labels_lines: "{{ (matrix_bot_draupnir_labels_file.content | b64decode).splitlines() }}" + matrix_bot_draupnir_runtime: "{{ (matrix_bot_draupnir_container_inspect.stdout | from_json) | first }}" + matrix_bot_draupnir_config_mounts: "{{ matrix_bot_draupnir_runtime.Mounts | selectattr('Destination', 'equalto', '/data/config') | list }}" + matrix_bot_draupnir_data_mounts: "{{ matrix_bot_draupnir_runtime.Mounts | selectattr('Destination', 'equalto', '/data') | list }}" + gather_facts: false + + tasks: + # Read the pin from the role rather than defining it in the scenario, so an image bump + # changes the expected value and exercises the newly shipped image. + - name: Load the role's defaults under a separate name + ansible.builtin.include_vars: + file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml" + name: matrix_bot_draupnir_role_defaults + + - name: Wait for the matrix-bot-draupnir service to become active + ansible.builtin.systemd_service: + name: matrix-bot-draupnir.service + register: matrix_bot_draupnir_service + until: matrix_bot_draupnir_service.status.ActiveState == 'active' + retries: 30 + delay: 5 + failed_when: false + + # Restart=always makes ActiveState alone insufficient for a crash-looping bot. + - name: Assert the service is active and has not restarted + ansible.builtin.assert: + that: + - matrix_bot_draupnir_service.status.ActiveState == 'active' + - matrix_bot_draupnir_service.status.NRestarts is defined + - matrix_bot_draupnir_service.status.NRestarts | int == 0 + fail_msg: >- + matrix-bot-draupnir.service is + {{ matrix_bot_draupnir_service.status.ActiveState | default('unknown') }} after + {{ matrix_bot_draupnir_service.status.NRestarts | default('?') }} restart(s) + success_msg: "matrix-bot-draupnir.service is active and has not restarted" + + # Probe over the role's own network. The non-default port and status are only reachable + # after normal-mode bootstrap because the scenario explicitly disables recovery safe mode. + - name: Wait for Draupnir to report healthy on the configured port + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_bot_draupnir_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --show-error + - --output + - /dev/null + - --write-out + - "HTTP_STATUS=%{http_code}" + - http://matrix-bot-draupnir:18081/molecule-ready + register: matrix_bot_draupnir_health + changed_when: false + until: matrix_bot_draupnir_health.stdout == 'HTTP_STATUS=201' + retries: 24 + delay: 5 + failed_when: false + + - name: Assert Draupnir reached its normal-mode health gate + ansible.builtin.assert: + that: + - matrix_bot_draupnir_health.rc == 0 + - matrix_bot_draupnir_health.stdout == 'HTTP_STATUS=201' + fail_msg: >- + Draupnir did not report the configured healthy status on port 18081 + (rc={{ matrix_bot_draupnir_health.rc }}, response={{ matrix_bot_draupnir_health.stdout | default('none') }}) + success_msg: "Draupnir reports healthy with the scenario's non-default status" + + - name: Wait for Draupnir to request an initial sync from the homeserver stub + ansible.builtin.command: + argv: + - docker + - logs + - matrix-homeserver-stub + register: matrix_bot_draupnir_stub_logs + changed_when: false + until: "'/sync?' in matrix_bot_draupnir_stub_logs.stderr or '/sync?' in matrix_bot_draupnir_stub_logs.stdout" + retries: 12 + delay: 5 + failed_when: false + + # These are observations of Draupnir's outbound bootstrap, not claims about the stub. + - name: Assert Draupnir completed its Matrix identity and management-room bootstrap + ansible.builtin.assert: + that: + - "'/account/whoami' in matrix_bot_draupnir_stub_request_log" + - "'/joined_rooms' in matrix_bot_draupnir_stub_request_log" + - "'/rooms/!draupnir-control%3Amolecule.local/state' in matrix_bot_draupnir_stub_request_log" + fail_msg: "Draupnir did not perform all expected Matrix bootstrap requests" + success_msg: "Draupnir performed its identity and management-room bootstrap" + vars: + matrix_bot_draupnir_stub_request_log: "{{ matrix_bot_draupnir_stub_logs.stdout + matrix_bot_draupnir_stub_logs.stderr }}" + + - name: Assert Draupnir entered the Matrix sync loop + ansible.builtin.assert: + that: + - "'/sync?' in matrix_bot_draupnir_stub_request_log" + fail_msg: "Draupnir became healthy without requesting an initial Matrix sync" + success_msg: "Draupnir requested its initial Matrix sync" + vars: + matrix_bot_draupnir_stub_request_log: "{{ matrix_bot_draupnir_stub_logs.stdout + matrix_bot_draupnir_stub_logs.stderr }}" + + - name: Read the configuration file the role rendered + ansible.builtin.slurp: + src: "{{ matrix_bot_draupnir_config_path }}/production.yaml" + register: matrix_bot_draupnir_config_file + + - name: Assert the rendered Matrix connection and management-room configuration + ansible.builtin.assert: + that: + - matrix_bot_draupnir_rendered_config.homeserverUrl == matrix_bot_draupnir_config_homeserverUrl + - matrix_bot_draupnir_rendered_config.rawHomeserverUrl == matrix_bot_draupnir_config_rawHomeserverUrl + - matrix_bot_draupnir_rendered_config.accessToken == matrix_bot_draupnir_config_accessToken + - matrix_bot_draupnir_rendered_config.managementRoom == matrix_bot_draupnir_config_managementRoom + - matrix_bot_draupnir_rendered_config.experimentalRustCrypto is sameas false + - matrix_bot_draupnir_rendered_config.pantalaimon is not defined + fail_msg: "The rendered configuration does not carry the scenario's Matrix connection" + success_msg: "The rendered configuration carries the scenario's Matrix connection" + + - name: Assert the rendered bootstrap and moderation behavior + ansible.builtin.assert: + that: + - matrix_bot_draupnir_rendered_config.logLevel == 'DEBUG' + - matrix_bot_draupnir_rendered_config.verifyPermissionsOnStartup is sameas false + - matrix_bot_draupnir_rendered_config.noop is sameas true + - matrix_bot_draupnir_rendered_config.disableServerACL is sameas true + - matrix_bot_draupnir_rendered_config.backgroundDelayMS == 137 + - matrix_bot_draupnir_rendered_config.commands.allowNoPrefix is sameas true + - matrix_bot_draupnir_rendered_config.roomStateBackingStore.enabled is sameas false + fail_msg: "The rendered configuration does not carry the non-default Draupnir behavior" + success_msg: "The rendered configuration carries the non-default Draupnir behavior" + + - name: Assert recovery safe mode is disabled in the rendered configuration + ansible.builtin.assert: + that: + - matrix_bot_draupnir_rendered_config.safeMode.bootOption == 'Never' + fail_msg: "Recovery safe mode could mask a failed normal Draupnir bootstrap" + success_msg: "Recovery safe mode cannot mask the scenario's readiness gate" + + - name: Assert the rendered health listener configuration + ansible.builtin.assert: + that: + - matrix_bot_draupnir_rendered_config.health.healthz.enabled is sameas true + - matrix_bot_draupnir_rendered_config.health.healthz.port == 18081 + - matrix_bot_draupnir_rendered_config.health.healthz.address == '0.0.0.0' + - matrix_bot_draupnir_rendered_config.health.healthz.endpoint == '/molecule-ready' + - matrix_bot_draupnir_rendered_config.health.healthz.healthyStatus == 201 + - matrix_bot_draupnir_rendered_config.health.healthz.unhealthyStatus == 503 + fail_msg: "The rendered health listener does not carry the scenario's settings" + success_msg: "The rendered health listener carries the scenario's settings" + + - name: Assert the rendered abuse-reporting web listener configuration + ansible.builtin.assert: + that: + - matrix_bot_draupnir_rendered_config.web.enabled is sameas true + - matrix_bot_draupnir_rendered_config.web.port == matrix_bot_draupnir_config_web_port + - matrix_bot_draupnir_rendered_config.web.address == '0.0.0.0' + - matrix_bot_draupnir_rendered_config.web.abuseReporting.enabled is sameas true + - matrix_bot_draupnir_rendered_config.web.synapseHTTPAntispam.enabled is sameas false + - matrix_bot_draupnir_rendered_config.displayReports is sameas false + fail_msg: "The rendered web configuration does not carry the abuse-reporting settings" + success_msg: "The rendered web listener carries the abuse-reporting settings" + + - name: Read the labels the role rendered + ansible.builtin.slurp: + src: "{{ matrix_bot_draupnir_base_path }}/labels" + register: matrix_bot_draupnir_labels_file + + - name: Assert the labels carry the configured public report routing + ansible.builtin.assert: + that: + - "'traefik.enable=true' in matrix_bot_draupnir_labels_lines" + - "'traefik.docker.network=' + matrix_bot_draupnir_container_network in matrix_bot_draupnir_labels_lines" + - "'traefik.http.services.matrix-bot-draupnir.loadbalancer.server.port=18082' in matrix_bot_draupnir_labels_lines" + - "'traefik.http.routers.matrix-bot-draupnir-web-abuseReporting.rule=Host(`draupnir-reports.molecule.local`) && PathRegexp(`^/molecule-report/(v1)/rooms/([^/]*)/event/(.*)$`)' in matrix_bot_draupnir_labels_lines" + - "'traefik.http.routers.matrix-bot-draupnir-web-abuseReporting.priority=743' in matrix_bot_draupnir_labels_lines" + - "'traefik.http.routers.matrix-bot-draupnir-web-abuseReporting.entrypoints=web' in matrix_bot_draupnir_labels_lines" + - "'traefik.http.routers.matrix-bot-draupnir-web-abuseReporting.tls=false' in matrix_bot_draupnir_labels_lines" + - "'molecule.draupnir.coverage=enabled' in matrix_bot_draupnir_labels_lines" + fail_msg: "The role's label file does not carry the scenario's public report routing" + success_msg: "The role's label file carries the scenario's public report routing" + + - name: Inspect the running Draupnir container + ansible.builtin.command: + argv: + - docker + - container + - inspect + - matrix-bot-draupnir + register: matrix_bot_draupnir_container_inspect + changed_when: false + + - name: Assert the running container uses the exact image pinned by the role + ansible.builtin.assert: + that: + - matrix_bot_draupnir_runtime.Config.Image == 'ghcr.io/the-draupnir-project/draupnir:' + matrix_bot_draupnir_role_defaults.matrix_bot_draupnir_version + fail_msg: "The running Draupnir container does not use the role's exact image pin" + success_msg: "The running Draupnir container uses the role's exact image pin" + + - name: Assert the running container uses the playbook-supplied identity + ansible.builtin.assert: + that: + - matrix_bot_draupnir_runtime.Config.User.split(':')[0] == matrix_user_uid | string + - matrix_bot_draupnir_runtime.Config.User.split(':')[1] == matrix_user_gid | string + fail_msg: >- + Draupnir runs as {{ matrix_bot_draupnir_runtime.Config.User }} instead of + {{ matrix_user_uid }}:{{ matrix_user_gid }} + success_msg: "The running container uses the playbook-supplied UID and GID" + + - name: Assert the container drops all Linux capabilities + ansible.builtin.assert: + that: + - matrix_bot_draupnir_runtime.HostConfig.CapDrop is sequence + - "'ALL' in matrix_bot_draupnir_runtime.HostConfig.CapDrop" + fail_msg: "The Draupnir container does not drop all Linux capabilities" + success_msg: "The Draupnir container drops all Linux capabilities" + + - name: Assert the container root filesystem is read-only + ansible.builtin.assert: + that: + - matrix_bot_draupnir_runtime.HostConfig.ReadonlyRootfs is sameas true + fail_msg: "The Draupnir container root filesystem is writable" + success_msg: "The Draupnir container root filesystem is read-only" + + - name: Assert the configuration bind mount is read-only + ansible.builtin.assert: + that: + - matrix_bot_draupnir_config_mounts | length == 1 + - matrix_bot_draupnir_config_mounts[0].RW is sameas false + fail_msg: "The Draupnir configuration bind mount is missing or writable" + success_msg: "The Draupnir configuration bind mount is present and read-only" + + - name: Assert the data bind mount is writable + ansible.builtin.assert: + that: + - matrix_bot_draupnir_data_mounts | length == 1 + - matrix_bot_draupnir_data_mounts[0].RW is sameas true + fail_msg: "The Draupnir data bind mount is missing or read-only" + success_msg: "The Draupnir data bind mount is present and writable" + + - name: Assert the container is attached only to its dedicated network + ansible.builtin.assert: + that: + - matrix_bot_draupnir_runtime.NetworkSettings.Networks is mapping + - matrix_bot_draupnir_runtime.NetworkSettings.Networks | length == 1 + - matrix_bot_draupnir_container_network in matrix_bot_draupnir_runtime.NetworkSettings.Networks + fail_msg: >- + Draupnir has unexpected networks: + {{ matrix_bot_draupnir_runtime.NetworkSettings.Networks.keys() | list }} + success_msg: "The Draupnir container is attached only to its dedicated network" + + - name: Ask Docker for Draupnir's published ports + ansible.builtin.command: + argv: + - docker + - container + - port + - matrix-bot-draupnir + register: matrix_bot_draupnir_published_ports + changed_when: false + failed_when: false + + - name: Assert the role did not publish a host port + ansible.builtin.assert: + that: + - matrix_bot_draupnir_runtime.HostConfig.PortBindings | default({}, true) | length == 0 + - matrix_bot_draupnir_published_ports.rc == 0 + - matrix_bot_draupnir_published_ports.stdout | trim | length == 0 + fail_msg: >- + Draupnir unexpectedly publishes a host port: + {{ matrix_bot_draupnir_published_ports.stdout | default('unknown') }} + success_msg: "The role leaves Draupnir's HTTP ports unpublished" + + - name: Assert Docker accepted the role's custom label + ansible.builtin.assert: + that: + - matrix_bot_draupnir_runtime.Config.Labels is mapping + - matrix_bot_draupnir_runtime.Config.Labels['molecule.draupnir.coverage'] == 'enabled' + fail_msg: "Docker did not attach the custom label from the role's label file" + success_msg: "Docker accepted the custom label from the role's label file"