overmind
/
matrix-docker-ansible-deploy
kopie van https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
Vork 0
Code Kwesties 0 Publicaties 0 Wiki Activiteit
Matrix Docker Ansible eploy
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
11892 Commits
1 Branch
174 MiB
 
 
 
Tree: 8ccabc46ec
Branches Labels
${ item.name }
Maak branch ${ searchTerm }
van '8ccabc46ec'
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-bridge-mautrix-signal/molecule/default/verify.yml

272 regels
14 KiB
Ruw Blame Geschiedenis 

  1. # SPDX-FileCopyrightText: 2026 Slavi Pantaleev

  2. #

  3. # SPDX-License-Identifier: AGPL-3.0-or-later

  4. 

  5. ---

  6. # Proves the bridge starts without a Signal account, accepts the configuration and

  7. # registration the role rendered, becomes ready against the homeserver stub, migrates its

  8. # Postgres schema, and carries the role's runtime identity and public-exposure wiring.

  9. - name: Verify mautrix-signal

  10.   hosts: all

  11.   become: true

  12.   vars_files:

  13.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"

  14.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"

  15.   # Lazily evaluated after the corresponding slurp. Keeping these as play vars avoids

  16.   # repeatedly templating the Go templates embedded in the bridge configuration.

  17.   vars:

  18.     mautrix_signal_config: "{{ mautrix_signal_config_file.content | b64decode | from_yaml }}"

  19.     mautrix_signal_registration: "{{ mautrix_signal_registration_file.content | b64decode | from_yaml }}"

  20.     mautrix_signal_labels_rendered: "{{ mautrix_signal_labels.content | b64decode }}"

  21.     mautrix_signal_expected_public_address: http://signal-api.molecule.local/bridges/signal-api

  22.   gather_facts: false

  23. 

  24.   tasks:

  25.     - name: Load the role's defaults under a separate name

  26.       ansible.builtin.include_vars:

  27.         file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"

  28.         name: mautrix_signal_role_defaults

  29. 

  30.     - name: Wait for the mautrix-signal service to become active

  31.       ansible.builtin.systemd_service:

  32.         name: matrix-mautrix-signal.service

  33.       register: mautrix_signal_service

  34.       until: mautrix_signal_service.status.ActiveState == 'active'

  35.       retries: 30

  36.       delay: 5

  37.       failed_when: false

  38. 

  39.     # Restart=always makes ActiveState alone insufficient for a crash-looping bridge.

  40.     - name: Assert the service is active and has not been restarting

  41.       ansible.builtin.assert:

  42.         that:

  43.           - mautrix_signal_service.status.ActiveState == 'active'

  44.           - mautrix_signal_service.status.NRestarts is defined

  45.           - mautrix_signal_service.status.NRestarts | int == 0

  46.         fail_msg: >-

  47.           matrix-mautrix-signal.service is

  48.           {{ mautrix_signal_service.status.ActiveState | default('unknown') }}

  49.           after {{ mautrix_signal_service.status.NRestarts | default('?') }} restart(s)

  50.         success_msg: "matrix-mautrix-signal.service is active and has not restarted"

  51. 

  52.     # /live proves the appservice listener opened; /ready additionally proves startup passed

  53.     # the homeserver identity check and database initialization.

  54.     - name: Wait for the bridge liveness endpoint

  55.       ansible.builtin.command:

  56.         argv:

  57.           - docker

  58.           - run

  59.           - --rm

  60.           - --network={{ matrix_bridge_mautrix_signal_container_network }}

  61.           - "{{ molecule_shared_image_curl }}"

  62.           - --silent

  63.           - --output

  64.           - /dev/null

  65.           - --write-out

  66.           - "HTTP_STATUS=%{http_code}"

  67.           - http://matrix-mautrix-signal:8080/_matrix/mau/live

  68.       register: mautrix_signal_live

  69.       changed_when: false

  70.       until: "'HTTP_STATUS=200' in mautrix_signal_live.stdout"

  71.       retries: 24

  72.       delay: 5

  73.       failed_when: false

  74. 

  75.     - name: Wait for the bridge readiness endpoint

  76.       ansible.builtin.command:

  77.         argv:

  78.           - docker

  79.           - run

  80.           - --rm

  81.           - --network={{ matrix_bridge_mautrix_signal_container_network }}

  82.           - "{{ molecule_shared_image_curl }}"

  83.           - --silent

  84.           - --output

  85.           - /dev/null

  86.           - --write-out

  87.           - "HTTP_STATUS=%{http_code}"

  88.           - http://matrix-mautrix-signal:8080/_matrix/mau/ready

  89.       register: mautrix_signal_ready

  90.       changed_when: false

  91.       until: "'HTTP_STATUS=200' in mautrix_signal_ready.stdout"

  92.       retries: 24

  93.       delay: 5

  94.       failed_when: false

  95. 

  96.     - name: Assert the bridge is live and ready on its appservice port

  97.       ansible.builtin.assert:

  98.         that:

  99.           - "'HTTP_STATUS=200' in mautrix_signal_live.stdout"

  100.           - "'HTTP_STATUS=200' in mautrix_signal_ready.stdout"

  101.         fail_msg: >-

  102.           The appservice health responses were live={{ mautrix_signal_live.stdout | default('none') }}

  103.           and ready={{ mautrix_signal_ready.stdout | default('none') }}

  104.         success_msg: "The bridge is live and ready on its appservice port"

  105. 

  106.     - name: Read the configuration the role rendered

  107.       ansible.builtin.slurp:

  108.         src: "{{ matrix_bridge_mautrix_signal_config_path }}/config.yaml"

  109.       register: mautrix_signal_config_file

  110. 

  111.     - name: Assert the rendered configuration carries this scenario's values

  112.       ansible.builtin.assert:

  113.         that:

  114.           - mautrix_signal_config.homeserver.address == matrix_bridge_mautrix_signal_homeserver_address

  115.           - mautrix_signal_config.homeserver.domain == matrix_bridge_mautrix_signal_homeserver_domain

  116.           - mautrix_signal_config.appservice.bot.username == matrix_bridge_mautrix_signal_appservice_bot_username

  117.           - mautrix_signal_config.appservice.as_token == matrix_bridge_mautrix_signal_appservice_token

  118.           - mautrix_signal_config.appservice.hs_token == matrix_bridge_mautrix_signal_homeserver_token

  119.           - mautrix_signal_config.appservice.public_address == mautrix_signal_expected_public_address

  120.           - mautrix_signal_config.bridge.command_prefix == matrix_bridge_mautrix_signal_command_prefix

  121.           - mautrix_signal_config.bridge.relay.enabled

  122.           - not mautrix_signal_config.bridge.relay.admin_only

  123.           - not mautrix_signal_config.matrix.federate_rooms

  124.           - mautrix_signal_config.network.extev_polls

  125.           - mautrix_signal_config.backfill.max_initial_messages == 17

  126.           - mautrix_signal_config.logging.min_level == matrix_bridge_mautrix_signal_logging_level

  127.         fail_msg: "The rendered configuration does not carry the scenario's non-default values"

  128.         success_msg: "The rendered configuration carries the scenario's non-default values"

  129. 

  130.     - name: Assert the configuration points at the scenario's Postgres database

  131.       ansible.builtin.assert:

  132.         that:

  133.           - mautrix_signal_config.database.type == matrix_bridge_mautrix_signal_database_engine

  134.           - matrix_bridge_mautrix_signal_database_username in mautrix_signal_config.database.uri

  135.           - matrix_bridge_mautrix_signal_database_hostname in mautrix_signal_config.database.uri

  136.           - matrix_bridge_mautrix_signal_database_name in mautrix_signal_config.database.uri

  137.         fail_msg: >-

  138.           database.uri is {{ mautrix_signal_config.database.uri | default('unset') }}, which

  139.           was not composed from the scenario's connection settings

  140.         success_msg: "The configuration points at the scenario's Postgres database"

  141. 

  142.     - name: Read the appservice registration the role rendered

  143.       ansible.builtin.slurp:

  144.         src: "{{ matrix_bridge_mautrix_signal_config_path }}/registration.yaml"

  145.       register: mautrix_signal_registration_file

  146. 

  147.     - name: Assert the registration carries the tokens, identity and address

  148.       ansible.builtin.assert:

  149.         that:

  150.           - mautrix_signal_registration.id == 'signal'

  151.           - mautrix_signal_registration.as_token == matrix_bridge_mautrix_signal_appservice_token

  152.           - mautrix_signal_registration.hs_token == matrix_bridge_mautrix_signal_homeserver_token

  153.           - mautrix_signal_registration.sender_localpart == '_bot_' + matrix_bridge_mautrix_signal_appservice_bot_username

  154.           - mautrix_signal_registration.url == 'http://matrix-mautrix-signal:8080'

  155.         fail_msg: "The appservice registration does not carry the expected identity and tokens"

  156.         success_msg: "The appservice registration carries the expected identity and tokens"

  157. 

  158.     - name: Assert the registration namespaces cover the bot and Signal ghosts

  159.       ansible.builtin.assert:

  160.         that:

  161.           - mautrix_signal_ghost_regex | length > 0

  162.           - mautrix_signal_bot_regex | length > 0

  163.           - mautrix_signal_ghost_mxid is match(mautrix_signal_ghost_regex)

  164.           - mautrix_signal_wrong_ghost_mxid is not match(mautrix_signal_ghost_regex)

  165.           - mautrix_signal_bot_mxid is match(mautrix_signal_bot_regex)

  166.         fail_msg: "The registration namespaces do not cover the bot and Signal ghost identities"

  167.         success_msg: "The registration namespaces cover the bot and Signal ghost identities"

  168.       vars:

  169.         mautrix_signal_user_regexes: "{{ mautrix_signal_registration.namespaces.users | map(attribute='regex') | list }}"

  170.         mautrix_signal_ghost_regex: "{{ mautrix_signal_user_regexes | select('search', 'signal_') | first | default('') }}"

  171.         mautrix_signal_bot_regex: "{{ mautrix_signal_user_regexes | reject('search', 'signal_') | first | default('') }}"

  172.         mautrix_signal_ghost_mxid: "@signal_01234567-89ab-cdef-0123-456789abcdef:{{ matrix_bridge_mautrix_signal_homeserver_domain }}"

  173.         mautrix_signal_wrong_ghost_mxid: "@telegram_01234567-89ab-cdef-0123-456789abcdef:{{ matrix_bridge_mautrix_signal_homeserver_domain }}"

  174.         mautrix_signal_bot_mxid: "@{{ matrix_bridge_mautrix_signal_appservice_bot_username }}:{{ matrix_bridge_mautrix_signal_homeserver_domain }}"

  175. 

  176.     # Tables can only appear after hostname resolution, authentication, and migrations.

  177.     - name: List the tables the bridge created in Postgres

  178.       ansible.builtin.command:

  179.         argv:

  180.           - docker

  181.           - exec

  182.           - matrix-postgres-molecule

  183.           - psql

  184.           - --username={{ matrix_bridge_mautrix_signal_database_username }}

  185.           - --dbname={{ matrix_bridge_mautrix_signal_database_name }}

  186.           - --tuples-only

  187.           - --no-align

  188.           - --command=SELECT tablename FROM pg_tables WHERE schemaname = 'public'

  189.       register: mautrix_signal_tables

  190.       changed_when: false

  191. 

  192.     - name: Assert the bridge migrated its schema into the configured database

  193.       ansible.builtin.assert:

  194.         that:

  195.           - mautrix_signal_tables.rc == 0

  196.           - "'version' in mautrix_signal_table_names"

  197.           - mautrix_signal_table_names | length > 5

  198.         fail_msg: >-

  199.           The bridge did not create its schema in {{ matrix_bridge_mautrix_signal_database_name }}

  200.           (found {{ mautrix_signal_table_names | length }} table(s))

  201.         success_msg: "The bridge migrated its schema into the configured database"

  202.       vars:

  203.         mautrix_signal_table_names: "{{ mautrix_signal_tables.stdout_lines | select | list }}"

  204. 

  205.     - name: Read the running container's image and user identity

  206.       ansible.builtin.command:

  207.         argv:

  208.           - docker

  209.           - container

  210.           - inspect

  211.           - matrix-mautrix-signal

  212.           - --format

  213.           - "{{ '{{' }} .Config.Image {{ '}}' }}|{{ '{{' }} .Config.User {{ '}}' }}"

  214.       register: mautrix_signal_container_identity

  215.       changed_when: false

  216. 

  217.     - name: Assert the running container uses the exact pinned image

  218.       ansible.builtin.assert:

  219.         that:

  220.           - mautrix_signal_container_image == 'dock.mau.dev/mautrix/signal:' + mautrix_signal_role_defaults.matrix_bridge_mautrix_signal_version

  221.         fail_msg: "The running container does not use the exact image the role pins"

  222.         success_msg: "The running container uses the exact image the role pins"

  223.       vars:

  224.         mautrix_signal_container_image: "{{ mautrix_signal_container_identity.stdout.split('|')[0] }}"

  225. 

  226.     - name: Assert the running container uses the playbook-supplied identity

  227.       ansible.builtin.assert:

  228.         that:

  229.           - mautrix_signal_container_user == (matrix_user_uid | string) + ':' + (matrix_user_gid | string)

  230.         fail_msg: "The running container does not use the {{ matrix_user_uid }}:{{ matrix_user_gid }} identity"

  231.         success_msg: "The running container uses the playbook-supplied identity"

  232.       vars:

  233.         mautrix_signal_container_user: "{{ mautrix_signal_container_identity.stdout.split('|')[1] }}"

  234. 

  235.     - name: Read the labels the role rendered

  236.       ansible.builtin.slurp:

  237.         src: "{{ matrix_bridge_mautrix_signal_base_path }}/labels"

  238.       register: mautrix_signal_labels

  239. 

  240.     - name: Assert the labels route the public endpoint to the appservice port

  241.       ansible.builtin.assert:

  242.         that:

  243.           - "'traefik.enable=true' in mautrix_signal_labels_rendered"

  244.           - "'traefik.docker.network=' + matrix_bridge_mautrix_signal_container_network in mautrix_signal_labels_rendered"

  245.           - "'traefik.http.services.matrix-mautrix-signal-exposure.loadbalancer.server.port=8080' in mautrix_signal_labels_rendered"

  246.           - "'traefik.http.routers.matrix-mautrix-signal-exposure.rule=Host(`signal-api.molecule.local`) && PathPrefix(`/bridges/signal-api`)' in mautrix_signal_labels_rendered"

  247.           - "'traefik.http.middlewares.matrix-mautrix-signal-exposure-strip-prefix.stripprefix.prefixes=/bridges/signal-api' in mautrix_signal_labels_rendered"

  248.           - "'traefik.http.routers.matrix-mautrix-signal-exposure.entrypoints=web' in mautrix_signal_labels_rendered"

  249.           - "'traefik.http.routers.matrix-mautrix-signal-exposure.tls=false' in mautrix_signal_labels_rendered"

  250.           - "'molecule.signal.coverage=enabled' in mautrix_signal_labels_rendered"

  251.         fail_msg: "The rendered labels do not carry the scenario's exposure configuration"

  252.         success_msg: "The rendered labels carry the scenario's exposure configuration"

  253. 

  254.     - name: Read the custom label Docker attached to the running container

  255.       ansible.builtin.command:

  256.         argv:

  257.           - docker

  258.           - container

  259.           - inspect

  260.           - matrix-mautrix-signal

  261.           - --format

  262.           - "{{ '{{' }} index .Config.Labels \"molecule.signal.coverage\" {{ '}}' }}"

  263.       register: mautrix_signal_container_label

  264.       changed_when: false

  265. 

  266.     - name: Assert Docker accepted the label file the role rendered

  267.       ansible.builtin.assert:

  268.         that:

  269.           - mautrix_signal_container_label.stdout == 'enabled'

  270.         fail_msg: "Docker did not attach the role's custom Molecule label"

  271.         success_msg: "Docker accepted the label file the role rendered"