overmind
/
matrix-docker-ansible-deploy
kopie van https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
Vork 0
Code Kwesties 0 Publicaties 0 Wiki Activiteit
Matrix Docker Ansible eploy
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
11931 Commits
2 Branches
137 MiB
 
 
 
Tree: 3ff0c8a87c
Branches Labels
${ item.name }
Maak branch ${ searchTerm }
van '3ff0c8a87c'
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-bridge-mautrix-googl.../molecule/default/verify.yml

345 regels
19 KiB
Ruw Blame Geschiedenis 

  1. # SPDX-FileCopyrightText: 2026 Slavi Pantaleev

  2. #

  3. # SPDX-License-Identifier: AGPL-3.0-or-later

  4. 

  5. ---

  6. # Proves the old Python bridge accepts the role-rendered configuration, completes its

  7. # Matrix-side startup, migrates real Postgres and exposes its appservice and metrics.

  8. - name: Verify mautrix-googlechat

  9.   hosts: all

  10.   become: true

  11.   vars_files:

  12.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"

  13.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"

  14.   vars:

  15.     mautrix_googlechat_config: "{{ mautrix_googlechat_config_file.content | b64decode | from_yaml }}"

  16.     mautrix_googlechat_registration: "{{ mautrix_googlechat_registration_file.content | b64decode | from_yaml }}"

  17.     mautrix_googlechat_labels_rendered: "{{ mautrix_googlechat_labels_file.content | b64decode }}"

  18.   gather_facts: false

  19.   tasks:

  20.     # Read the version from the role so a Renovate bump changes the expected image.

  21.     - name: Load the role's defaults under a separate name

  22.       ansible.builtin.include_vars:

  23.         file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"

  24.         name: mautrix_googlechat_role_defaults

  25. 

  26.     - name: Wait for the mautrix-googlechat service to become active

  27.       ansible.builtin.systemd_service:

  28.         name: matrix-mautrix-googlechat.service

  29.       register: mautrix_googlechat_service

  30.       until: mautrix_googlechat_service.status.ActiveState == 'active'

  31.       retries: 30

  32.       delay: 5

  33.       failed_when: false

  34. 

  35.     - name: Assert the service is active and has not been restarting

  36.       ansible.builtin.assert:

  37.         that:

  38.           - mautrix_googlechat_service.status.ActiveState == 'active'

  39.           - mautrix_googlechat_service.status.NRestarts is defined

  40.           - mautrix_googlechat_service.status.NRestarts | int == 0

  41.         fail_msg: >-

  42.           matrix-mautrix-googlechat.service is

  43.           {{ mautrix_googlechat_service.status.ActiveState | default('unknown') }} after

  44.           {{ mautrix_googlechat_service.status.NRestarts | default('?') }} restart(s)

  45.         success_msg: "matrix-mautrix-googlechat.service is active and has not restarted"

  46. 

  47.     - name: Wait for the bridge liveness endpoint

  48.       ansible.builtin.command:

  49.         argv:

  50.           - docker

  51.           - run

  52.           - --rm

  53.           - --network={{ matrix_bridge_mautrix_googlechat_container_network }}

  54.           - "{{ molecule_shared_image_curl }}"

  55.           - --silent

  56.           - --output

  57.           - /dev/null

  58.           - --write-out

  59.           - "HTTP_STATUS=%{http_code}"

  60.           - http://matrix-mautrix-googlechat:8080/_matrix/mau/live

  61.       register: mautrix_googlechat_live

  62.       changed_when: false

  63.       until: mautrix_googlechat_live.rc == 0 and mautrix_googlechat_live.stdout == 'HTTP_STATUS=200'

  64.       retries: 24

  65.       delay: 5

  66.       failed_when: false

  67. 

  68.     - name: Wait for the bridge readiness endpoint

  69.       ansible.builtin.command:

  70.         argv:

  71.           - docker

  72.           - run

  73.           - --rm

  74.           - --network={{ matrix_bridge_mautrix_googlechat_container_network }}

  75.           - "{{ molecule_shared_image_curl }}"

  76.           - --silent

  77.           - --output

  78.           - /dev/null

  79.           - --write-out

  80.           - "HTTP_STATUS=%{http_code}"

  81.           - http://matrix-mautrix-googlechat:8080/_matrix/mau/ready

  82.       register: mautrix_googlechat_ready

  83.       changed_when: false

  84.       until: mautrix_googlechat_ready.rc == 0 and mautrix_googlechat_ready.stdout == 'HTTP_STATUS=200'

  85.       retries: 24

  86.       delay: 5

  87.       failed_when: false

  88. 

  89.     - name: Assert the bridge is live and ready on its appservice listener

  90.       ansible.builtin.assert:

  91.         that:

  92.           - mautrix_googlechat_live.rc == 0

  93.           - mautrix_googlechat_live.stdout == 'HTTP_STATUS=200'

  94.           - mautrix_googlechat_ready.rc == 0

  95.           - mautrix_googlechat_ready.stdout == 'HTTP_STATUS=200'

  96.         fail_msg: >-

  97.           Health probes returned live={{ mautrix_googlechat_live.stdout | default('none') }} and

  98.           ready={{ mautrix_googlechat_ready.stdout | default('none') }}

  99.         success_msg: "The bridge is live and ready on its appservice listener"

  100. 

  101.     - name: Query the enabled metrics listener

  102.       ansible.builtin.command:

  103.         argv:

  104.           - docker

  105.           - run

  106.           - --rm

  107.           - --network={{ matrix_bridge_mautrix_googlechat_container_network }}

  108.           - "{{ molecule_shared_image_curl }}"

  109.           - --silent

  110.           - --show-error

  111.           - --fail

  112.           - http://matrix-mautrix-googlechat:8000/metrics

  113.       register: mautrix_googlechat_metrics

  114.       changed_when: false

  115. 

  116.     - name: Assert the live metrics surface comes from the running Python bridge

  117.       ansible.builtin.assert:

  118.         that:

  119.           - mautrix_googlechat_metrics.rc == 0

  120.           - "'# HELP python_gc_objects_collected_total' in mautrix_googlechat_metrics.stdout"

  121.           - "'# HELP process_start_time_seconds' in mautrix_googlechat_metrics.stdout"

  122.           - "'# HELP python_info' in mautrix_googlechat_metrics.stdout"

  123.         fail_msg: "The enabled metrics listener did not expose the Python process metrics"

  124.         success_msg: "The enabled metrics listener exposes the Python process metrics"

  125. 

  126.     - name: Read the configuration the role rendered

  127.       ansible.builtin.slurp:

  128.         src: "{{ matrix_bridge_mautrix_googlechat_config_path }}/config.yaml"

  129.       register: mautrix_googlechat_config_file

  130. 

  131.     - name: Assert the rendered configuration carries the appservice identity

  132.       ansible.builtin.assert:

  133.         that:

  134.           - mautrix_googlechat_config.homeserver.address == matrix_bridge_mautrix_googlechat_homeserver_address

  135.           - mautrix_googlechat_config.homeserver.domain == matrix_bridge_mautrix_googlechat_homeserver_domain

  136.           - mautrix_googlechat_config.appservice.id == 'googlechat'

  137.           - mautrix_googlechat_config.appservice.address == 'http://matrix-mautrix-googlechat:8080'

  138.           - mautrix_googlechat_config.appservice.bot_username == matrix_bridge_mautrix_googlechat_appservice_bot_username

  139.           - mautrix_googlechat_config.appservice.as_token == matrix_bridge_mautrix_googlechat_appservice_token

  140.           - mautrix_googlechat_config.appservice.hs_token == matrix_bridge_mautrix_googlechat_homeserver_token

  141.         fail_msg: "The rendered configuration does not carry the scenario's appservice identity"

  142.         success_msg: "The rendered configuration carries the scenario's appservice identity"

  143. 

  144.     - name: Assert the rendered configuration carries non-default bridge behavior

  145.       ansible.builtin.assert:

  146.         that:

  147.           - mautrix_googlechat_config.bridge.command_prefix == matrix_bridge_mautrix_googlechat_command_prefix

  148.           - not mautrix_googlechat_config.bridge.federate_rooms

  149.           - mautrix_googlechat_config.bridge.login_shared_secret == matrix_bridge_mautrix_googlechat_login_shared_secret

  150.           - mautrix_googlechat_config.bridge.web.auth.public == 'http://matrix.molecule.local:8008/molecule-googlechat/login'

  151.           - mautrix_googlechat_config.bridge.web.auth.prefix == '/molecule-googlechat/login'

  152.           - mautrix_googlechat_config.metrics.enabled

  153.           - mautrix_googlechat_config.logging.root.level == matrix_bridge_mautrix_googlechat_logging_level

  154.         fail_msg: "The rendered configuration does not carry the scenario's bridge behavior"

  155.         success_msg: "The rendered configuration carries the scenario's bridge behavior"

  156. 

  157.     - name: Assert the configuration points at the scenario's Postgres database

  158.       ansible.builtin.assert:

  159.         that:

  160.           - mautrix_googlechat_config.appservice.database is string

  161.           - mautrix_googlechat_config.appservice.database is match('^postgres://')

  162.           - matrix_bridge_mautrix_googlechat_database_username in mautrix_googlechat_config.appservice.database

  163.           - matrix_bridge_mautrix_googlechat_database_hostname in mautrix_googlechat_config.appservice.database

  164.           - matrix_bridge_mautrix_googlechat_database_name in mautrix_googlechat_config.appservice.database

  165.         fail_msg: >-

  166.           appservice.database is {{ mautrix_googlechat_config.appservice.database | default('unset') }},

  167.           which was not composed from the scenario's Postgres settings

  168.         success_msg: "The configuration points at the scenario's Postgres database"

  169. 

  170.     - name: Read the appservice registration the role rendered

  171.       ansible.builtin.slurp:

  172.         src: "{{ matrix_bridge_mautrix_googlechat_config_path }}/registration.yaml"

  173.       register: mautrix_googlechat_registration_file

  174. 

  175.     - name: Assert the registration carries the configured handshake values

  176.       ansible.builtin.assert:

  177.         that:

  178.           - mautrix_googlechat_registration.id == 'googlechat'

  179.           - mautrix_googlechat_registration.as_token == matrix_bridge_mautrix_googlechat_appservice_token

  180.           - mautrix_googlechat_registration.hs_token == matrix_bridge_mautrix_googlechat_homeserver_token

  181.           - mautrix_googlechat_registration.sender_localpart == '_bot_' + matrix_bridge_mautrix_googlechat_appservice_bot_username

  182.           - mautrix_googlechat_registration.url == 'http://matrix-mautrix-googlechat:8080'

  183.         fail_msg: "The registration does not carry the configured handshake values"

  184.         success_msg: "The registration carries the configured handshake values"

  185. 

  186.     - name: Assert the registration namespaces cover only Google Chat ghosts and the bot

  187.       ansible.builtin.assert:

  188.         that:

  189.           - mautrix_googlechat_ghost_regex | length > 0

  190.           - mautrix_googlechat_bot_regex | length > 0

  191.           - mautrix_googlechat_ghost_mxid is match(mautrix_googlechat_ghost_regex)

  192.           - mautrix_googlechat_wrong_ghost_mxid is not match(mautrix_googlechat_ghost_regex)

  193.           - mautrix_googlechat_bot_mxid is match(mautrix_googlechat_bot_regex)

  194.         fail_msg: "The registration namespaces do not cover only Google Chat ghosts and the bot"

  195.         success_msg: "The registration namespaces cover only Google Chat ghosts and the bot"

  196.       vars:

  197.         mautrix_googlechat_user_regexes: "{{ mautrix_googlechat_registration.namespaces.users | map(attribute='regex') | list }}"

  198.         mautrix_googlechat_ghost_regex: "{{ mautrix_googlechat_user_regexes | select('search', 'googlechat_') | first | default('') }}"

  199.         mautrix_googlechat_bot_regex: "{{ mautrix_googlechat_user_regexes | reject('search', 'googlechat_') | first | default('') }}"

  200.         mautrix_googlechat_ghost_mxid: "@googlechat_123456:{{ matrix_bridge_mautrix_googlechat_homeserver_domain }}"

  201.         mautrix_googlechat_wrong_ghost_mxid: "@gvoice_123456:{{ matrix_bridge_mautrix_googlechat_homeserver_domain }}"

  202.         mautrix_googlechat_bot_mxid: "@{{ matrix_bridge_mautrix_googlechat_appservice_bot_username }}:{{ matrix_bridge_mautrix_googlechat_homeserver_domain }}"

  203. 

  204.     - name: List the tables the bridge created in Postgres

  205.       ansible.builtin.command:

  206.         argv:

  207.           - docker

  208.           - exec

  209.           - matrix-postgres-molecule

  210.           - psql

  211.           - --username={{ matrix_bridge_mautrix_googlechat_database_username }}

  212.           - --dbname={{ matrix_bridge_mautrix_googlechat_database_name }}

  213.           - --tuples-only

  214.           - --no-align

  215.           - "--command=SELECT tablename FROM pg_tables WHERE schemaname = 'public'"

  216.       register: mautrix_googlechat_tables

  217.       changed_when: false

  218. 

  219.     - name: Assert the bridge migrated its schema into the configured database

  220.       ansible.builtin.assert:

  221.         that:

  222.           - mautrix_googlechat_tables.rc == 0

  223.           - "'version' in mautrix_googlechat_table_names"

  224.           - "'portal' in mautrix_googlechat_table_names"

  225.           - "'puppet' in mautrix_googlechat_table_names"

  226.           - "'message' in mautrix_googlechat_table_names"

  227.           - "'mx_version' in mautrix_googlechat_table_names"

  228.           - mautrix_googlechat_table_names | length >= 10

  229.         fail_msg: >-

  230.           The bridge did not migrate its schema into {{ matrix_bridge_mautrix_googlechat_database_name }}

  231.           (found {{ mautrix_googlechat_table_names | length }} table(s))

  232.         success_msg: "The bridge migrated its schema into the configured database"

  233.       vars:

  234.         mautrix_googlechat_table_names: "{{ mautrix_googlechat_tables.stdout_lines | select | list }}"

  235. 

  236.     - name: Read the labels the role rendered

  237.       ansible.builtin.slurp:

  238.         src: "{{ matrix_bridge_mautrix_googlechat_base_path }}/labels"

  239.       register: mautrix_googlechat_labels_file

  240. 

  241.     - name: Assert the labels route both HTTP surfaces to their configured ports

  242.       ansible.builtin.assert:

  243.         that:

  244.           - "'traefik.enable=true' in mautrix_googlechat_labels_rendered"

  245.           - "'traefik.docker.network=' + matrix_bridge_mautrix_googlechat_container_network in mautrix_googlechat_labels_rendered"

  246.           - "'traefik.http.services.matrix-mautrix-googlechat-public.loadbalancer.server.port=8080' in mautrix_googlechat_labels_rendered"

  247.           - "'traefik.http.routers.matrix-mautrix-googlechat-public.rule=Host(`googlechat.molecule.local`) && PathPrefix(`/molecule-googlechat`)' in mautrix_googlechat_labels_rendered"

  248.           - "'traefik.http.services.matrix-mautrix-googlechat-metrics.loadbalancer.server.port=8000' in mautrix_googlechat_labels_rendered"

  249.           - "'traefik.http.routers.matrix-mautrix-googlechat-metrics.rule=Host(`metrics.molecule.local`) && PathPrefix(`/metrics/googlechat`)' in mautrix_googlechat_labels_rendered"

  250.           - "'molecule.googlechat.coverage=enabled' in mautrix_googlechat_labels_rendered"

  251.         fail_msg: "The rendered labels do not carry both HTTP routing contracts"

  252.         success_msg: "The rendered labels carry both HTTP routing contracts"

  253. 

  254.     - name: Inspect the running bridge container

  255.       ansible.builtin.command:

  256.         argv:

  257.           - docker

  258.           - container

  259.           - inspect

  260.           - matrix-mautrix-googlechat

  261.       register: mautrix_googlechat_container_inspect

  262.       changed_when: false

  263. 

  264.     - name: Parse the running bridge container inspection

  265.       ansible.builtin.set_fact:

  266.         mautrix_googlechat_container: "{{ (mautrix_googlechat_container_inspect.stdout | from_json) | first }}"

  267. 

  268.     - name: Assert the running container uses the exact image pinned by the role

  269.       ansible.builtin.assert:

  270.         that:

  271.           - mautrix_googlechat_container.Config.Image == mautrix_googlechat_expected_image

  272.         fail_msg: >-

  273.           The running container uses {{ mautrix_googlechat_container.Config.Image }}, expected

  274.           {{ mautrix_googlechat_expected_image }}

  275.         success_msg: "The running container uses the exact image pinned by the role"

  276.       vars:

  277.         mautrix_googlechat_expected_image: >-

  278.           {{ mautrix_googlechat_role_defaults.matrix_bridge_mautrix_googlechat_container_image_registry_prefix_upstream_default }}mautrix/googlechat:{{ mautrix_googlechat_role_defaults.matrix_bridge_mautrix_googlechat_version }}

  279. 

  280.     - name: Assert the running container uses the playbook-supplied runtime

  281.       ansible.builtin.assert:

  282.         that:

  283.           - mautrix_googlechat_container.Config.User == (matrix_user_uid | string) + ':' + (matrix_user_gid | string)

  284.           - mautrix_googlechat_container.Config.WorkingDir == '/opt/mautrix-googlechat'

  285.           - mautrix_googlechat_container.Config.Cmd == ['python3', '-m', 'mautrix_googlechat', '-c', '/config/config.yaml', '--no-update']

  286.           - mautrix_googlechat_container.HostConfig.RestartPolicy.Name == 'no'

  287.           - mautrix_googlechat_container.HostConfig.AutoRemove

  288.           - mautrix_googlechat_container.HostConfig.LogConfig.Type == 'none'

  289.         fail_msg: "The running container does not use the role's exact identity, command and workdir"

  290.         success_msg: "The running container uses the role's exact identity, command and workdir"

  291. 

  292.     - name: Assert the running container has the intended privilege isolation

  293.       ansible.builtin.assert:

  294.         that:

  295.           - "'ALL' in mautrix_googlechat_container.HostConfig.CapDrop"

  296.           - not mautrix_googlechat_container.HostConfig.Privileged

  297.         fail_msg: "The running container does not have the intended privilege isolation"

  298.         success_msg: "The running container drops all capabilities and is unprivileged"

  299. 

  300.     - name: Assert the running container carries the role's two bind mounts

  301.       ansible.builtin.assert:

  302.         that:

  303.           - mautrix_googlechat_config_mount | length > 0

  304.           - mautrix_googlechat_config_mount.Source == matrix_bridge_mautrix_googlechat_config_path

  305.           - not mautrix_googlechat_config_mount.RW

  306.           - mautrix_googlechat_data_mount | length > 0

  307.           - mautrix_googlechat_data_mount.Source == matrix_bridge_mautrix_googlechat_data_path

  308.           - mautrix_googlechat_data_mount.RW

  309.           - mautrix_googlechat_container.Mounts | length == 2

  310.         fail_msg: "The running container does not carry the role's exact config and data mounts"

  311.         success_msg: "The running container carries its read-only config and writable data mounts"

  312.       vars:

  313.         mautrix_googlechat_config_mount: >-

  314.           {{ mautrix_googlechat_container.Mounts

  315.              | selectattr('Destination', 'equalto', '/config')

  316.              | first | default({}) }}

  317.         mautrix_googlechat_data_mount: >-

  318.           {{ mautrix_googlechat_container.Mounts

  319.              | selectattr('Destination', 'equalto', '/data')

  320.              | first | default({}) }}

  321. 

  322.     - name: Assert the rendered labels are attached to the running container

  323.       ansible.builtin.assert:

  324.         that:

  325.           - mautrix_googlechat_container.Config.Labels['traefik.enable'] == 'true'

  326.           - mautrix_googlechat_container.Config.Labels['traefik.docker.network'] == matrix_bridge_mautrix_googlechat_container_network

  327.           - mautrix_googlechat_container.Config.Labels['traefik.http.services.matrix-mautrix-googlechat-public.loadbalancer.server.port'] == '8080'

  328.           - mautrix_googlechat_container.Config.Labels['traefik.http.services.matrix-mautrix-googlechat-metrics.loadbalancer.server.port'] == '8000'

  329.           - mautrix_googlechat_container.Config.Labels['molecule.googlechat.coverage'] == 'enabled'

  330.         fail_msg: "The running container does not carry the labels the role rendered"

  331.         success_msg: "The running container carries the labels the role rendered"

  332. 

  333.     - name: Assert the running container has the exact network and port exposure

  334.       ansible.builtin.assert:

  335.         that:

  336.           - mautrix_googlechat_container.HostConfig.NetworkMode == matrix_bridge_mautrix_googlechat_container_network

  337.           - matrix_bridge_mautrix_googlechat_container_network in mautrix_googlechat_container.NetworkSettings.Networks

  338.           - mautrix_googlechat_container.NetworkSettings.Networks | length == 1

  339.           - mautrix_googlechat_container.HostConfig.PortBindings | default({}, true) | length == 0

  340.         fail_msg: >-

  341.           The container has unexpected networks or host ports:

  342.           networks={{ mautrix_googlechat_container.NetworkSettings.Networks.keys() | list }},

  343.           ports={{ mautrix_googlechat_container.HostConfig.PortBindings | default({}) }}

  344.         success_msg: "The container uses only its dedicated network and publishes no host ports"