Test matrix-bot-draupnir with Molecule

.github/renovate.json

@@ -85,6 +85,7 @@
       "matchFileNames": [
         "roles/custom/matrix-alertmanager-receiver/defaults/main.yml",
         "roles/custom/matrix-bot-baibot/defaults/main.yml",
+        "roles/custom/matrix-bot-draupnir/defaults/main.yml",
         "roles/custom/matrix-bot-maubot/defaults/main.yml",
         "roles/custom/matrix-bot-matrix-reminder-bot/defaults/main.yml",
         "roles/custom/matrix-bridge-heisenbridge/defaults/main.yml",

molecule-shared/homeserver-stub.py

@@ -14,8 +14,8 @@ a 200 rather than a 404, because the goal is to get the component past its start
 
 What it is NOT: an authentication check, a room state machine, or anything a scenario should
 assert *about*. Assert on what the role rendered and what the component reports about itself.
-A scenario that needs this stub to behave like a real homeserver has outgrown what these
-tests are for.
+Scenarios may supply a small static room-state fixture when startup requires it, but the stub
+does not model state changes.
 """
 
 import json
@@ -24,7 +24,7 @@ import re
 import sys
 import time
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from urllib.parse import parse_qs, urlparse
+from urllib.parse import parse_qs, unquote, urlparse
 
 SERVER_NAME = os.environ.get("STUB_SERVER_NAME", "molecule.local")
 PORT = int(os.environ.get("STUB_PORT", "8008"))
@@ -35,6 +35,7 @@ PORT = int(os.environ.get("STUB_PORT", "8008"))
 JOINED_ROOMS = [r for r in os.environ.get("STUB_JOINED_ROOMS", "").split(",") if r]
 
 USER_ID = os.environ.get("STUB_USER_ID", f"@stub:{SERVER_NAME}")
+ROOM_STATE = json.loads(os.environ.get("STUB_ROOM_STATE", "[]"))
 
 # Longest a /sync call is held open. Long-polling clients ask for a 30s timeout and
 # immediately ask again when the call returns, so answering instantly spins them into a hot
@@ -120,6 +121,10 @@ class Handler(BaseHTTPRequestHandler):
         if path.endswith("/createRoom"):
             return {"room_id": f"!stub-room:{SERVER_NAME}"}
 
+        join_match = re.search(r"/join/([^/]+)$", path)
+        if join_match:
+            return {"room_id": unquote(join_match.group(1))}
+
         if re.search(r"/rooms/[^/]+/join$", path) or path.endswith("/join"):
             return {"room_id": f"!stub-room:{SERVER_NAME}"}
 
@@ -154,6 +159,25 @@ class Handler(BaseHTTPRequestHandler):
         return {}
 
     def do_GET(self):
+        path = urlparse(self.path).path
+
+        if ROOM_STATE:
+            if re.search(r"/rooms/[^/]+/state$", path):
+                self._send(ROOM_STATE)
+                return
+
+            if "/account_data/" in path or re.search(
+                r"/rooms/[^/]+/state/[^/]+(?:/[^/]+)?$", path
+            ):
+                self._send(
+                    {
+                        "errcode": "M_NOT_FOUND",
+                        "error": "Molecule stub state not found",
+                    },
+                    status=404,
+                )
+                return
+
         self._send(self._route())
 
     def do_POST(self):

molecule-shared/tasks/homeserver-stub.yml

@@ -53,6 +53,9 @@
       # the bot user they were configured as, so a scenario bridging anything has to tell
       # the stub who it should claim to be.
       - --env=STUB_USER_ID={{ molecule_shared_stub_user_id | default('@stub:' + (molecule_shared_stub_server_name | default('molecule.local'))) }}
+      # Some components need to inspect an existing management room before they can start.
+      # This optional static fixture does not attempt to model subsequent state changes.
+      - --env=STUB_ROOM_STATE={{ (molecule_shared_stub_room_state | default([])) | to_json }}
       # Set molecule_shared_stub_verbose to "1" to log every request the stub is asked for.
       # How you find out why a component will not start, and for a component with no port of
       # its own, the only place to observe it acting on what the role configured.

roles/custom/matrix-bot-draupnir/molecule/default/converge.yml

@@ -0,0 +1,37 @@
+# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: Include roles for matrix-bot-draupnir Molecule tests
+  hosts: all
+  become: true
+  vars_files:
+    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
+  gather_facts: true
+  tasks:
+    - name: Include roles for matrix-bot-draupnir Molecule tests
+      ansible.builtin.include_role:
+        name: "{{ role_name }}"
+        public: true
+      loop:
+        - com.devture.ansible.role.playbook_help
+        - com.devture.ansible.role.systemd_docker_base
+        - "custom/{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
+      loop_control:
+        loop_var: role_name
+
+# Component roles install their unit; the complete playbook's service manager starts it.
+- name: Ensure matrix-bot-draupnir is started
+  hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Ensure systemd daemon is reloaded
+      ansible.builtin.systemd_service:
+        daemon_reload: true
+
+    - name: Ensure matrix-bot-draupnir systemd service is started
+      ansible.builtin.systemd_service:
+        name: matrix-bot-draupnir.service
+        state: started

roles/custom/matrix-bot-draupnir/molecule/default/molecule.yml

@@ -0,0 +1,110 @@
+# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+dependency:
+  name: galaxy
+  options:
+    requirements-file: requirements.yml
+    force: true
+driver:
+  name: docker
+platforms:
+  - name: matrix-bot-draupnir-${MOLECULE_DISTRO:-ubuntu2604}-default
+    image: "geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2604}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      callback_result_format: yaml
+  inventory:
+    group_vars:
+      all:
+        matrix_bot_draupnir_container_network: matrix-bot-draupnir-molecule
+
+        # verify.yml is a separate play where the role's defaults are out of scope. Pin
+        # only paths it reads; the component version is loaded from defaults/main.yml.
+        matrix_bot_draupnir_base_path: /matrix/draupnir
+        matrix_bot_draupnir_config_path: /matrix/draupnir/config
+        matrix_bot_draupnir_data_path: /matrix/draupnir/data
+
+        # Full-playbook context supplies the companion role's switch. It is deliberately
+        # absent here: this scenario tests the standalone bot, not the appservice variant.
+        matrix_appservice_draupnir_for_all_enabled: false
+
+        # A local homeserver stub accepts this fake token. No real Matrix or third-party
+        # account is involved. The pre-existing room avoids zero-touch room creation.
+        matrix_bot_draupnir_config_accessToken: molecule_draupnir_access_token_48c1e7
+        matrix_bot_draupnir_config_homeserverUrl: http://matrix.molecule.local:8008
+        matrix_bot_draupnir_config_rawHomeserverUrl: http://matrix.molecule.local:8008
+        matrix_bot_draupnir_config_managementRoom: "!draupnir-control:molecule.local"
+        matrix_bot_draupnir_zero_touch_deploy: false
+        matrix_bot_draupnir_pantalaimon_use: false
+        matrix_bot_draupnir_login_native: false
+        matrix_bot_draupnir_config_experimentalRustCrypto: false
+
+        # Values differ from both role and upstream defaults. The extension also disables
+        # recovery safe mode: otherwise Draupnir can become healthy after a recoverable
+        # bootstrap failure without entering its normal moderation mode.
+        matrix_bot_draupnir_config_disableServerACL: true
+        matrix_bot_draupnir_config_roomStateBackingStore_enabled: false
+        matrix_bot_draupnir_config_web_abuseReporting: true
+        matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled: false
+        matrix_bot_draupnir_config_web_port: 18082
+        matrix_bot_draupnir_config_displayReports: false
+        matrix_bot_draupnir_configuration_extension_yaml: |
+          logLevel: DEBUG
+          verifyPermissionsOnStartup: false
+          noop: true
+          backgroundDelayMS: 137
+          commands:
+            allowNoPrefix: true
+          safeMode:
+            bootOption: Never
+          health:
+            healthz:
+              enabled: true
+              port: 18081
+              address: 0.0.0.0
+              endpoint: /molecule-ready
+              healthyStatus: 201
+              unhealthyStatus: 503
+
+        # Traefik itself is not deployed. The role still renders these labels and Docker
+        # consumes them, proving the public-report routing contract and the derived network.
+        matrix_bot_draupnir_container_labels_traefik_enabled: true
+        matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_hostname: draupnir-reports.molecule.local
+        matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_path_regexp: ^/molecule-report/(v1)/rooms/([^/]*)/event/(.*)$$
+        matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_priority: 743
+        matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_entrypoints: web
+        matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_tls: false
+        matrix_bot_draupnir_container_labels_traefik_labels_additional_labels: |
+          molecule.draupnir.coverage=enabled
+
+        # Match the production-like no-host-port path; probes join the Docker network.
+        matrix_bot_draupnir_container_http_host_bind_port: ''
+  env:
+    # Workaround for https://github.com/ansible/molecule/issues/4391
+    ANSIBLE_ROLES_PATH: ${MOLECULE_PROJECT_DIRECTORY}/../..:/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:${ANSIBLE_HOME:-~/.ansible}/roles
+scenario:
+  test_sequence:
+    - dependency
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - cleanup
+    - destroy
+verifier:
+  name: ansible

roles/custom/matrix-bot-draupnir/molecule/default/prepare.yml

@@ -0,0 +1,119 @@
+# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: Prepare matrix-bot-draupnir Molecule tests
+  hosts: all
+  become: true
+  vars_files:
+    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"
+    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
+  gather_facts: true
+  tasks:
+    - name: Ensure apt cache is updated
+      ansible.builtin.apt:
+        update_cache: true
+        cache_valid_time: 600
+      when: ansible_facts['os_family'] == 'Debian'
+
+    - name: Ensure required packages are installed
+      ansible.builtin.package:
+        name:
+          - python3-requests
+          - fuse-overlayfs
+        state: present
+
+    - name: Ensure Docker is installed
+      ansible.builtin.include_role:
+        name: ansible-role-docker
+      vars:
+        docker_daemon_options:
+          storage-driver: fuse-overlayfs
+
+    # matrix-base creates this identity in the complete playbook. The component role's file
+    # tasks resolve owner/group by name, so the role-scoped scenario supplies that side effect.
+    - name: Ensure the matrix group exists
+      ansible.builtin.group:
+        name: "{{ matrix_group_name }}"
+        gid: "{{ matrix_user_gid }}"
+        state: present
+
+    - name: Ensure the matrix user exists
+      ansible.builtin.user:
+        name: "{{ matrix_user_name }}"
+        uid: "{{ matrix_user_uid }}"
+        group: "{{ matrix_group_name }}"
+        create_home: false
+        system: true
+        state: present
+
+    - name: Ensure the base data path exists
+      ansible.builtin.file:
+        path: "{{ matrix_base_data_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        mode: "0750"
+
+    # Draupnir and the stub need the network before the role's converge creates it.
+    - name: Ensure the container network the role attaches to exists
+      ansible.builtin.command:
+        argv:
+          - docker
+          - network
+          - create
+          - "{{ matrix_bot_draupnir_container_network }}"
+      register: matrix_bot_draupnir_molecule_network
+      changed_when: matrix_bot_draupnir_molecule_network.rc == 0
+      failed_when:
+        - matrix_bot_draupnir_molecule_network.rc != 0
+        - "'already exists' not in matrix_bot_draupnir_molecule_network.stderr"
+
+    # The bot must see itself joined to an existing management room. The create, member and
+    # power-level events are the minimum state Draupnir needs to validate that room and prove
+    # its own user can send state. No real homeserver or account is involved.
+    - name: Ensure the homeserver stub is running with Draupnir management-room state
+      ansible.builtin.include_tasks:
+        file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/tasks/homeserver-stub.yml"
+      vars:
+        molecule_shared_stub_network: "{{ matrix_bot_draupnir_container_network }}"
+        molecule_shared_stub_user_id: "@draupnir:molecule.local"
+        molecule_shared_stub_joined_rooms:
+          - "{{ matrix_bot_draupnir_config_managementRoom }}"
+        molecule_shared_stub_verbose: "1"
+        molecule_shared_stub_room_state:
+          - type: m.room.create
+            state_key: ''
+            room_id: "{{ matrix_bot_draupnir_config_managementRoom }}"
+            sender: "@draupnir:molecule.local"
+            event_id: "$molecule-create"
+            origin_server_ts: 1
+            content:
+              creator: "@draupnir:molecule.local"
+              room_version: "10"
+          - type: m.room.member
+            state_key: "@draupnir:molecule.local"
+            room_id: "{{ matrix_bot_draupnir_config_managementRoom }}"
+            sender: "@draupnir:molecule.local"
+            event_id: "$molecule-member"
+            origin_server_ts: 2
+            content:
+              displayname: Molecule Draupnir
+              membership: join
+          - type: m.room.power_levels
+            state_key: ''
+            room_id: "{{ matrix_bot_draupnir_config_managementRoom }}"
+            sender: "@draupnir:molecule.local"
+            event_id: "$molecule-power"
+            origin_server_ts: 3
+            content:
+              ban: 50
+              events_default: 0
+              invite: 50
+              kick: 50
+              redact: 50
+              state_default: 50
+              users:
+                "@draupnir:molecule.local": 100
+              users_default: 0

roles/custom/matrix-bot-draupnir/molecule/default/requirements.yml

@@ -0,0 +1 @@
+../../../../../molecule-shared/requirements.yml

roles/custom/matrix-bot-draupnir/molecule/default/verify.yml

@@ -0,0 +1,298 @@
+# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+# Health with safe mode disabled is the main readiness gate. Stub request evidence closes
+# Draupnir's remaining blind spot: its health turns green after launching, but not awaiting,
+# the SDK's first sync request.
+- name: Verify matrix-bot-draupnir
+  hosts: all
+  become: true
+  vars_files:
+    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"
+    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
+  vars:
+    matrix_bot_draupnir_rendered_config: "{{ matrix_bot_draupnir_config_file.content | b64decode | from_yaml }}"
+    matrix_bot_draupnir_labels_lines: "{{ (matrix_bot_draupnir_labels_file.content | b64decode).splitlines() }}"
+    matrix_bot_draupnir_runtime: "{{ (matrix_bot_draupnir_container_inspect.stdout | from_json) | first }}"
+    matrix_bot_draupnir_config_mounts: "{{ matrix_bot_draupnir_runtime.Mounts | selectattr('Destination', 'equalto', '/data/config') | list }}"
+    matrix_bot_draupnir_data_mounts: "{{ matrix_bot_draupnir_runtime.Mounts | selectattr('Destination', 'equalto', '/data') | list }}"
+  gather_facts: false
+
+  tasks:
+    # Read the pin from the role rather than defining it in the scenario, so an image bump
+    # changes the expected value and exercises the newly shipped image.
+    - name: Load the role's defaults under a separate name
+      ansible.builtin.include_vars:
+        file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"
+        name: matrix_bot_draupnir_role_defaults
+
+    - name: Wait for the matrix-bot-draupnir service to become active
+      ansible.builtin.systemd_service:
+        name: matrix-bot-draupnir.service
+      register: matrix_bot_draupnir_service
+      until: matrix_bot_draupnir_service.status.ActiveState == 'active'
+      retries: 30
+      delay: 5
+      failed_when: false
+
+    # Restart=always makes ActiveState alone insufficient for a crash-looping bot.
+    - name: Assert the service is active and has not restarted
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_service.status.ActiveState == 'active'
+          - matrix_bot_draupnir_service.status.NRestarts is defined
+          - matrix_bot_draupnir_service.status.NRestarts | int == 0
+        fail_msg: >-
+          matrix-bot-draupnir.service is
+          {{ matrix_bot_draupnir_service.status.ActiveState | default('unknown') }} after
+          {{ matrix_bot_draupnir_service.status.NRestarts | default('?') }} restart(s)
+        success_msg: "matrix-bot-draupnir.service is active and has not restarted"
+
+    # Probe over the role's own network. The non-default port and status are only reachable
+    # after normal-mode bootstrap because the scenario explicitly disables recovery safe mode.
+    - name: Wait for Draupnir to report healthy on the configured port
+      ansible.builtin.command:
+        argv:
+          - docker
+          - run
+          - --rm
+          - --network={{ matrix_bot_draupnir_container_network }}
+          - "{{ molecule_shared_image_curl }}"
+          - --silent
+          - --show-error
+          - --output
+          - /dev/null
+          - --write-out
+          - "HTTP_STATUS=%{http_code}"
+          - http://matrix-bot-draupnir:18081/molecule-ready
+      register: matrix_bot_draupnir_health
+      changed_when: false
+      until: matrix_bot_draupnir_health.stdout == 'HTTP_STATUS=201'
+      retries: 24
+      delay: 5
+      failed_when: false
+
+    - name: Assert Draupnir reached its normal-mode health gate
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_health.rc == 0
+          - matrix_bot_draupnir_health.stdout == 'HTTP_STATUS=201'
+        fail_msg: >-
+          Draupnir did not report the configured healthy status on port 18081
+          (rc={{ matrix_bot_draupnir_health.rc }}, response={{ matrix_bot_draupnir_health.stdout | default('none') }})
+        success_msg: "Draupnir reports healthy with the scenario's non-default status"
+
+    - name: Wait for Draupnir to request an initial sync from the homeserver stub
+      ansible.builtin.command:
+        argv:
+          - docker
+          - logs
+          - matrix-homeserver-stub
+      register: matrix_bot_draupnir_stub_logs
+      changed_when: false
+      until: "'/sync?' in matrix_bot_draupnir_stub_logs.stderr or '/sync?' in matrix_bot_draupnir_stub_logs.stdout"
+      retries: 12
+      delay: 5
+      failed_when: false
+
+    # These are observations of Draupnir's outbound bootstrap, not claims about the stub.
+    - name: Assert Draupnir completed its Matrix identity and management-room bootstrap
+      ansible.builtin.assert:
+        that:
+          - "'/account/whoami' in matrix_bot_draupnir_stub_request_log"
+          - "'/joined_rooms' in matrix_bot_draupnir_stub_request_log"
+          - "'/rooms/!draupnir-control%3Amolecule.local/state' in matrix_bot_draupnir_stub_request_log"
+        fail_msg: "Draupnir did not perform all expected Matrix bootstrap requests"
+        success_msg: "Draupnir performed its identity and management-room bootstrap"
+      vars:
+        matrix_bot_draupnir_stub_request_log: "{{ matrix_bot_draupnir_stub_logs.stdout + matrix_bot_draupnir_stub_logs.stderr }}"
+
+    - name: Assert Draupnir entered the Matrix sync loop
+      ansible.builtin.assert:
+        that:
+          - "'/sync?' in matrix_bot_draupnir_stub_request_log"
+        fail_msg: "Draupnir became healthy without requesting an initial Matrix sync"
+        success_msg: "Draupnir requested its initial Matrix sync"
+      vars:
+        matrix_bot_draupnir_stub_request_log: "{{ matrix_bot_draupnir_stub_logs.stdout + matrix_bot_draupnir_stub_logs.stderr }}"
+
+    - name: Read the configuration file the role rendered
+      ansible.builtin.slurp:
+        src: "{{ matrix_bot_draupnir_config_path }}/production.yaml"
+      register: matrix_bot_draupnir_config_file
+
+    - name: Assert the rendered Matrix connection and management-room configuration
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_rendered_config.homeserverUrl == matrix_bot_draupnir_config_homeserverUrl
+          - matrix_bot_draupnir_rendered_config.rawHomeserverUrl == matrix_bot_draupnir_config_rawHomeserverUrl
+          - matrix_bot_draupnir_rendered_config.accessToken == matrix_bot_draupnir_config_accessToken
+          - matrix_bot_draupnir_rendered_config.managementRoom == matrix_bot_draupnir_config_managementRoom
+          - matrix_bot_draupnir_rendered_config.experimentalRustCrypto is sameas false
+          - matrix_bot_draupnir_rendered_config.pantalaimon is not defined
+        fail_msg: "The rendered configuration does not carry the scenario's Matrix connection"
+        success_msg: "The rendered configuration carries the scenario's Matrix connection"
+
+    - name: Assert the rendered bootstrap and moderation behavior
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_rendered_config.logLevel == 'DEBUG'
+          - matrix_bot_draupnir_rendered_config.verifyPermissionsOnStartup is sameas false
+          - matrix_bot_draupnir_rendered_config.noop is sameas true
+          - matrix_bot_draupnir_rendered_config.disableServerACL is sameas true
+          - matrix_bot_draupnir_rendered_config.backgroundDelayMS == 137
+          - matrix_bot_draupnir_rendered_config.commands.allowNoPrefix is sameas true
+          - matrix_bot_draupnir_rendered_config.roomStateBackingStore.enabled is sameas false
+        fail_msg: "The rendered configuration does not carry the non-default Draupnir behavior"
+        success_msg: "The rendered configuration carries the non-default Draupnir behavior"
+
+    - name: Assert recovery safe mode is disabled in the rendered configuration
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_rendered_config.safeMode.bootOption == 'Never'
+        fail_msg: "Recovery safe mode could mask a failed normal Draupnir bootstrap"
+        success_msg: "Recovery safe mode cannot mask the scenario's readiness gate"
+
+    - name: Assert the rendered health listener configuration
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_rendered_config.health.healthz.enabled is sameas true
+          - matrix_bot_draupnir_rendered_config.health.healthz.port == 18081
+          - matrix_bot_draupnir_rendered_config.health.healthz.address == '0.0.0.0'
+          - matrix_bot_draupnir_rendered_config.health.healthz.endpoint == '/molecule-ready'
+          - matrix_bot_draupnir_rendered_config.health.healthz.healthyStatus == 201
+          - matrix_bot_draupnir_rendered_config.health.healthz.unhealthyStatus == 503
+        fail_msg: "The rendered health listener does not carry the scenario's settings"
+        success_msg: "The rendered health listener carries the scenario's settings"
+
+    - name: Assert the rendered abuse-reporting web listener configuration
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_rendered_config.web.enabled is sameas true
+          - matrix_bot_draupnir_rendered_config.web.port == matrix_bot_draupnir_config_web_port
+          - matrix_bot_draupnir_rendered_config.web.address == '0.0.0.0'
+          - matrix_bot_draupnir_rendered_config.web.abuseReporting.enabled is sameas true
+          - matrix_bot_draupnir_rendered_config.web.synapseHTTPAntispam.enabled is sameas false
+          - matrix_bot_draupnir_rendered_config.displayReports is sameas false
+        fail_msg: "The rendered web configuration does not carry the abuse-reporting settings"
+        success_msg: "The rendered web listener carries the abuse-reporting settings"
+
+    - name: Read the labels the role rendered
+      ansible.builtin.slurp:
+        src: "{{ matrix_bot_draupnir_base_path }}/labels"
+      register: matrix_bot_draupnir_labels_file
+
+    - name: Assert the labels carry the configured public report routing
+      ansible.builtin.assert:
+        that:
+          - "'traefik.enable=true' in matrix_bot_draupnir_labels_lines"
+          - "'traefik.docker.network=' + matrix_bot_draupnir_container_network in matrix_bot_draupnir_labels_lines"
+          - "'traefik.http.services.matrix-bot-draupnir.loadbalancer.server.port=18082' in matrix_bot_draupnir_labels_lines"
+          - "'traefik.http.routers.matrix-bot-draupnir-web-abuseReporting.rule=Host(`draupnir-reports.molecule.local`) && PathRegexp(`^/molecule-report/(v1)/rooms/([^/]*)/event/(.*)$`)' in matrix_bot_draupnir_labels_lines"
+          - "'traefik.http.routers.matrix-bot-draupnir-web-abuseReporting.priority=743' in matrix_bot_draupnir_labels_lines"
+          - "'traefik.http.routers.matrix-bot-draupnir-web-abuseReporting.entrypoints=web' in matrix_bot_draupnir_labels_lines"
+          - "'traefik.http.routers.matrix-bot-draupnir-web-abuseReporting.tls=false' in matrix_bot_draupnir_labels_lines"
+          - "'molecule.draupnir.coverage=enabled' in matrix_bot_draupnir_labels_lines"
+        fail_msg: "The role's label file does not carry the scenario's public report routing"
+        success_msg: "The role's label file carries the scenario's public report routing"
+
+    - name: Inspect the running Draupnir container
+      ansible.builtin.command:
+        argv:
+          - docker
+          - container
+          - inspect
+          - matrix-bot-draupnir
+      register: matrix_bot_draupnir_container_inspect
+      changed_when: false
+
+    - name: Assert the running container uses the exact image pinned by the role
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_runtime.Config.Image == 'ghcr.io/the-draupnir-project/draupnir:' + matrix_bot_draupnir_role_defaults.matrix_bot_draupnir_version
+        fail_msg: "The running Draupnir container does not use the role's exact image pin"
+        success_msg: "The running Draupnir container uses the role's exact image pin"
+
+    - name: Assert the running container uses the playbook-supplied identity
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_runtime.Config.User.split(':')[0] == matrix_user_uid | string
+          - matrix_bot_draupnir_runtime.Config.User.split(':')[1] == matrix_user_gid | string
+        fail_msg: >-
+          Draupnir runs as {{ matrix_bot_draupnir_runtime.Config.User }} instead of
+          {{ matrix_user_uid }}:{{ matrix_user_gid }}
+        success_msg: "The running container uses the playbook-supplied UID and GID"
+
+    - name: Assert the container drops all Linux capabilities
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_runtime.HostConfig.CapDrop is sequence
+          - "'ALL' in matrix_bot_draupnir_runtime.HostConfig.CapDrop"
+        fail_msg: "The Draupnir container does not drop all Linux capabilities"
+        success_msg: "The Draupnir container drops all Linux capabilities"
+
+    - name: Assert the container root filesystem is read-only
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_runtime.HostConfig.ReadonlyRootfs is sameas true
+        fail_msg: "The Draupnir container root filesystem is writable"
+        success_msg: "The Draupnir container root filesystem is read-only"
+
+    - name: Assert the configuration bind mount is read-only
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_config_mounts | length == 1
+          - matrix_bot_draupnir_config_mounts[0].RW is sameas false
+        fail_msg: "The Draupnir configuration bind mount is missing or writable"
+        success_msg: "The Draupnir configuration bind mount is present and read-only"
+
+    - name: Assert the data bind mount is writable
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_data_mounts | length == 1
+          - matrix_bot_draupnir_data_mounts[0].RW is sameas true
+        fail_msg: "The Draupnir data bind mount is missing or read-only"
+        success_msg: "The Draupnir data bind mount is present and writable"
+
+    - name: Assert the container is attached only to its dedicated network
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_runtime.NetworkSettings.Networks is mapping
+          - matrix_bot_draupnir_runtime.NetworkSettings.Networks | length == 1
+          - matrix_bot_draupnir_container_network in matrix_bot_draupnir_runtime.NetworkSettings.Networks
+        fail_msg: >-
+          Draupnir has unexpected networks:
+          {{ matrix_bot_draupnir_runtime.NetworkSettings.Networks.keys() | list }}
+        success_msg: "The Draupnir container is attached only to its dedicated network"
+
+    - name: Ask Docker for Draupnir's published ports
+      ansible.builtin.command:
+        argv:
+          - docker
+          - container
+          - port
+          - matrix-bot-draupnir
+      register: matrix_bot_draupnir_published_ports
+      changed_when: false
+      failed_when: false
+
+    - name: Assert the role did not publish a host port
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_runtime.HostConfig.PortBindings | default({}, true) | length == 0
+          - matrix_bot_draupnir_published_ports.rc == 0
+          - matrix_bot_draupnir_published_ports.stdout | trim | length == 0
+        fail_msg: >-
+          Draupnir unexpectedly publishes a host port:
+          {{ matrix_bot_draupnir_published_ports.stdout | default('unknown') }}
+        success_msg: "The role leaves Draupnir's HTTP ports unpublished"
+
+    - name: Assert Docker accepted the role's custom label
+      ansible.builtin.assert:
+        that:
+          - matrix_bot_draupnir_runtime.Config.Labels is mapping
+          - matrix_bot_draupnir_runtime.Config.Labels['molecule.draupnir.coverage'] == 'enabled'
+        fail_msg: "Docker did not attach the custom label from the role's label file"
+        success_msg: "Docker accepted the custom label from the role's label file"