overmind
/
matrix-docker-ansible-deploy
огледало од https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
Креирај огранак 0
Код Дискусије 0 Издања 0 Вики Activity
Matrix Docker Ansible eploy
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
11908 Комити
2 Гране
137 MiB
 
 
 
Дрво: 8d50b2c735
Гране Ознаке
${ item.name }
Create branch ${ searchTerm }
from '8d50b2c735'
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-authentication-service/molecule/default/verify.yml

539 lines
30 KiB
Датотека Blame Историја 

  1. # SPDX-FileCopyrightText: 2026 Slavi Pantaleev

  2. #

  3. # SPDX-License-Identifier: AGPL-3.0-or-later

  4. 

  5. ---

  6. # MAS exits on a bad startup configuration rather than retrying in-process. The restart

  7. # counter guards that failure mode; live health, OIDC, JWKS, and schema checks carry the

  8. # stronger proof that the stable process is actually using what this role rendered.

  9. - name: Verify Matrix Authentication Service

  10.   hosts: all

  11.   become: true

  12.   vars_files:

  13.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"

  14.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"

  15.   gather_facts: false

  16.   vars:

  17.     matrix_authentication_service_config: >-

  18.       {{ matrix_authentication_service_config_file.content | b64decode | from_yaml }}

  19.     matrix_authentication_service_web_listener: >-

  20.       {{ matrix_authentication_service_config.http.listeners

  21.          | selectattr('name', 'equalto', 'web') | first | default({}) }}

  22.     matrix_authentication_service_internal_listener: >-

  23.       {{ matrix_authentication_service_config.http.listeners

  24.          | selectattr('name', 'equalto', 'internal') | first | default({}) }}

  25.     matrix_authentication_service_discovery_body: >-

  26.       {{ matrix_authentication_service_discovery_http.stdout_lines[:-1] | join('\n') }}

  27.     matrix_authentication_service_discovery: >-

  28.       {{ matrix_authentication_service_discovery_body | from_json }}

  29.     matrix_authentication_service_jwks_body: >-

  30.       {{ matrix_authentication_service_jwks_http.stdout_lines[:-1] | join('\n') }}

  31.     matrix_authentication_service_jwks: >-

  32.       {{ matrix_authentication_service_jwks_body | from_json }}

  33.     matrix_authentication_service_jwks_kids: >-

  34.       {{ matrix_authentication_service_jwks['keys'] | map(attribute='kid') | list }}

  35.     matrix_authentication_service_labels_lines: >-

  36.       {{ (matrix_authentication_service_labels_file.content | b64decode).splitlines() }}

  37.     matrix_authentication_service_runtime: >-

  38.       {{ (matrix_authentication_service_container_inspect.stdout | from_json) | first }}

  39.     matrix_authentication_service_config_mounts: >-

  40.       {{ matrix_authentication_service_runtime.Mounts

  41.          | selectattr('Destination', 'equalto', '/config.yaml') | list }}

  42.     matrix_authentication_service_keys_mounts: >-

  43.       {{ matrix_authentication_service_runtime.Mounts

  44.          | selectattr('Destination', 'equalto', '/keys') | list }}

  45. 

  46.   tasks:

  47.     # Read the pin from the role itself so Renovate changes what this assertion expects.

  48.     - name: Load the role's defaults under a separate name

  49.       ansible.builtin.include_vars:

  50.         file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"

  51.         name: matrix_authentication_service_role_defaults

  52. 

  53.     - name: Wait for the Matrix Authentication Service unit to become active

  54.       ansible.builtin.systemd_service:

  55.         name: matrix-authentication-service.service

  56.       register: matrix_authentication_service_service

  57.       until: matrix_authentication_service_service.status.ActiveState == 'active'

  58.       retries: 30

  59.       delay: 5

  60.       failed_when: false

  61. 

  62.     - name: Assert the Matrix Authentication Service process is stable

  63.       ansible.builtin.assert:

  64.         that:

  65.           - matrix_authentication_service_service.status.ActiveState == 'active'

  66.           - matrix_authentication_service_service.status.NRestarts is defined

  67.           - matrix_authentication_service_service.status.NRestarts | int == 0

  68.         fail_msg: >-

  69.           matrix-authentication-service.service is

  70.           {{ matrix_authentication_service_service.status.ActiveState | default('unknown') }}

  71.           after {{ matrix_authentication_service_service.status.NRestarts | default('?') }} restart(s)

  72.         success_msg: "Matrix Authentication Service is active and has not restarted"

  73. 

  74.     # The internal listener binds loopback inside the MAS container. Sharing its network

  75.     # namespace is the only way to probe it without changing the deployment contract.

  76.     - name: Request the prefixed internal health endpoint

  77.       ansible.builtin.command:

  78.         argv:

  79.           - docker

  80.           - run

  81.           - --rm

  82.           - --network=container:matrix-authentication-service

  83.           - "{{ molecule_shared_image_curl }}"

  84.           - --silent

  85.           - --show-error

  86.           - --write-out

  87.           - "\nHTTP_STATUS=%{http_code}"

  88.           - http://[::1]:8081/molecule-auth/health

  89.       register: matrix_authentication_service_health_http

  90.       changed_when: false

  91.       until: "'HTTP_STATUS=200' in matrix_authentication_service_health_http.stdout"

  92.       retries: 24

  93.       delay: 5

  94.       failed_when: false

  95. 

  96.     - name: Assert the internal listener reports healthy

  97.       ansible.builtin.assert:

  98.         that:

  99.           - matrix_authentication_service_health_http.rc == 0

  100.           - matrix_authentication_service_health_http.stdout_lines[-1] == 'HTTP_STATUS=200'

  101.           - matrix_authentication_service_health_http.stdout_lines[0] == 'ok'

  102.         fail_msg: >-

  103.           MAS did not report healthy on its prefixed, loopback-only internal listener

  104.           ({{ matrix_authentication_service_health_http.stdout | default('no output') }})

  105.         success_msg: "MAS reports healthy on the prefixed internal listener"

  106. 

  107.     - name: Request the unprefixed internal health path

  108.       ansible.builtin.command:

  109.         argv:

  110.           - docker

  111.           - run

  112.           - --rm

  113.           - --network=container:matrix-authentication-service

  114.           - "{{ molecule_shared_image_curl }}"

  115.           - --silent

  116.           - --output

  117.           - /dev/null

  118.           - --write-out

  119.           - "HTTP_STATUS=%{http_code}"

  120.           - http://[::1]:8081/health

  121.       register: matrix_authentication_service_unprefixed_health_http

  122.       changed_when: false

  123.       failed_when: false

  124. 

  125.     - name: Assert the internal health resource exists only below the configured prefix

  126.       ansible.builtin.assert:

  127.         that:

  128.           - matrix_authentication_service_unprefixed_health_http.rc == 0

  129.           - matrix_authentication_service_unprefixed_health_http.stdout == 'HTTP_STATUS=404'

  130.         fail_msg: "The unprefixed health path answered, so the configured prefix is not proven"

  131.         success_msg: "The internal listener rejects the unprefixed health path"

  132. 

  133.     # Probed through the private network because the role deliberately publishes no host port.

  134.     - name: Request the prefixed OpenID Provider discovery document

  135.       ansible.builtin.command:

  136.         argv:

  137.           - docker

  138.           - run

  139.           - --rm

  140.           - --network={{ matrix_authentication_service_container_network }}

  141.           - "{{ molecule_shared_image_curl }}"

  142.           - --silent

  143.           - --show-error

  144.           - --write-out

  145.           - "\nHTTP_STATUS=%{http_code}"

  146.           - http://matrix-authentication-service:8080/molecule-auth/.well-known/openid-configuration

  147.       register: matrix_authentication_service_discovery_http

  148.       changed_when: false

  149.       until: "'HTTP_STATUS=200' in matrix_authentication_service_discovery_http.stdout"

  150.       retries: 24

  151.       delay: 5

  152.       failed_when: false

  153. 

  154.     - name: Assert MAS serves a real OpenID Provider discovery document

  155.       ansible.builtin.assert:

  156.         that:

  157.           - matrix_authentication_service_discovery_http.rc == 0

  158.           - matrix_authentication_service_discovery_http.stdout_lines[-1] == 'HTTP_STATUS=200'

  159.           - matrix_authentication_service_discovery is mapping

  160.           - matrix_authentication_service_discovery.issuer == 'https://mas.molecule.local/molecule-auth/'

  161.           - matrix_authentication_service_discovery.authorization_endpoint == 'https://mas.molecule.local/molecule-auth/authorize'

  162.           - matrix_authentication_service_discovery.token_endpoint == 'https://mas.molecule.local/molecule-auth/oauth2/token'

  163.           - matrix_authentication_service_discovery.jwks_uri == 'https://mas.molecule.local/molecule-auth/oauth2/keys.json'

  164.           - matrix_authentication_service_discovery.userinfo_endpoint == 'https://mas.molecule.local/molecule-auth/oauth2/userinfo'

  165.           - "'openid' in matrix_authentication_service_discovery.scopes_supported"

  166.           - "'authorization_code' in matrix_authentication_service_discovery.grant_types_supported"

  167.           - "'S256' in matrix_authentication_service_discovery.code_challenge_methods_supported"

  168.         fail_msg: >-

  169.           MAS did not return the configured, prefixed OIDC discovery contract

  170.           ({{ matrix_authentication_service_discovery_http.stdout | default('no output') }})

  171.         success_msg: "MAS advertises its configured prefixed OpenID Provider contract"

  172. 

  173.     - name: Request the unprefixed discovery path

  174.       ansible.builtin.command:

  175.         argv:

  176.           - docker

  177.           - run

  178.           - --rm

  179.           - --network={{ matrix_authentication_service_container_network }}

  180.           - "{{ molecule_shared_image_curl }}"

  181.           - --silent

  182.           - --output

  183.           - /dev/null

  184.           - --write-out

  185.           - "HTTP_STATUS=%{http_code}"

  186.           - http://matrix-authentication-service:8080/.well-known/openid-configuration

  187.       register: matrix_authentication_service_unprefixed_discovery_http

  188.       changed_when: false

  189.       failed_when: false

  190. 

  191.     - name: Assert discovery exists only below the configured prefix

  192.       ansible.builtin.assert:

  193.         that:

  194.           - matrix_authentication_service_unprefixed_discovery_http.rc == 0

  195.           - matrix_authentication_service_unprefixed_discovery_http.stdout == 'HTTP_STATUS=404'

  196.         fail_msg: "The unprefixed discovery path answered, so the configured prefix is not proven"

  197.         success_msg: "The public listener rejects the unprefixed discovery path"

  198. 

  199.     - name: Request the JWKS advertised by discovery

  200.       ansible.builtin.command:

  201.         argv:

  202.           - docker

  203.           - run

  204.           - --rm

  205.           - --network={{ matrix_authentication_service_container_network }}

  206.           - "{{ molecule_shared_image_curl }}"

  207.           - --silent

  208.           - --show-error

  209.           - --write-out

  210.           - "\nHTTP_STATUS=%{http_code}"

  211.           - http://matrix-authentication-service:8080/molecule-auth/oauth2/keys.json

  212.       register: matrix_authentication_service_jwks_http

  213.       changed_when: false

  214.       failed_when: false

  215. 

  216.     - name: Assert JWKS exposes all role-managed signing keys

  217.       ansible.builtin.assert:

  218.         that:

  219.           - matrix_authentication_service_jwks_http.rc == 0

  220.           - matrix_authentication_service_jwks_http.stdout_lines[-1] == 'HTTP_STATUS=200'

  221.           - matrix_authentication_service_jwks is mapping

  222.           - matrix_authentication_service_jwks['keys'] is sequence

  223.           - matrix_authentication_service_jwks['keys'] | length == 4

  224.           - "'default-rsa' in matrix_authentication_service_jwks_kids"

  225.           - "'default-ecdsa-p256' in matrix_authentication_service_jwks_kids"

  226.           - "'default-ecdsa-p384' in matrix_authentication_service_jwks_kids"

  227.           - "'default-ecdsa-k256' in matrix_authentication_service_jwks_kids"

  228.           - (matrix_authentication_service_jwks['keys'] | selectattr('kid', 'equalto', 'default-rsa') | first).kty == 'RSA'

  229.           - (matrix_authentication_service_jwks['keys'] | selectattr('kid', 'equalto', 'default-rsa') | first).n | length > 100

  230.           - (matrix_authentication_service_jwks['keys'] | selectattr('kid', 'equalto', 'default-ecdsa-p256') | first).crv == 'P-256'

  231.           - (matrix_authentication_service_jwks['keys'] | selectattr('kid', 'equalto', 'default-ecdsa-p384') | first).crv == 'P-384'

  232.           - (matrix_authentication_service_jwks['keys'] | selectattr('kid', 'equalto', 'default-ecdsa-k256') | first).crv == 'secp256k1'

  233.         fail_msg: "MAS did not derive the expected public JWKS from all four managed keys"

  234.         success_msg: "MAS exposes all four role-managed signing keys in its public JWKS"

  235. 

  236.     - name: Read the rendered MAS configuration

  237.       ansible.builtin.slurp:

  238.         src: "{{ matrix_authentication_service_config_path }}/config.yaml"

  239.       register: matrix_authentication_service_config_file

  240. 

  241.     - name: Read the rendered MAS configuration identity

  242.       ansible.builtin.stat:

  243.         path: "{{ matrix_authentication_service_config_path }}/config.yaml"

  244.       register: matrix_authentication_service_config_stat

  245. 

  246.     - name: Assert the parsed listener and public URL configuration

  247.       ansible.builtin.assert:

  248.         that:

  249.           - matrix_authentication_service_config.http.listeners | length == 2

  250.           - matrix_authentication_service_web_listener.resources | map(attribute='name') | list == ['discovery', 'human', 'oauth', 'compat', 'graphql', 'assets']

  251.           - "matrix_authentication_service_web_listener.binds == [{'address': '[::]:8080'}]"

  252.           - matrix_authentication_service_web_listener.prefix == '/molecule-auth'

  253.           - not matrix_authentication_service_web_listener.proxy_protocol

  254.           - "matrix_authentication_service_internal_listener.resources == [{'name': 'health'}]"

  255.           - "matrix_authentication_service_internal_listener.binds == [{'host': 'localhost', 'port': 8081}]"

  256.           - matrix_authentication_service_internal_listener.prefix == '/molecule-auth'

  257.           - matrix_authentication_service_config.http.public_base == 'https://mas.molecule.local/molecule-auth/'

  258.           - matrix_authentication_service_config.http.issuer == 'https://mas.molecule.local/molecule-auth/'

  259.           - matrix_authentication_service_config.http.trusted_proxies == ['198.51.100.0/24', '2001:db8:1234::/48']

  260.         fail_msg: "The parsed MAS listener or public URL configuration is incorrect"

  261.         success_msg: "The parsed MAS configuration carries the non-default listener contract"

  262. 

  263.     - name: Assert the parsed Postgres pool configuration

  264.       ansible.builtin.assert:

  265.         that:

  266.           - matrix_authentication_service_config.database.host == matrix_authentication_service_config_database_host

  267.           - matrix_authentication_service_config.database.port == matrix_authentication_service_config_database_port

  268.           - matrix_authentication_service_config.database.username == matrix_authentication_service_config_database_username

  269.           - matrix_authentication_service_config.database.password == matrix_authentication_service_config_database_password

  270.           - matrix_authentication_service_config.database.database == matrix_authentication_service_config_database_database

  271.           - matrix_authentication_service_config.database.ssl_mode == 'disable'

  272.           - matrix_authentication_service_config.database.max_connections == 7

  273.           - matrix_authentication_service_config.database.min_connections == 2

  274.           - matrix_authentication_service_config.database.connect_timeout == 17

  275.         fail_msg: "The parsed MAS configuration does not point at scenario Postgres"

  276.         success_msg: "The parsed MAS configuration points at scenario Postgres"

  277.       no_log: true

  278. 

  279.     - name: Assert the parsed Matrix and cryptographic configuration

  280.       ansible.builtin.assert:

  281.         that:

  282.           - matrix_authentication_service_config.matrix.homeserver == 'molecule.local'

  283.           - matrix_authentication_service_config.matrix.endpoint == 'http://matrix.molecule.local:8008'

  284.           - matrix_authentication_service_config.matrix.secret == matrix_authentication_service_config_matrix_secret

  285.           - matrix_authentication_service_config.secrets.encryption == matrix_authentication_service_config_secrets_encryption

  286.           - matrix_authentication_service_config.secrets['keys'] | map(attribute='kid') | list == ['default-rsa', 'default-ecdsa-p256', 'default-ecdsa-p384', 'default-ecdsa-k256']

  287.           - matrix_authentication_service_config.secrets['keys'] | map(attribute='key_file') | list == ['/keys/rsa-2048.priv.pem', '/keys/ecdsa-p256.priv.pem', '/keys/ecdsa-p384.priv.pem', '/keys/ecdsa-k256.priv.pem']

  288.         fail_msg: "The parsed MAS Matrix or signing-key configuration is incorrect"

  289.         success_msg: "The parsed MAS configuration carries its Matrix secrets and managed keys"

  290.       no_log: true

  291. 

  292.     - name: Assert the parsed non-default account behavior

  293.       ansible.builtin.assert:

  294.         that:

  295.           - not matrix_authentication_service_config.account.displayname_change_allowed

  296.           - matrix_authentication_service_config.account.password_registration_enabled

  297.           - not matrix_authentication_service_config.account.password_registration_email_required

  298.           - matrix_authentication_service_config.account.password_recovery_enabled

  299.           - matrix_authentication_service_config.account.login_with_email_allowed

  300.           - matrix_authentication_service_config.passwords.minimum_complexity == 2

  301.           - matrix_authentication_service_config.email.from == '"Molecule MAS" <auth@molecule.local>'

  302.           - matrix_authentication_service_config.email.transport == 'blackhole'

  303.           - matrix_authentication_service_config.clients == []

  304.           - "'upstream_oauth2' not in matrix_authentication_service_config"

  305.           - "'captcha' not in matrix_authentication_service_config"

  306.         fail_msg: "The parsed MAS configuration does not carry the scenario account behavior"

  307.         success_msg: "The parsed MAS configuration carries the non-default account behavior"

  308. 

  309.     - name: Assert the rendered configuration file identity

  310.       ansible.builtin.assert:

  311.         that:

  312.           - matrix_authentication_service_config_stat.stat.uid | int == matrix_user_uid | int

  313.           - matrix_authentication_service_config_stat.stat.gid | int == matrix_user_gid | int

  314.           - matrix_authentication_service_config_stat.stat.mode == '0644'

  315.         fail_msg: "config.yaml has the wrong ownership or mode"

  316.         success_msg: "config.yaml has the playbook identity and expected mode"

  317. 

  318.     - name: Read the managed signing-key identities

  319.       ansible.builtin.stat:

  320.         path: "{{ matrix_authentication_service_data_keys_path }}/{{ key_file }}"

  321.       loop:

  322.         - rsa-2048.priv.pem

  323.         - ecdsa-p256.priv.pem

  324.         - ecdsa-p384.priv.pem

  325.         - ecdsa-k256.priv.pem

  326.       loop_control:

  327.         loop_var: key_file

  328.       register: matrix_authentication_service_key_stats

  329. 

  330.     - name: Assert every managed signing key is non-empty and private

  331.       ansible.builtin.assert:

  332.         that:

  333.           - key_stat.stat.exists

  334.           - key_stat.stat.isreg

  335.           - key_stat.stat.size | int > 200

  336.           - key_stat.stat.uid | int == matrix_user_uid | int

  337.           - key_stat.stat.gid | int == matrix_user_gid | int

  338.           - key_stat.stat.mode == '0600'

  339.         fail_msg: "A managed MAS signing key is missing, empty, exposed, or misowned"

  340.         success_msg: "The managed MAS signing key is present and private"

  341.       loop: "{{ matrix_authentication_service_key_stats.results }}"

  342.       loop_control:

  343.         loop_var: key_stat

  344.         label: "{{ key_stat.key_file }}"

  345. 

  346.     - name: Validate every managed signing key with OpenSSL

  347.       ansible.builtin.command:

  348.         argv:

  349.           - openssl

  350.           - pkey

  351.           - -in

  352.           - "{{ matrix_authentication_service_data_keys_path }}/{{ key_file }}"

  353.           - -check

  354.           - -noout

  355.       loop:

  356.         - rsa-2048.priv.pem

  357.         - ecdsa-p256.priv.pem

  358.         - ecdsa-p384.priv.pem

  359.         - ecdsa-k256.priv.pem

  360.       loop_control:

  361.         loop_var: key_file

  362.       register: matrix_authentication_service_key_validation

  363.       changed_when: false

  364. 

  365.     - name: Assert OpenSSL accepts every managed signing key

  366.       ansible.builtin.assert:

  367.         that:

  368.           - key_validation.rc == 0

  369.         fail_msg: "OpenSSL rejected a role-managed MAS signing key"

  370.         success_msg: "OpenSSL accepts the role-managed MAS signing key"

  371.       loop: "{{ matrix_authentication_service_key_validation.results }}"

  372.       loop_control:

  373.         loop_var: key_validation

  374.         label: "{{ key_validation.key_file }}"

  375. 

  376.     # These tables can only exist after MAS has reached the named host, authenticated as

  377.     # the non-default role, selected the non-default database, and run genuine migrations.

  378.     - name: List the tables MAS created in Postgres

  379.       ansible.builtin.command:

  380.         argv:

  381.           - docker

  382.           - exec

  383.           - matrix-postgres-molecule

  384.           - psql

  385.           - --username={{ matrix_authentication_service_config_database_username }}

  386.           - --dbname={{ matrix_authentication_service_config_database_database }}

  387.           - --tuples-only

  388.           - --no-align

  389.           - --command=SELECT tablename FROM pg_tables WHERE schemaname = 'public'

  390.       register: matrix_authentication_service_tables

  391.       changed_when: false

  392. 

  393.     - name: Count successful MAS migrations in Postgres

  394.       ansible.builtin.command:

  395.         argv:

  396.           - docker

  397.           - exec

  398.           - matrix-postgres-molecule

  399.           - psql

  400.           - --username={{ matrix_authentication_service_config_database_username }}

  401.           - --dbname={{ matrix_authentication_service_config_database_database }}

  402.           - --tuples-only

  403.           - --no-align

  404.           - --command=SELECT count(*) FROM _sqlx_migrations WHERE success

  405.       register: matrix_authentication_service_migrations

  406.       changed_when: false

  407. 

  408.     - name: Assert MAS genuinely migrated the configured Postgres database

  409.       ansible.builtin.assert:

  410.         that:

  411.           - matrix_authentication_service_tables.rc == 0

  412.           - "'_sqlx_migrations' in matrix_authentication_service_table_names"

  413.           - "'users' in matrix_authentication_service_table_names"

  414.           - "'user_sessions' in matrix_authentication_service_table_names"

  415.           - "'oauth2_clients' in matrix_authentication_service_table_names"

  416.           - "'oauth2_access_tokens' in matrix_authentication_service_table_names"

  417.           - "'upstream_oauth_providers' in matrix_authentication_service_table_names"

  418.           - matrix_authentication_service_table_names | length > 30

  419.           - matrix_authentication_service_migrations.rc == 0

  420.           - matrix_authentication_service_migrations.stdout | trim | int > 100

  421.         fail_msg: >-

  422.           MAS did not genuinely migrate {{ matrix_authentication_service_config_database_database }}

  423.           ({{ matrix_authentication_service_table_names | length }} tables,

  424.           {{ matrix_authentication_service_migrations.stdout | trim | default('?') }} migrations)

  425.         success_msg: "MAS genuinely migrated the configured Postgres database"

  426.       vars:

  427.         matrix_authentication_service_table_names: >-

  428.           {{ matrix_authentication_service_tables.stdout_lines | select | list }}

  429. 

  430.     - name: Read the Traefik labels the role rendered

  431.       ansible.builtin.slurp:

  432.         src: "{{ matrix_authentication_service_config_path }}/labels"

  433.       register: matrix_authentication_service_labels_file

  434. 

  435.     - name: Assert the rendered labels carry the non-default public routing contract

  436.       ansible.builtin.assert:

  437.         that:

  438.           - "'traefik.enable=true' in matrix_authentication_service_labels_lines"

  439.           - "'traefik.docker.network=matrix-authentication-service-molecule' in matrix_authentication_service_labels_lines"

  440.           - "'traefik.http.services.matrix-authentication-service.loadbalancer.server.port=8080' in matrix_authentication_service_labels_lines"

  441.           - "'traefik.http.routers.matrix-authentication-service.rule=Host(`mas.molecule.local`) && PathPrefix(`/molecule-auth`)' in matrix_authentication_service_labels_lines"

  442.           - "'traefik.http.routers.matrix-authentication-service.priority=742' in matrix_authentication_service_labels_lines"

  443.           - "'traefik.http.middlewares.matrix-authentication-service-slashless-redirect.redirectregex.regex=(/molecule-auth)$' in matrix_authentication_service_labels_lines"

  444.           - "'traefik.http.middlewares.matrix-authentication-service-add-headers.headers.customresponseheaders.X-Molecule-MAS=covered' in matrix_authentication_service_labels_lines"

  445.           - "'traefik.http.routers.matrix-authentication-service.middlewares=matrix-authentication-service-slashless-redirect,matrix-authentication-service-add-headers' in matrix_authentication_service_labels_lines"

  446.           - "'traefik.http.routers.matrix-authentication-service.entrypoints=web' in matrix_authentication_service_labels_lines"

  447.           - "'traefik.http.routers.matrix-authentication-service.tls=false' in matrix_authentication_service_labels_lines"

  448.           - "'molecule.mas.coverage=enabled' in matrix_authentication_service_labels_lines"

  449.         fail_msg: "The rendered labels do not carry the configured public MAS route"

  450.         success_msg: "The rendered labels carry the configured public MAS route"

  451. 

  452.     - name: Assert the rendered labels carry the compatibility-layer route

  453.       ansible.builtin.assert:

  454.         that:

  455.           - "'traefik.http.middlewares.matrix-authentication-service-add-prefix.addprefix.prefix=/molecule-auth' in matrix_authentication_service_labels_lines"

  456.           - "'traefik.http.routers._internalmatrix-authentication-service-public-compatibility-layer.rule=Host(`matrix.molecule.local`) && PathRegexp(`^/_matrix/client/(?P<version>([^/]+))/(?P<endpoint>(login|logout|refresh))`)' in matrix_authentication_service_labels_lines"

  457.           - "'traefik.http.routers._internalmatrix-authentication-service-public-compatibility-layer.priority=743' in matrix_authentication_service_labels_lines"

  458.           - "'traefik.http.routers._internalmatrix-authentication-service-public-compatibility-layer.middlewares=matrix-authentication-service-add-prefix' in matrix_authentication_service_labels_lines"

  459.           - "'traefik.http.routers._internalmatrix-authentication-service-public-compatibility-layer.entrypoints=web' in matrix_authentication_service_labels_lines"

  460.           - "'traefik.http.routers._internalmatrix-authentication-service-public-compatibility-layer.tls=false' in matrix_authentication_service_labels_lines"

  461.         fail_msg: "The rendered labels do not carry the configured compatibility route"

  462.         success_msg: "The rendered labels carry the configured compatibility-layer route"

  463. 

  464.     - name: Inspect the running MAS container

  465.       ansible.builtin.command:

  466.         argv:

  467.           - docker

  468.           - container

  469.           - inspect

  470.           - matrix-authentication-service

  471.       register: matrix_authentication_service_container_inspect

  472.       changed_when: false

  473. 

  474.     - name: Assert the running container uses the exact image pinned by the role

  475.       ansible.builtin.assert:

  476.         that:

  477.           - matrix_authentication_service_runtime.Config.Image == 'ghcr.io/element-hq/matrix-authentication-service:' + matrix_authentication_service_role_defaults.matrix_authentication_service_version

  478.         fail_msg: "The running MAS container does not use the exact role-pinned image"

  479.         success_msg: "The running MAS container uses the exact role-pinned image"

  480. 

  481.     - name: Assert the running container uses the playbook identity

  482.       ansible.builtin.assert:

  483.         that:

  484.           - matrix_authentication_service_runtime.Config.User == (matrix_user_uid | string) + ':' + (matrix_user_gid | string)

  485.         fail_msg: "The running MAS container does not use the playbook UID and GID"

  486.         success_msg: "The running MAS container uses the playbook UID and GID"

  487. 

  488.     - name: Assert the running container security isolation

  489.       ansible.builtin.assert:

  490.         that:

  491.           - matrix_authentication_service_runtime.HostConfig.ReadonlyRootfs is sameas true

  492.           - matrix_authentication_service_runtime.HostConfig.CapDrop == ['ALL']

  493.           - not matrix_authentication_service_runtime.HostConfig.Privileged

  494.         fail_msg: "The running MAS container lacks read-only, capability-dropped isolation"

  495.         success_msg: "The running MAS container has read-only, capability-dropped isolation"

  496. 

  497.     - name: Assert the running container mounts only configuration and keys read-only

  498.       ansible.builtin.assert:

  499.         that:

  500.           - matrix_authentication_service_runtime.Mounts | length == 2

  501.           - matrix_authentication_service_config_mounts | length == 1

  502.           - matrix_authentication_service_config_mounts[0].RW is sameas false

  503.           - matrix_authentication_service_keys_mounts | length == 1

  504.           - matrix_authentication_service_keys_mounts[0].RW is sameas false

  505.         fail_msg: "The running MAS container's config or key mount contract is incorrect"

  506.         success_msg: "The running MAS container mounts only configuration and keys read-only"

  507. 

  508.     - name: Assert the running container has only its dedicated network

  509.       ansible.builtin.assert:

  510.         that:

  511.           - matrix_authentication_service_runtime.NetworkSettings.Networks is mapping

  512.           - matrix_authentication_service_runtime.NetworkSettings.Networks | length == 1

  513.           - matrix_authentication_service_container_network in matrix_authentication_service_runtime.NetworkSettings.Networks

  514.         fail_msg: "The running MAS container has unexpected network attachments"

  515.         success_msg: "The running MAS container has only its dedicated network"

  516. 

  517.     - name: Assert the running container publishes no host ports

  518.       ansible.builtin.assert:

  519.         that:

  520.           - matrix_authentication_service_runtime.HostConfig.PortBindings | default({}, true) | length == 0

  521.           - matrix_authentication_service_runtime.NetworkSettings.Ports | default({}, true) | length == 0

  522.           - not matrix_authentication_service_runtime.HostConfig.PublishAllPorts

  523.         fail_msg: "The running MAS container unexpectedly publishes a host port"

  524.         success_msg: "The running MAS container publishes no host ports"

  525. 

  526.     - name: Assert Docker accepted the role's exact routing labels

  527.       ansible.builtin.assert:

  528.         that:

  529.           - matrix_authentication_service_runtime.Config.Labels is mapping

  530.           - matrix_authentication_service_runtime.Config.Labels['molecule.mas.coverage'] == 'enabled'

  531.           - matrix_authentication_service_runtime.Config.Labels['traefik.docker.network'] == 'matrix-authentication-service-molecule'

  532.           - matrix_authentication_service_runtime.Config.Labels['traefik.http.services.matrix-authentication-service.loadbalancer.server.port'] == '8080'

  533.           - matrix_authentication_service_runtime.Config.Labels['traefik.http.routers.matrix-authentication-service.rule'] == 'Host(`mas.molecule.local`) && PathPrefix(`/molecule-auth`)'

  534.           - matrix_authentication_service_runtime.Config.Labels['traefik.http.routers.matrix-authentication-service.priority'] == '742'

  535.           - matrix_authentication_service_runtime.Config.Labels['traefik.http.routers._internalmatrix-authentication-service-public-compatibility-layer.priority'] == '743'

  536.           - matrix_authentication_service_runtime.Config.Labels['traefik.http.middlewares.matrix-authentication-service-add-headers.headers.customresponseheaders.X-Molecule-MAS'] == 'covered'

  537.         fail_msg: "Docker did not attach the exact labels rendered by the role"

  538.         success_msg: "Docker attached the exact routing labels rendered by the role"