From 8d50b2c7350527ea2eb7ed133e4fc11034896903 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sun, 30 Aug 2026 18:06:31 +0300 Subject: [PATCH] Test matrix-static-files with Molecule --- .github/renovate.json | 1 + .../molecule/default/converge.yml | 48 ++ .../molecule/default/molecule.yml | 148 ++++++ .../molecule/default/prepare.yml | 56 +++ .../molecule/default/requirements.yml | 1 + .../molecule/default/verify.yml | 469 ++++++++++++++++++ 6 files changed, 723 insertions(+) create mode 100644 roles/custom/matrix-static-files/molecule/default/converge.yml create mode 100644 roles/custom/matrix-static-files/molecule/default/molecule.yml create mode 100644 roles/custom/matrix-static-files/molecule/default/prepare.yml create mode 120000 roles/custom/matrix-static-files/molecule/default/requirements.yml create mode 100644 roles/custom/matrix-static-files/molecule/default/verify.yml diff --git a/.github/renovate.json b/.github/renovate.json index c3ca1b30c..c666eb5eb 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -138,6 +138,7 @@ "roles/custom/matrix-bridge-postmoogle/defaults/main.yml", "roles/custom/matrix-client-element/defaults/main.yml", "roles/custom/matrix-ketesa/defaults/main.yml", + "roles/custom/matrix-static-files/defaults/main.yml", "roles/custom/matrix-synapse/defaults/main.yml" ], "matchUpdateTypes": [ diff --git a/roles/custom/matrix-static-files/molecule/default/converge.yml b/roles/custom/matrix-static-files/molecule/default/converge.yml new file mode 100644 index 000000000..ed693ef0a --- /dev/null +++ b/roles/custom/matrix-static-files/molecule/default/converge.yml @@ -0,0 +1,48 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +- name: Include roles for matrix-static-files Molecule tests + hosts: all + become: true + vars_files: + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml" + gather_facts: true + tasks: + - name: Include base roles for matrix-static-files Molecule tests + ansible.builtin.include_role: + name: "{{ role_name }}" + public: true + loop: + - com.devture.ansible.role.playbook_help + - com.devture.ansible.role.systemd_docker_base + loop_control: + loop_var: role_name + + # main.yml also invokes the separately-tagged public self-check. In the full + # playbook that runs only after systemd_service_manager has started services. + - name: Include matrix-static-files setup task files + ansible.builtin.include_role: + name: "custom/{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}" + public: true + tasks_from: "{{ role_task_file }}" + loop: + - validate_config.yml + - install.yml + loop_control: + loop_var: role_task_file + +- name: Ensure matrix-static-files is started + hosts: all + become: true + gather_facts: false + tasks: + - name: Ensure systemd daemon is reloaded + ansible.builtin.systemd_service: + daemon_reload: true + + - name: Ensure matrix-static-files systemd service is started + ansible.builtin.systemd_service: + name: matrix-static-files.service + state: started diff --git a/roles/custom/matrix-static-files/molecule/default/molecule.yml b/roles/custom/matrix-static-files/molecule/default/molecule.yml new file mode 100644 index 000000000..311bd1701 --- /dev/null +++ b/roles/custom/matrix-static-files/molecule/default/molecule.yml @@ -0,0 +1,148 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +dependency: + name: galaxy + options: + requirements-file: requirements.yml + force: true +driver: + name: docker +platforms: + - name: matrix-static-files-${MOLECULE_DISTRO:-ubuntu2604}-default + image: "geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2604}-ansible:latest" + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + pre_build_image: true +provisioner: + name: ansible + config_options: + defaults: + callback_result_format: yaml + inventory: + group_vars: + all: + # verify.yml is a separate play, so paths and runtime settings it reads are + # pinned here rather than relying on role defaults remaining in scope. + matrix_static_files_base_path: /matrix/static-files + matrix_static_files_config_path: /matrix/static-files/config + matrix_static_files_public_path: /matrix/static-files/public + matrix_static_files_container_network: matrix-static-files-molecule + matrix_static_files_container_http_host_bind_port: '' + + # Exercise the generated environment and prove the server listens on what + # the role rendered rather than static-web-server's own port default. + matrix_static_files_environment_variable_server_port: 18082 + matrix_static_files_environment_variable_server_log_level: debug + matrix_static_files_environment_variable_server_log_remote_address: true + matrix_static_files_environment_variable_server_ignore_hidden_files: false + matrix_static_files_environment_variables_additional_variables: | + MOLECULE_STATIC_FILES_MARKER=environment-reached + matrix_static_files_files_cache_time_hours: 7 + + # Render both router families with non-default routing knobs. Traefik does + # not need to run: the file and the attached container labels are inspected. + matrix_static_files_container_labels_traefik_entrypoints: web + matrix_static_files_container_labels_well_known_matrix_endpoint_traefik_hostname: matrix-well-known.molecule.local + matrix_static_files_container_labels_well_known_matrix_endpoint_traefik_path_prefix: /molecule-well-known + matrix_static_files_container_labels_well_known_matrix_endpoint_traefik_priority: 67 + matrix_static_files_container_labels_well_known_matrix_endpoint_middleware_compress_minResponseBodyBytes: 321 + matrix_static_files_container_labels_base_domain_enabled: true + matrix_static_files_container_labels_base_domain_traefik_hostname: base.molecule.local + matrix_static_files_container_labels_base_domain_traefik_path_prefix: /molecule-base + matrix_static_files_container_labels_base_domain_traefik_priority: 43 + matrix_static_files_container_labels_base_domain_root_path_redirection_enabled: false + matrix_static_files_container_labels_additional_labels: | + molecule.scenario=matrix-static-files + + matrix_static_files_file_index_html_template: |- + + + Molecule static-files index marker + + + # All URLs are inert data: the static server never contacts them. The mix + # exercises optional sections, recursive extensions, lists and mappings. + matrix_static_files_file_matrix_client_property_m_homeserver_base_url: https://homeserver.molecule.invalid + matrix_static_files_file_matrix_client_property_m_identity_server_base_url: '' + matrix_static_files_file_matrix_client_property_m_integrations_managers_api_url: https://integrations.molecule.invalid/api + matrix_static_files_file_matrix_client_property_m_integrations_managers_ui_url: https://integrations.molecule.invalid/ui + matrix_static_files_file_matrix_client_property_io_element_jitsi_preferred_domain: jitsi.molecule.local + matrix_static_files_file_matrix_client_property_org_matrix_msc2965_authentication_enabled: true + matrix_static_files_file_matrix_client_property_org_matrix_msc2965_authentication_issuer: https://auth.molecule.invalid/ + matrix_static_files_file_matrix_client_property_org_matrix_msc2965_authentication_account: https://auth.molecule.invalid/account + matrix_static_files_file_matrix_client_property_org_matrix_msc3575_proxy_url: https://sync.molecule.invalid + matrix_static_files_file_matrix_client_property_m_tile_server_entries_enabled: true + matrix_static_files_file_matrix_client_property_m_tile_server_map_style_url: https://maps.molecule.invalid/style.json + matrix_static_files_file_matrix_client_property_io_element_e2ee_default: false + matrix_static_files_file_matrix_client_property_io_element_e2ee_force_disable: true + matrix_static_files_file_matrix_client_property_cc_etke_ketesa_custom: + allow: + - molecule-client + marker: ketesa-custom + matrix_static_files_file_matrix_client_property_org_matrix_msc4143_rtc_foci_custom: + - type: livekit + livekit_service_url: https://livekit.molecule.invalid + matrix_static_files_file_matrix_client_configuration_extension_json: | + { + "m.homeserver": { + "molecule_extension_marker": "recursive-merge-reached" + }, + "org.example.molecule": { + "enabled": true, + "sequence": 42 + } + } + + matrix_static_files_file_matrix_server_property_m_server: federation.molecule.local:9448 + matrix_static_files_file_matrix_server_configuration_extension_json: | + { + "org.example.molecule": "server-extension-reached" + } + + matrix_static_files_file_matrix_support_enabled: true + matrix_static_files_file_matrix_support_property_m_contacts: + - matrix_id: "@support:molecule.local" + email_address: support@molecule.invalid + role: m.role.admin + matrix_static_files_file_matrix_support_property_m_support_page: https://support.molecule.invalid + matrix_static_files_file_matrix_support_configuration_extension_json: | + { + "org.example.molecule": { + "channel": "support-extension-reached" + } + } + + matrix_static_files_file_matrix_mautrix_property_fi_mau_bridges_custom: + - https://telegram.molecule.invalid + - https://signal.molecule.invalid + matrix_static_files_file_matrix_mautrix_configuration_extension_json: | + { + "fi.mau.external_bridge_servers": [ + "https://external-bridges.molecule.invalid" + ], + "org.example.molecule": "mautrix-extension-reached" + } + env: + # Workaround for https://github.com/ansible/molecule/issues/4391 + ANSIBLE_ROLES_PATH: ${MOLECULE_PROJECT_DIRECTORY}/../..:/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:${ANSIBLE_HOME:-~/.ansible}/roles +scenario: + test_sequence: + - dependency + - cleanup + - destroy + - syntax + - create + - prepare + - converge + - idempotence + - verify + - cleanup + - destroy +verifier: + name: ansible diff --git a/roles/custom/matrix-static-files/molecule/default/prepare.yml b/roles/custom/matrix-static-files/molecule/default/prepare.yml new file mode 100644 index 000000000..1aa754942 --- /dev/null +++ b/roles/custom/matrix-static-files/molecule/default/prepare.yml @@ -0,0 +1,56 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +- name: Prepare matrix-static-files Molecule tests + hosts: all + become: true + vars_files: + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml" + gather_facts: true + tasks: + - name: Ensure apt cache is updated + ansible.builtin.apt: + update_cache: true + cache_valid_time: 600 + when: ansible_facts['os_family'] == 'Debian' + + - name: Ensure required packages are installed + ansible.builtin.package: + name: + - python3-requests + - fuse-overlayfs + state: present + + - name: Ensure Docker is installed + ansible.builtin.include_role: + name: ansible-role-docker + vars: + docker_daemon_options: + storage-driver: fuse-overlayfs + + # The role's file tasks resolve owner and group by name. matrix-base creates + # these during a real deployment, so the scenario supplies that prerequisite. + - name: Ensure the matrix group exists + ansible.builtin.group: + name: "{{ matrix_group_name }}" + gid: "{{ matrix_user_gid }}" + state: present + + - name: Ensure the matrix user exists + ansible.builtin.user: + name: "{{ matrix_user_name }}" + uid: "{{ matrix_user_uid }}" + group: "{{ matrix_group_name }}" + create_home: false + system: true + state: present + + - name: Ensure the base data path exists + ansible.builtin.file: + path: "{{ matrix_base_data_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + mode: "0750" diff --git a/roles/custom/matrix-static-files/molecule/default/requirements.yml b/roles/custom/matrix-static-files/molecule/default/requirements.yml new file mode 120000 index 000000000..1567a5392 --- /dev/null +++ b/roles/custom/matrix-static-files/molecule/default/requirements.yml @@ -0,0 +1 @@ +../../../../../molecule-shared/requirements.yml \ No newline at end of file diff --git a/roles/custom/matrix-static-files/molecule/default/verify.yml b/roles/custom/matrix-static-files/molecule/default/verify.yml new file mode 100644 index 000000000..e07815ff9 --- /dev/null +++ b/roles/custom/matrix-static-files/molecule/default/verify.yml @@ -0,0 +1,469 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +- name: Verify matrix-static-files + hosts: all + become: true + vars_files: + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml" + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml" + gather_facts: false + + tasks: + # Load the shipped version independently of the scenario. A role version bump + # therefore advances the expected image instead of comparing two test pins. + - name: Load the role's defaults under a separate name + ansible.builtin.include_vars: + file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml" + name: matrix_static_files_role_defaults + + - name: Wait for the matrix-static-files service to become active + ansible.builtin.systemd_service: + name: matrix-static-files.service + register: matrix_static_files_service + until: matrix_static_files_service.status.ActiveState == 'active' + retries: 30 + delay: 5 + failed_when: false + + # Restart=always means ActiveState alone stays green during a crash loop. + - name: Assert the service is active and has not restarted + ansible.builtin.assert: + that: + - matrix_static_files_service.status.ActiveState == 'active' + - matrix_static_files_service.status.NRestarts is defined + - matrix_static_files_service.status.NRestarts | int == 0 + fail_msg: >- + matrix-static-files.service is + {{ matrix_static_files_service.status.ActiveState | default('unknown') }} + after {{ matrix_static_files_service.status.NRestarts | default('?') }} restart(s) + success_msg: "matrix-static-files.service is active and has not restarted" + + # Probe over the private container network, matching how Traefik reaches the + # service in a deployment. Every document is generated by a different role path. + - name: Fetch the generated JSON documents from the running service + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_static_files_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --show-error + - --write-out + - "\nMOLECULE_HTTP_STATUS=%{http_code}" + - "http://matrix-static-files:{{ matrix_static_files_environment_variable_server_port }}{{ item.path }}" + loop: + - name: client + path: /.well-known/matrix/client + - name: server + path: /.well-known/matrix/server + - name: support + path: /.well-known/matrix/support + - name: mautrix + path: /.well-known/matrix/mautrix + register: matrix_static_files_document_responses + changed_when: false + until: "'MOLECULE_HTTP_STATUS=200' in matrix_static_files_document_responses.stdout" + retries: 24 + delay: 5 + failed_when: false + + - name: Assert every enabled generated document is served successfully + ansible.builtin.assert: + that: + - "'MOLECULE_HTTP_STATUS=200' in item.stdout" + fail_msg: >- + {{ item.item.path }} was not served successfully + ({{ item.stdout | default('no output') }}) + success_msg: "{{ item.item.path }} is served successfully" + loop: "{{ matrix_static_files_document_responses.results }}" + loop_control: + label: "{{ item.item.name }}" + + - name: Initialize parsed served documents + ansible.builtin.set_fact: + matrix_static_files_served_documents: {} + + - name: Parse the served JSON documents + ansible.builtin.set_fact: + matrix_static_files_served_documents: >- + {{ + matrix_static_files_served_documents + | combine({item.item.name: item.stdout | regex_replace('\nMOLECULE_HTTP_STATUS=[0-9]+\s*$', '') | from_json}) + }} + loop: "{{ matrix_static_files_document_responses.results }}" + loop_control: + label: "{{ item.item.name }}" + + # The default server port must be closed. Otherwise a response on the scenario's + # port would not prove SERVER_PORT reached the process. + - name: Probe static-web-server's default port + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_static_files_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --output + - /dev/null + - --write-out + - "MOLECULE_HTTP_STATUS=%{http_code}" + - --connect-timeout + - "2" + - http://matrix-static-files:8080/.well-known/matrix/client + register: matrix_static_files_default_port_response + changed_when: false + failed_when: false + + - name: Assert static-web-server's default port is not listening + ansible.builtin.assert: + that: + - "'MOLECULE_HTTP_STATUS=200' not in matrix_static_files_default_port_response.stdout" + fail_msg: >- + Port 8080 answered, so the live probe does not prove the non-default + SERVER_PORT reached static-web-server + success_msg: "Only the configured non-default internal port answers" + + - name: Read the generated JSON files from disk + ansible.builtin.slurp: + src: "{{ matrix_static_files_public_path }}/.well-known/matrix/{{ item }}" + loop: + - client + - server + - support + - mautrix + register: matrix_static_files_rendered_document_files + + - name: Initialize parsed rendered documents + ansible.builtin.set_fact: + matrix_static_files_rendered_documents: {} + + - name: Parse the generated JSON files + ansible.builtin.set_fact: + matrix_static_files_rendered_documents: >- + {{ + matrix_static_files_rendered_documents + | combine({item.item: item.content | b64decode | from_json}) + }} + loop: "{{ matrix_static_files_rendered_document_files.results }}" + loop_control: + label: "{{ item.item }}" + + - name: Assert the running service exposes the exact documents the role generated + ansible.builtin.assert: + that: + - matrix_static_files_served_documents[item] == matrix_static_files_rendered_documents[item] + fail_msg: "The served {{ item }} document differs from the generated file" + success_msg: "The served {{ item }} document is the generated file" + loop: + - client + - server + - support + - mautrix + + - name: Assert the client document carries all configured discovery sections + ansible.builtin.assert: + that: + - matrix_static_files_served_documents.client['m.homeserver'].base_url == 'https://homeserver.molecule.invalid' + - matrix_static_files_served_documents.client['m.integrations'].managers[0].api_url == 'https://integrations.molecule.invalid/api' + - matrix_static_files_served_documents.client['m.integrations'].managers[0].ui_url == 'https://integrations.molecule.invalid/ui' + - matrix_static_files_served_documents.client['io.element.jitsi'].preferredDomain == 'jitsi.molecule.local' + - matrix_static_files_served_documents.client['org.matrix.msc2965.authentication'].issuer == 'https://auth.molecule.invalid/' + - matrix_static_files_served_documents.client['org.matrix.msc2965.authentication'].account == 'https://auth.molecule.invalid/account' + - matrix_static_files_served_documents.client['org.matrix.msc3575.proxy'].url == 'https://sync.molecule.invalid' + - matrix_static_files_served_documents.client['m.tile_server'].map_style_url == 'https://maps.molecule.invalid/style.json' + - matrix_static_files_served_documents.client['io.element.e2ee'].default == false + - matrix_static_files_served_documents.client['io.element.e2ee'].force_disable == true + - matrix_static_files_served_documents.client['cc.etke.ketesa'].marker == 'ketesa-custom' + - matrix_static_files_served_documents.client['org.matrix.msc4143.rtc_foci'][0].livekit_service_url == 'https://livekit.molecule.invalid' + fail_msg: "The client document does not carry the configured discovery sections" + success_msg: "The client document carries the configured discovery sections" + + - name: Assert recursive extension and omission behavior in the client document + ansible.builtin.assert: + that: + - matrix_static_files_served_documents.client['m.homeserver'].molecule_extension_marker == 'recursive-merge-reached' + - matrix_static_files_served_documents.client['org.example.molecule'].enabled == true + - matrix_static_files_served_documents.client['org.example.molecule'].sequence == 42 + - "'m.identity_server' not in matrix_static_files_served_documents.client" + fail_msg: "The client extension was not merged recursively or an omitted section leaked in" + success_msg: "The client extension is merged recursively and disabled identity discovery is omitted" + + - name: Assert the server, support and mautrix documents carry configured data and extensions + ansible.builtin.assert: + that: + - matrix_static_files_served_documents.server['m.server'] == 'federation.molecule.local:9448' + - matrix_static_files_served_documents.server['org.example.molecule'] == 'server-extension-reached' + - matrix_static_files_served_documents.support.contacts[0].matrix_id == '@support:molecule.local' + - matrix_static_files_served_documents.support.contacts[0].role == 'm.role.admin' + - matrix_static_files_served_documents.support.support_page == 'https://support.molecule.invalid' + - matrix_static_files_served_documents.support['org.example.molecule'].channel == 'support-extension-reached' + - matrix_static_files_served_documents.mautrix['fi.mau.bridges'] | length == 2 + - "'https://telegram.molecule.invalid' in matrix_static_files_served_documents.mautrix['fi.mau.bridges']" + - matrix_static_files_served_documents.mautrix['fi.mau.external_bridge_servers'][0] == 'https://external-bridges.molecule.invalid' + - matrix_static_files_served_documents.mautrix['org.example.molecule'] == 'mautrix-extension-reached' + fail_msg: "One or more auxiliary documents lost configured data or extensions" + success_msg: "Server, support and mautrix documents carry configured data and extensions" + + - name: Fetch response headers for every generated JSON document + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_static_files_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --show-error + - --head + - "http://matrix-static-files:{{ matrix_static_files_environment_variable_server_port }}/.well-known/matrix/{{ item }}" + loop: + - client + - server + - support + - mautrix + register: matrix_static_files_document_headers + changed_when: false + + - name: Assert every generated JSON document carries the configured headers + ansible.builtin.assert: + that: + - "'content-type: application/json' in item.stdout_lines" + - "'access-control-allow-origin: *' in item.stdout_lines" + - "'cache-control: max-age=25200' in item.stdout_lines" + fail_msg: >- + {{ item.item }} did not carry the configured JSON, CORS and cache headers: + {{ item.stdout }} + success_msg: "{{ item.item }} carries the configured JSON, CORS and cache headers" + loop: "{{ matrix_static_files_document_headers.results }}" + loop_control: + label: "{{ item.item }}" + + - name: Fetch the generated base-domain index document + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_static_files_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --show-error + - --write-out + - "\nMOLECULE_HTTP_STATUS=%{http_code}" + - "http://matrix-static-files:{{ matrix_static_files_environment_variable_server_port }}/" + register: matrix_static_files_index_response + changed_when: false + + - name: Assert the configured base-domain index is served + ansible.builtin.assert: + that: + - "'MOLECULE_HTTP_STATUS=200' in matrix_static_files_index_response.stdout" + - "'Molecule static-files index marker' in matrix_static_files_index_response.stdout" + fail_msg: >- + The configured base-domain index was not served + ({{ matrix_static_files_index_response.stdout | default('no output') }}) + success_msg: "The configured base-domain index is served" + + - name: Parse the TOML configuration the role rendered + ansible.builtin.command: + argv: + - python3 + - -c + - >- + import json, sys, tomllib; + print(json.dumps(tomllib.load(open(sys.argv[1], 'rb')))) + - "{{ matrix_static_files_config_path }}/config.toml" + register: matrix_static_files_config_command + changed_when: false + + - name: Assert the parsed server configuration carries the header contract + ansible.builtin.assert: + that: + - matrix_static_files_config.advanced.headers[0].source == '/.well-known/matrix/*' + - matrix_static_files_config.advanced.headers[0].headers['Content-Type'] == 'application/json' + - matrix_static_files_config.advanced.headers[0].headers['Access-Control-Allow-Origin'] == '*' + - matrix_static_files_config.advanced.headers[0].headers['Cache-Control'] == 'max-age=25200' + fail_msg: "The parsed config.toml does not carry the configured header contract" + success_msg: "The parsed config.toml carries the configured header contract" + vars: + matrix_static_files_config: "{{ matrix_static_files_config_command.stdout | from_json }}" + + - name: Read the environment file the role rendered + ansible.builtin.slurp: + src: "{{ matrix_static_files_base_path }}/env" + register: matrix_static_files_env_file + + - name: Initialize the parsed environment + ansible.builtin.set_fact: + matrix_static_files_env_parsed: {} + + - name: Parse the rendered environment + ansible.builtin.set_fact: + matrix_static_files_env_parsed: >- + {{ matrix_static_files_env_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }} + loop: "{{ (matrix_static_files_env_file.content | b64decode).splitlines() | reject('equalto', '') }}" + when: "'=' in item" + no_log: true + + - name: Assert the rendered environment carries the scenario's settings + ansible.builtin.assert: + that: + - matrix_static_files_env_parsed.SERVER_PORT == matrix_static_files_environment_variable_server_port | string + - matrix_static_files_env_parsed.SERVER_LOG_LEVEL == 'debug' + - matrix_static_files_env_parsed.SERVER_LOG_REMOTE_ADDRESS == 'true' + - matrix_static_files_env_parsed.SERVER_IGNORE_HIDDEN_FILES == 'false' + - matrix_static_files_env_parsed.MOLECULE_STATIC_FILES_MARKER == 'environment-reached' + fail_msg: "The parsed environment file does not carry the scenario's settings" + success_msg: "The parsed environment file carries the scenario's settings" + + - name: Read the labels file the role rendered + ansible.builtin.slurp: + src: "{{ matrix_static_files_base_path }}/labels" + register: matrix_static_files_labels_file + + - name: Initialize the parsed labels + ansible.builtin.set_fact: + matrix_static_files_labels_parsed: {} + + - name: Parse the rendered labels + ansible.builtin.set_fact: + matrix_static_files_labels_parsed: >- + {{ matrix_static_files_labels_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }} + loop: "{{ (matrix_static_files_labels_file.content | b64decode).splitlines() | reject('equalto', '') }}" + when: + - "'=' in item" + - not item.startswith('#') + no_log: true + + - name: Assert the rendered labels carry both routing contracts + ansible.builtin.assert: + that: + - matrix_static_files_labels_parsed['traefik.enable'] == 'true' + - matrix_static_files_labels_parsed['traefik.docker.network'] == matrix_static_files_container_network + - matrix_static_files_labels_parsed['traefik.http.services.matrix-static-files.loadbalancer.server.port'] == matrix_static_files_environment_variable_server_port | string + - "'Host(`matrix-well-known.molecule.local`)' in matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.rule']" + - "'PathPrefix(`/molecule-well-known`)' in matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.rule']" + - matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.priority'] == '67' + - matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.entrypoints'] == 'web' + - matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-well-known-matrix.tls'] == 'false' + - matrix_static_files_labels_parsed['traefik.http.middlewares.matrix-static-files-well-known-matrix-compress.compress.minResponseBodyBytes'] == '321' + - "'Host(`base.molecule.local`)' in matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-base-domain.rule']" + - "'PathPrefix(`/molecule-base`)' in matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-base-domain.rule']" + - matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-base-domain.priority'] == '43' + - matrix_static_files_labels_parsed['traefik.http.routers.matrix-static-files-base-domain.tls'] == 'false' + - matrix_static_files_labels_parsed['molecule.scenario'] == 'matrix-static-files' + fail_msg: "The rendered labels do not carry both routing contracts" + success_msg: "The rendered labels carry both routing contracts" + + - name: Inspect the running matrix-static-files container + ansible.builtin.command: + argv: + - docker + - container + - inspect + - matrix-static-files + register: matrix_static_files_container_inspect_command + changed_when: false + + - name: Parse the running container inspection + ansible.builtin.set_fact: + matrix_static_files_container: "{{ (matrix_static_files_container_inspect_command.stdout | from_json)[0] }}" + + - name: Assert the configured environment reached the running container + ansible.builtin.assert: + that: + - "('SERVER_PORT=' ~ (matrix_static_files_environment_variable_server_port | string)) in matrix_static_files_container.Config.Env" + - "'SERVER_LOG_LEVEL=debug' in matrix_static_files_container.Config.Env" + - "'SERVER_LOG_REMOTE_ADDRESS=true' in matrix_static_files_container.Config.Env" + - "'SERVER_IGNORE_HIDDEN_FILES=false' in matrix_static_files_container.Config.Env" + - "'MOLECULE_STATIC_FILES_MARKER=environment-reached' in matrix_static_files_container.Config.Env" + fail_msg: "The running container environment does not carry the scenario's settings" + success_msg: "The configured environment reached the running container" + + - name: Assert the rendered labels reached the running container + ansible.builtin.assert: + that: + - matrix_static_files_container.Config.Labels['traefik.enable'] == 'true' + - matrix_static_files_container.Config.Labels['traefik.docker.network'] == matrix_static_files_container_network + - matrix_static_files_container.Config.Labels['traefik.http.services.matrix-static-files.loadbalancer.server.port'] == matrix_static_files_environment_variable_server_port | string + - matrix_static_files_container.Config.Labels['traefik.http.routers.matrix-static-files-well-known-matrix.priority'] == '67' + - matrix_static_files_container.Config.Labels['traefik.http.routers.matrix-static-files-base-domain.priority'] == '43' + - matrix_static_files_container.Config.Labels['molecule.scenario'] == 'matrix-static-files' + fail_msg: "The running container does not carry the labels the role rendered" + success_msg: "The rendered labels reached the running container" + + - name: Assert the running container uses the exact image and version the role pins + ansible.builtin.assert: + that: + - matrix_static_files_container.Config.Image == matrix_static_files_expected_image + fail_msg: >- + The running container uses {{ matrix_static_files_container.Config.Image }}, + expected {{ matrix_static_files_expected_image }} + success_msg: "The running container uses the exact image and version defaults/main.yml pins" + vars: + matrix_static_files_expected_tag: >- + {{ + 'latest' + if matrix_static_files_role_defaults.matrix_static_files_version == 'latest' + else matrix_static_files_role_defaults.matrix_static_files_version ~ '-alpine' + }} + matrix_static_files_expected_image: >- + {{ matrix_static_files_role_defaults.matrix_static_files_container_image_registry_prefix_upstream_default }}joseluisq/static-web-server:{{ matrix_static_files_expected_tag }} + + - name: Assert the running container uses the configured UID and GID + ansible.builtin.assert: + that: + - matrix_static_files_container.Config.User == (matrix_user_uid | string) ~ ':' ~ (matrix_user_gid | string) + fail_msg: >- + The running container uses {{ matrix_static_files_container.Config.User }}, + expected {{ matrix_user_uid }}:{{ matrix_user_gid }} + success_msg: "The running container uses the configured UID and GID" + + - name: Assert the running container has a read-only root filesystem + ansible.builtin.assert: + that: + - matrix_static_files_container.HostConfig.ReadonlyRootfs == true + fail_msg: "The running container's root filesystem is writable" + success_msg: "The running container has a read-only root filesystem" + + - name: Assert the running container drops all capabilities and adds none + ansible.builtin.assert: + that: + - matrix_static_files_container.HostConfig.CapDrop == ['ALL'] + - matrix_static_files_container.HostConfig.CapAdd | default([], true) | length == 0 + fail_msg: "The running container does not have the expected capability restrictions" + success_msg: "The running container drops all capabilities and adds none" + + - name: Assert both bind mounts are read-only + ansible.builtin.assert: + that: + - matrix_static_files_container.Mounts | selectattr('Destination', 'equalto', '/var/public') | list | length == 1 + - (matrix_static_files_container.Mounts | selectattr('Destination', 'equalto', '/var/public') | first).RW == false + - matrix_static_files_container.Mounts | selectattr('Destination', 'equalto', '/config') | list | length == 1 + - (matrix_static_files_container.Mounts | selectattr('Destination', 'equalto', '/config') | first).RW == false + fail_msg: "The running container is missing a read-only content or configuration mount" + success_msg: "Both bind mounts are present and read-only" + + - name: Assert the running container is attached only to its dedicated network + ansible.builtin.assert: + that: + - matrix_static_files_container.NetworkSettings.Networks.keys() | list | length == 1 + - matrix_static_files_container_network in matrix_static_files_container.NetworkSettings.Networks + fail_msg: >- + The running container is attached to unexpected networks: + {{ matrix_static_files_container.NetworkSettings.Networks.keys() | list }} + success_msg: "The running container is attached only to its dedicated network" + + - name: Assert the running container publishes no host ports + ansible.builtin.assert: + that: + - matrix_static_files_container.HostConfig.PortBindings | default({}, true) | length == 0 + fail_msg: "The running container unexpectedly publishes a host port" + success_msg: "The running container publishes no host ports"