overmind
/
matrix-docker-ansible-deploy
ミラー元 https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
フォーク 0
コード 課題 0 リリース 0 Wiki アクティビティ
Matrix Docker Ansible eploy
選択できるのは25トピックまでです。 トピックは、先頭が英数字で、英数字とダッシュ('-')を使用した35文字以内のものにしてください。
11941 コミット
2 ブランチ
137 MiB
 
 
 
ツリー: 64b691e8fd
ブランチ タグ
${ item.name }
ブランチ ${ searchTerm } を作成
'64b691e8fd' から
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-client-fluffychat/molecule/default/verify.yml

383 行
21 KiB
Raw Blame 履歴 

  1. # SPDX-FileCopyrightText: 2026 Slavi Pantaleev

  2. #

  3. # SPDX-License-Identifier: AGPL-3.0-or-later

  4. 

  5. ---

  6. # FluffyChat Web is a static browser client. The live JSON configuration and a real

  7. # application asset are the weight-bearing probes; no homeserver account is needed.

  8. - name: Verify matrix-client-fluffychat

  9.   hosts: all

  10.   become: true

  11.   vars_files:

  12.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"

  13.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"

  14.   vars:

  15.     matrix_client_fluffychat_root_body: "{{ matrix_client_fluffychat_root_http.stdout_lines[:-1] | join('\n') }}"

  16.     matrix_client_fluffychat_runtime: "{{ (matrix_client_fluffychat_container_inspect.stdout | from_json) | first }}"

  17.   gather_facts: false

  18. 

  19.   tasks:

  20.     # Load the pin independently of the scenario so a role version bump advances

  21.     # the expected image instead of comparing two duplicated test values.

  22.     - name: Load the role's defaults under a separate name

  23.       ansible.builtin.include_vars:

  24.         file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"

  25.         name: matrix_client_fluffychat_role_defaults

  26. 

  27.     - name: Wait for the matrix-client-fluffychat service to become active

  28.       ansible.builtin.systemd_service:

  29.         name: matrix-client-fluffychat.service

  30.       register: matrix_client_fluffychat_service

  31.       until: matrix_client_fluffychat_service.status.ActiveState == 'active'

  32.       retries: 30

  33.       delay: 5

  34.       failed_when: false

  35. 

  36.     # Restart=always makes ActiveState alone green even during a crash loop.

  37.     - name: Assert the service is active and has not restarted

  38.       ansible.builtin.assert:

  39.         that:

  40.           - matrix_client_fluffychat_service.status.ActiveState == 'active'

  41.           - matrix_client_fluffychat_service.status.NRestarts is defined

  42.           - matrix_client_fluffychat_service.status.NRestarts | int == 0

  43.         fail_msg: >-

  44.           matrix-client-fluffychat.service is

  45.           {{ matrix_client_fluffychat_service.status.ActiveState | default('unknown') }} after

  46.           {{ matrix_client_fluffychat_service.status.NRestarts | default('?') }} restart(s)

  47.         success_msg: "matrix-client-fluffychat.service is active and has not restarted"

  48. 

  49.     # Probe through the private container network, matching how Traefik reaches the

  50.     # service in a deployment without publishing an artificial host port.

  51.     - name: Wait for FluffyChat to serve its application root

  52.       ansible.builtin.command:

  53.         argv:

  54.           - docker

  55.           - run

  56.           - --rm

  57.           - --network={{ matrix_client_fluffychat_container_network }}

  58.           - "{{ molecule_shared_image_curl }}"

  59.           - --silent

  60.           - --show-error

  61.           - --write-out

  62.           - "\nHTTP_STATUS=%{http_code}"

  63.           - "http://matrix-client-fluffychat:{{ matrix_client_fluffychat_container_http_port }}/"

  64.       register: matrix_client_fluffychat_root_http

  65.       changed_when: false

  66.       until: "'HTTP_STATUS=200' in matrix_client_fluffychat_root_http.stdout"

  67.       retries: 24

  68.       delay: 5

  69.       failed_when: false

  70. 

  71.     - name: Assert the application root is real FluffyChat HTML

  72.       ansible.builtin.assert:

  73.         that:

  74.           - matrix_client_fluffychat_root_http.rc == 0

  75.           - matrix_client_fluffychat_root_http.stdout_lines[-1] == 'HTTP_STATUS=200'

  76.           - matrix_client_fluffychat_root_body | trim | length > 500

  77.           - "'<!doctype html' in matrix_client_fluffychat_root_body | lower"

  78.           - "'fluffychat' in matrix_client_fluffychat_root_body | lower"

  79.         fail_msg: "FluffyChat did not return its real application HTML over the container network"

  80.         success_msg: "FluffyChat serves its real application root over HTTP"

  81. 

  82.     - name: Fetch FluffyChat's live browser configuration

  83.       ansible.builtin.command:

  84.         argv:

  85.           - docker

  86.           - run

  87.           - --rm

  88.           - --network={{ matrix_client_fluffychat_container_network }}

  89.           - "{{ molecule_shared_image_curl }}"

  90.           - --silent

  91.           - --show-error

  92.           - --write-out

  93.           - "\nHTTP_STATUS=%{http_code}\nCONTENT_TYPE=%{content_type}"

  94.           - "http://matrix-client-fluffychat:{{ matrix_client_fluffychat_container_http_port }}/config.json"

  95.       register: matrix_client_fluffychat_config_http

  96.       changed_when: false

  97.       failed_when: false

  98. 

  99.     - name: Assert the live browser configuration is served as JSON

  100.       ansible.builtin.assert:

  101.         that:

  102.           - matrix_client_fluffychat_config_http.rc == 0

  103.           - "'HTTP_STATUS=200' in matrix_client_fluffychat_config_http.stdout_lines"

  104.           - matrix_client_fluffychat_config_http.stdout | regex_search('(?m)^CONTENT_TYPE=application/json(?:;|$)') is not none

  105.         fail_msg: "FluffyChat did not serve its live browser configuration as JSON"

  106.         success_msg: "FluffyChat serves its live browser configuration as JSON"

  107. 

  108.     - name: Parse the live browser configuration

  109.       ansible.builtin.set_fact:

  110.         matrix_client_fluffychat_live_config: >-

  111.           {{ matrix_client_fluffychat_config_http.stdout | regex_replace('\nHTTP_STATUS=[0-9]+\nCONTENT_TYPE=.*$', '') | from_json }}

  112. 

  113.     - name: Assert the live configuration carries the configured homeserver

  114.       ansible.builtin.assert:

  115.         that:

  116.           - matrix_client_fluffychat_live_config is mapping

  117.           - matrix_client_fluffychat_live_config.keys() | list == ['defaultHomeserver']

  118.           - matrix_client_fluffychat_live_config.defaultHomeserver == matrix_client_fluffychat_config_defaultHomeserver

  119.         fail_msg: "The live config.json does not carry the non-default homeserver rendered by the role"

  120.         success_msg: "The live config.json carries the configured homeserver"

  121. 

  122.     # Fetch a browser bundle referenced by the live HTML rather than assuming the

  123.     # container is useful just because nginx answered at its root.

  124.     - name: Extract a live FluffyChat application asset path

  125.       ansible.builtin.set_fact:

  126.         matrix_client_fluffychat_application_asset_path: >-

  127.           {{ matrix_client_fluffychat_root_body | regex_search('(?<=src=")[^"]+[.]js(?=")') }}

  128. 

  129.     - name: Fetch the live FluffyChat application asset

  130.       ansible.builtin.command:

  131.         argv:

  132.           - docker

  133.           - run

  134.           - --rm

  135.           - --network={{ matrix_client_fluffychat_container_network }}

  136.           - "{{ molecule_shared_image_curl }}"

  137.           - --silent

  138.           - --show-error

  139.           - --output

  140.           - /dev/null

  141.           - --write-out

  142.           - "HTTP_STATUS=%{http_code}\nCONTENT_TYPE=%{content_type}\nSIZE=%{size_download}"

  143.           - "http://matrix-client-fluffychat:{{ matrix_client_fluffychat_container_http_port }}/{{ matrix_client_fluffychat_application_asset_path }}"

  144.       register: matrix_client_fluffychat_asset_http

  145.       changed_when: false

  146.       failed_when: false

  147. 

  148.     - name: Assert a real FluffyChat application asset is served

  149.       ansible.builtin.assert:

  150.         that:

  151.           - matrix_client_fluffychat_asset_http.rc == 0

  152.           - "'HTTP_STATUS=200' in matrix_client_fluffychat_asset_http.stdout_lines"

  153.           - matrix_client_fluffychat_asset_http.stdout | regex_search('(?m)^CONTENT_TYPE=(?:application|text)/javascript(?:;|$)') is not none

  154.           - matrix_client_fluffychat_asset_http.stdout | regex_search('(?m)^SIZE=([1-9][0-9]{3,})$') is not none

  155.         fail_msg: "FluffyChat did not serve the JavaScript asset referenced by its live HTML"

  156.         success_msg: "FluffyChat serves a substantial live application asset"

  157. 

  158.     - name: Read the configuration file the role rendered

  159.       ansible.builtin.slurp:

  160.         src: "{{ matrix_client_fluffychat_config_path }}/config.json"

  161.       register: matrix_client_fluffychat_rendered_config_file

  162. 

  163.     - name: Assert the served and rendered structured configurations are identical

  164.       ansible.builtin.assert:

  165.         that:

  166.           - matrix_client_fluffychat_rendered_config == matrix_client_fluffychat_live_config

  167.         fail_msg: "The live configuration differs from the parsed file the role rendered"

  168.         success_msg: "The running service exposes the exact structured configuration the role rendered"

  169.       vars:

  170.         matrix_client_fluffychat_rendered_config: >-

  171.           {{ matrix_client_fluffychat_rendered_config_file.content | b64decode | from_json }}

  172. 

  173.     - name: Read the labels file the role rendered

  174.       ansible.builtin.slurp:

  175.         src: "{{ matrix_client_fluffychat_base_path }}/labels"

  176.       register: matrix_client_fluffychat_labels_file

  177. 

  178.     - name: Initialize the parsed labels

  179.       ansible.builtin.set_fact:

  180.         matrix_client_fluffychat_labels_parsed: {}

  181. 

  182.     - name: Parse the rendered labels

  183.       ansible.builtin.set_fact:

  184.         matrix_client_fluffychat_labels_parsed: >-

  185.           {{ matrix_client_fluffychat_labels_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }}

  186.       loop: "{{ (matrix_client_fluffychat_labels_file.content | b64decode).splitlines() | reject('equalto', '') }}"

  187.       when: "'=' in item"

  188.       no_log: true

  189. 

  190.     - name: Assert the rendered labels carry the public routing contract

  191.       ansible.builtin.assert:

  192.         that:

  193.           - matrix_client_fluffychat_labels_parsed['traefik.enable'] == 'true'

  194.           - matrix_client_fluffychat_labels_parsed['traefik.docker.network'] == matrix_client_fluffychat_container_network

  195.           - matrix_client_fluffychat_labels_parsed['traefik.http.services.matrix-client-fluffychat.loadbalancer.server.port'] == (matrix_client_fluffychat_container_http_port | string)

  196.           - matrix_client_fluffychat_labels_parsed['traefik.http.routers.matrix-client-fluffychat.rule'] == 'Host(`chat.fluffy.molecule.local`) && PathPrefix(`/fluffy`)'

  197.           - matrix_client_fluffychat_labels_parsed['traefik.http.routers.matrix-client-fluffychat.priority'] == '731'

  198.           - matrix_client_fluffychat_labels_parsed['traefik.http.routers.matrix-client-fluffychat.entrypoints'] == 'web'

  199.           - matrix_client_fluffychat_labels_parsed['traefik.http.routers.matrix-client-fluffychat.tls'] == 'false'

  200.           - matrix_client_fluffychat_labels_parsed['traefik.http.routers.matrix-client-fluffychat.middlewares'] == 'matrix-client-fluffychat-slashless-redirect,matrix-client-fluffychat-strip-prefix,matrix-client-fluffychat-add-headers'

  201.           - matrix_client_fluffychat_labels_parsed['molecule.fluffychat.coverage'] == 'enabled'

  202.         fail_msg: "The parsed labels do not carry the scenario's routing contract"

  203.         success_msg: "The parsed labels carry the scenario's routing contract"

  204. 

  205.     - name: Assert the rendered labels carry the configured response headers

  206.       ansible.builtin.assert:

  207.         that:

  208.           - matrix_client_fluffychat_labels_parsed['traefik.http.middlewares.matrix-client-fluffychat-add-headers.headers.customresponseheaders.X-XSS-Protection'] == '0'

  209.           - matrix_client_fluffychat_labels_parsed['traefik.http.middlewares.matrix-client-fluffychat-add-headers.headers.customresponseheaders.X-Content-Type-Options'] == 'molecule-nosniff'

  210.           - matrix_client_fluffychat_labels_parsed['traefik.http.middlewares.matrix-client-fluffychat-add-headers.headers.customresponseheaders.Content-Security-Policy'] == 'frame-ancestors https://embed.molecule.local'

  211.           - matrix_client_fluffychat_labels_parsed['traefik.http.middlewares.matrix-client-fluffychat-add-headers.headers.customresponseheaders.Permission-Policy'] == 'camera=(self)'

  212.           - "'traefik.http.middlewares.matrix-client-fluffychat-add-headers.headers.customresponseheaders.Strict-Transport-Security' not in matrix_client_fluffychat_labels_parsed"

  213.         fail_msg: "The parsed labels lost response headers or incorrectly enable HSTS without TLS"

  214.         success_msg: "The parsed labels carry the configured response-header contract"

  215. 

  216.     - name: Inspect the running FluffyChat container

  217.       ansible.builtin.command:

  218.         argv:

  219.           - docker

  220.           - container

  221.           - inspect

  222.           - matrix-client-fluffychat

  223.       register: matrix_client_fluffychat_container_inspect

  224.       changed_when: false

  225. 

  226.     - name: Assert the rendered labels reached the running container

  227.       ansible.builtin.assert:

  228.         that:

  229.           - matrix_client_fluffychat_runtime.Config.Labels['traefik.enable'] == 'true'

  230.           - matrix_client_fluffychat_runtime.Config.Labels['traefik.docker.network'] == matrix_client_fluffychat_container_network

  231.           - matrix_client_fluffychat_runtime.Config.Labels['traefik.http.services.matrix-client-fluffychat.loadbalancer.server.port'] == (matrix_client_fluffychat_container_http_port | string)

  232.           - matrix_client_fluffychat_runtime.Config.Labels['traefik.http.routers.matrix-client-fluffychat.priority'] == '731'

  233.           - matrix_client_fluffychat_runtime.Config.Labels['molecule.fluffychat.coverage'] == 'enabled'

  234.           - matrix_client_fluffychat_runtime.Config.Labels['molecule.fluffychat.extra-argument'] == 'reached'

  235.         fail_msg: "The running container does not carry the labels the role rendered and passed"

  236.         success_msg: "The configured labels reached the running container"

  237. 

  238.     - name: Assert the configured internal port reached the running container

  239.       ansible.builtin.assert:

  240.         that:

  241.           - "('SERVER_PORT=' ~ (matrix_client_fluffychat_container_http_port | string)) in matrix_client_fluffychat_runtime.Config.Env"

  242.         fail_msg: "The running container did not receive its configured internal HTTP port"

  243.         success_msg: "The configured internal HTTP port reached the running container"

  244. 

  245.     - name: Assert the running container uses the exact image and version the role pins

  246.       ansible.builtin.assert:

  247.         that:

  248.           - matrix_client_fluffychat_runtime.Config.Image == matrix_client_fluffychat_expected_image

  249.         fail_msg: >-

  250.           The running container uses {{ matrix_client_fluffychat_runtime.Config.Image }},

  251.           expected {{ matrix_client_fluffychat_expected_image }}

  252.         success_msg: "The running container uses the exact image and version defaults/main.yml pins"

  253.       vars:

  254.         matrix_client_fluffychat_expected_image: >-

  255.           {{ matrix_client_fluffychat_role_defaults.matrix_client_fluffychat_container_image_registry_prefix_upstream_default }}etkecc/fluffychat-web:{{ matrix_client_fluffychat_role_defaults.matrix_client_fluffychat_version }}

  256. 

  257.     - name: Assert the running container uses the configured UID and GID

  258.       ansible.builtin.assert:

  259.         that:

  260.           - matrix_client_fluffychat_runtime.Config.User == (matrix_user_uid | string) ~ ':' ~ (matrix_user_gid | string)

  261.         fail_msg: >-

  262.           The running container uses {{ matrix_client_fluffychat_runtime.Config.User }},

  263.           expected {{ matrix_user_uid }}:{{ matrix_user_gid }}

  264.         success_msg: "The running container uses the configured UID and GID"

  265. 

  266.     - name: Assert the running container keeps the image command contract

  267.       ansible.builtin.assert:

  268.         that:

  269.           - matrix_client_fluffychat_runtime.Config.Entrypoint == ['/usr/local/bin/entrypoint.sh']

  270.           - matrix_client_fluffychat_runtime.Config.Cmd == ['static-web-server']

  271.           - matrix_client_fluffychat_runtime.HostConfig.RestartPolicy.Name == 'no'

  272.           - matrix_client_fluffychat_runtime.HostConfig.AutoRemove is sameas true

  273.           - matrix_client_fluffychat_runtime.HostConfig.LogConfig.Type == 'none'

  274.         fail_msg: >-

  275.           FluffyChat has unexpected command or Docker lifecycle values:

  276.           entrypoint={{ matrix_client_fluffychat_runtime.Config.Entrypoint }},

  277.           command={{ matrix_client_fluffychat_runtime.Config.Cmd }},

  278.           restart={{ matrix_client_fluffychat_runtime.HostConfig.RestartPolicy.Name }},

  279.           auto-remove={{ matrix_client_fluffychat_runtime.HostConfig.AutoRemove }},

  280.           log-driver={{ matrix_client_fluffychat_runtime.HostConfig.LogConfig.Type }}

  281.         success_msg: "The role preserves the image command and exact Docker lifecycle contract"

  282. 

  283.     - name: Assert the running container security contract

  284.       ansible.builtin.assert:

  285.         that:

  286.           - matrix_client_fluffychat_runtime.HostConfig.ReadonlyRootfs is sameas true

  287.           - matrix_client_fluffychat_runtime.HostConfig.Privileged is sameas false

  288.           - matrix_client_fluffychat_runtime.HostConfig.CapAdd | default([], true) | length == 0

  289.           - matrix_client_fluffychat_runtime.HostConfig.CapDrop == ['ALL']

  290.         fail_msg: "The FluffyChat container is missing its read-only root or dropped capabilities"

  291.         success_msg: "The FluffyChat container has a read-only root and all capabilities dropped"

  292. 

  293.     - name: Assert the intended writable path is a constrained tmpfs mount

  294.       ansible.builtin.assert:

  295.         that:

  296.           - matrix_client_fluffychat_runtime.HostConfig.Tmpfs.keys() | list == ['/tmp']

  297.           - matrix_client_fluffychat_runtime.HostConfig.Tmpfs['/tmp'] == 'rw,noexec,nosuid,size=10m'

  298.         fail_msg: "The running container does not have the role's exact /tmp tmpfs contract"

  299.         success_msg: "The running container has the exact constrained /tmp tmpfs mount"

  300. 

  301.     - name: Assert the role's configuration is mounted read-only at the image path

  302.       ansible.builtin.assert:

  303.         that:

  304.           - matrix_client_fluffychat_runtime.Mounts | length == 1

  305.           - matrix_client_fluffychat_runtime.Mounts[0].Type == 'bind'

  306.           - matrix_client_fluffychat_runtime.Mounts[0].Source == matrix_client_fluffychat_config_path ~ '/config.json'

  307.           - matrix_client_fluffychat_runtime.Mounts[0].Destination == '/var/public/config.json'

  308.           - matrix_client_fluffychat_runtime.Mounts[0].RW is sameas false

  309.         fail_msg: "The role-rendered config.json is not the container's sole read-only bind mount"

  310.         success_msg: "The role-rendered config.json is mounted read-only at the image's live path"

  311. 

  312.     - name: Assert the running container is attached only to its dedicated network

  313.       ansible.builtin.assert:

  314.         that:

  315.           - matrix_client_fluffychat_runtime.HostConfig.NetworkMode == matrix_client_fluffychat_container_network

  316.           - matrix_client_fluffychat_runtime.NetworkSettings.Networks is mapping

  317.           - matrix_client_fluffychat_runtime.NetworkSettings.Networks | length == 1

  318.           - matrix_client_fluffychat_container_network in matrix_client_fluffychat_runtime.NetworkSettings.Networks

  319.         fail_msg: >-

  320.           FluffyChat has unexpected network attachments:

  321.           {{ matrix_client_fluffychat_runtime.NetworkSettings.Networks.keys() | list }}

  322.         success_msg: "The running container is attached only to its dedicated network"

  323. 

  324.     - name: Assert the observable extra runtime argument reached Docker

  325.       ansible.builtin.assert:

  326.         that:

  327.           - matrix_client_fluffychat_runtime.Config.Hostname == 'fluffychat-molecule-runtime'

  328.         fail_msg: "The configured container hostname extra argument did not reach Docker"

  329.         success_msg: "The configured container extra argument reached Docker"

  330. 

  331.     - name: Probe the image's default HTTP port

  332.       ansible.builtin.command:

  333.         argv:

  334.           - docker

  335.           - run

  336.           - --rm

  337.           - --network={{ matrix_client_fluffychat_container_network }}

  338.           - "{{ molecule_shared_image_curl }}"

  339.           - --silent

  340.           - --show-error

  341.           - --connect-timeout

  342.           - "2"

  343.           - --max-time

  344.           - "3"

  345.           - --output

  346.           - /dev/null

  347.           - --write-out

  348.           - "HTTP_STATUS=%{http_code}"

  349.           - http://matrix-client-fluffychat:8080/

  350.       register: matrix_client_fluffychat_default_port_http

  351.       changed_when: false

  352.       failed_when: false

  353. 

  354.     - name: Assert the image's default HTTP port is closed

  355.       ansible.builtin.assert:

  356.         that:

  357.           - matrix_client_fluffychat_default_port_http.rc != 0

  358.           - matrix_client_fluffychat_default_port_http.stdout != 'HTTP_STATUS=200'

  359.         fail_msg: "FluffyChat still listens on the image's default port instead of only the configured port"

  360.         success_msg: "FluffyChat no longer listens on the image's default HTTP port"

  361. 

  362.     - name: Ask Docker for FluffyChat's published ports

  363.       ansible.builtin.command:

  364.         argv:

  365.           - docker

  366.           - container

  367.           - port

  368.           - matrix-client-fluffychat

  369.       register: matrix_client_fluffychat_published_ports

  370.       changed_when: false

  371.       failed_when: false

  372. 

  373.     - name: Assert the role publishes no host ports

  374.       ansible.builtin.assert:

  375.         that:

  376.           - matrix_client_fluffychat_runtime.HostConfig.PortBindings | default({}, true) | length == 0

  377.           - matrix_client_fluffychat_published_ports.rc == 0

  378.           - matrix_client_fluffychat_published_ports.stdout | trim | length == 0

  379.         fail_msg: >-

  380.           FluffyChat unexpectedly publishes a host port:

  381.           {{ matrix_client_fluffychat_published_ports.stdout | default('unknown') }}

  382.         success_msg: "The role leaves FluffyChat's HTTP port unpublished"