overmind
/
matrix-docker-ansible-deploy
镜像来自 https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
複製 0
程式碼 問題 0 版本發佈 0 Wiki 活動
Matrix Docker Ansible eploy
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
11936 提交
2 分支
137 MiB
 
 
 
目錄樹: 9dc72e45a8
分支列表 標籤
${ item.name }
建立分支 ${ searchTerm }
從 '9dc72e45a8'
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-bot-honoroit/molecule/default/verify.yml

442 line
25 KiB
原始文件 Blame 歷史記錄 

  1. # SPDX-FileCopyrightText: 2026 Slavi Pantaleev

  2. #

  3. # SPDX-License-Identifier: AGPL-3.0-or-later

  4. 

  5. ---

  6. - name: Verify matrix-bot-honoroit

  7.   hosts: all

  8.   become: true

  9.   vars_files:

  10.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"

  11.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"

  12.   vars:

  13.     matrix_bot_honoroit_health_body: "{{ matrix_bot_honoroit_health.stdout_lines[:-1] | join('\n') }}"

  14.     matrix_bot_honoroit_metrics_body: "{{ matrix_bot_honoroit_metrics.stdout_lines[:-1] | join('\n') }}"

  15.     matrix_bot_honoroit_metrics_lines: "{{ matrix_bot_honoroit_metrics_body.splitlines() | select | list }}"

  16.     matrix_bot_honoroit_rendered_env_lines: >-

  17.       {{ (matrix_bot_honoroit_env_file.content | b64decode).splitlines()

  18.          | select('match', '^[A-Z0-9_]+=') | list }}

  19.     matrix_bot_honoroit_rendered_env: >-

  20.       {{ dict(matrix_bot_honoroit_rendered_env_lines | map('split', '=', 1)) }}

  21.     matrix_bot_honoroit_rendered_labels_lines: >-

  22.       {{ (matrix_bot_honoroit_labels_file.content | b64decode).splitlines()

  23.          | select('match', '^[A-Za-z0-9_.-]+=') | list }}

  24.     matrix_bot_honoroit_rendered_labels: >-

  25.       {{ dict(matrix_bot_honoroit_rendered_labels_lines | map('split', '=', 1)) }}

  26.     matrix_bot_honoroit_runtime: "{{ (matrix_bot_honoroit_container_inspect.stdout | from_json) | first }}"

  27.     matrix_bot_honoroit_runtime_env: "{{ dict(matrix_bot_honoroit_runtime.Config.Env | map('split', '=', 1)) }}"

  28.     matrix_bot_honoroit_data_mounts: >-

  29.       {{ matrix_bot_honoroit_runtime.Mounts | selectattr('Destination', 'equalto', '/data') | list }}

  30.   gather_facts: false

  31.   tasks:

  32.     - name: Load the role's defaults under a separate name

  33.       ansible.builtin.include_vars:

  34.         file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"

  35.         name: matrix_bot_honoroit_role_defaults

  36. 

  37.     - name: Wait for the matrix-bot-honoroit service to become active

  38.       ansible.builtin.systemd_service:

  39.         name: matrix-bot-honoroit.service

  40.       register: matrix_bot_honoroit_service

  41.       until: matrix_bot_honoroit_service.status.ActiveState == 'active'

  42.       retries: 30

  43.       delay: 5

  44.       failed_when: false

  45. 

  46.     - name: Assert the service is active and has not restarted

  47.       ansible.builtin.assert:

  48.         that:

  49.           - matrix_bot_honoroit_service.status.ActiveState == 'active'

  50.           - matrix_bot_honoroit_service.status.NRestarts is defined

  51.           - matrix_bot_honoroit_service.status.NRestarts | int == 0

  52.         fail_msg: >-

  53.           matrix-bot-honoroit.service is

  54.           {{ matrix_bot_honoroit_service.status.ActiveState | default('unknown') }} after

  55.           {{ matrix_bot_honoroit_service.status.NRestarts | default('?') }} restart(s)

  56.         success_msg: "matrix-bot-honoroit.service is active and has not restarted"

  57. 

  58.     - name: Wait for Honoroit's health API

  59.       ansible.builtin.command:

  60.         argv:

  61.           - docker

  62.           - run

  63.           - --rm

  64.           - --network={{ matrix_bot_honoroit_container_network }}

  65.           - "{{ molecule_shared_image_curl }}"

  66.           - --silent

  67.           - --show-error

  68.           - --write-out

  69.           - "\nHTTP_STATUS=%{http_code}"

  70.           - "http://matrix-bot-honoroit:{{ matrix_bot_honoroit_container_port }}/_health"

  71.       register: matrix_bot_honoroit_health

  72.       changed_when: false

  73.       until: "'HTTP_STATUS=200' in matrix_bot_honoroit_health.stdout"

  74.       retries: 24

  75.       delay: 5

  76.       failed_when: false

  77. 

  78.     - name: Assert the configured health API is live and structurally valid

  79.       ansible.builtin.assert:

  80.         that:

  81.           - matrix_bot_honoroit_health.rc == 0

  82.           - matrix_bot_honoroit_health.stdout_lines[-1] == 'HTTP_STATUS=200'

  83.           - "matrix_bot_honoroit_health_body | from_json == {'status': 'ok'}"

  84.         fail_msg: >-

  85.           Honoroit's health API did not answer with its expected JSON

  86.           ({{ matrix_bot_honoroit_health.stdout | default('no output') }})

  87.         success_msg: "Honoroit's live health API answers with its structured status"

  88. 

  89.     - name: Ask the metrics endpoint without credentials

  90.       ansible.builtin.command:

  91.         argv:

  92.           - docker

  93.           - run

  94.           - --rm

  95.           - --network={{ matrix_bot_honoroit_container_network }}

  96.           - "{{ molecule_shared_image_curl }}"

  97.           - --silent

  98.           - --output

  99.           - /dev/null

  100.           - --write-out

  101.           - "HTTP_STATUS=%{http_code}"

  102.           - "http://matrix-bot-honoroit:{{ matrix_bot_honoroit_container_port }}/metrics"

  103.       register: matrix_bot_honoroit_unauthenticated_metrics

  104.       changed_when: false

  105.       failed_when: false

  106. 

  107.     - name: Assert the metrics endpoint requires authentication

  108.       ansible.builtin.assert:

  109.         that:

  110.           - matrix_bot_honoroit_unauthenticated_metrics.rc == 0

  111.           - matrix_bot_honoroit_unauthenticated_metrics.stdout == 'HTTP_STATUS=401'

  112.         fail_msg: "Honoroit's metrics endpoint did not reject an unauthenticated request"

  113.         success_msg: "Honoroit's metrics endpoint rejects unauthenticated requests"

  114. 

  115.     - name: Ask the metrics endpoint with incorrect credentials

  116.       ansible.builtin.command:

  117.         argv:

  118.           - docker

  119.           - run

  120.           - --rm

  121.           - --network={{ matrix_bot_honoroit_container_network }}

  122.           - "{{ molecule_shared_image_curl }}"

  123.           - --silent

  124.           - --user

  125.           - molecule-metrics-user:incorrect-molecule-password

  126.           - --output

  127.           - /dev/null

  128.           - --write-out

  129.           - "HTTP_STATUS=%{http_code}"

  130.           - "http://matrix-bot-honoroit:{{ matrix_bot_honoroit_container_port }}/metrics"

  131.       register: matrix_bot_honoroit_wrong_metrics_credentials

  132.       changed_when: false

  133.       failed_when: false

  134. 

  135.     - name: Assert the metrics endpoint rejects incorrect credentials

  136.       ansible.builtin.assert:

  137.         that:

  138.           - matrix_bot_honoroit_wrong_metrics_credentials.rc == 0

  139.           - matrix_bot_honoroit_wrong_metrics_credentials.stdout == 'HTTP_STATUS=401'

  140.         fail_msg: "Honoroit's metrics endpoint accepted incorrect credentials"

  141.         success_msg: "Honoroit's metrics endpoint rejects incorrect credentials"

  142. 

  143.     - name: Ask the metrics endpoint with the configured credentials

  144.       ansible.builtin.command:

  145.         argv:

  146.           - docker

  147.           - run

  148.           - --rm

  149.           - --network={{ matrix_bot_honoroit_container_network }}

  150.           - "{{ molecule_shared_image_curl }}"

  151.           - --silent

  152.           - --show-error

  153.           - --user

  154.           - molecule-metrics-user:molecule_metrics_password_c9ed32

  155.           - --write-out

  156.           - "\nHTTP_STATUS=%{http_code}"

  157.           - "http://matrix-bot-honoroit:{{ matrix_bot_honoroit_container_port }}/metrics"

  158.       register: matrix_bot_honoroit_metrics

  159.       changed_when: false

  160.       failed_when: false

  161. 

  162.     - name: Assert configured credentials unlock genuine Prometheus metrics

  163.       ansible.builtin.assert:

  164.         that:

  165.           - matrix_bot_honoroit_metrics.rc == 0

  166.           - matrix_bot_honoroit_metrics.stdout_lines[-1] == 'HTTP_STATUS=200'

  167.           - matrix_bot_honoroit_metrics_lines | select('match', '^honoroit_messages_operator [0-9]+$') | list | length == 1

  168.           - matrix_bot_honoroit_metrics_lines | select('match', '^honoroit_messages_total [0-9]+$') | list | length == 1

  169.           - matrix_bot_honoroit_metrics_lines | select('match', '^honoroit_request_done [0-9]+$') | list | length == 1

  170.           - matrix_bot_honoroit_metrics_lines | select('match', '^honoroit_request_new [0-9]+$') | list | length == 1

  171.         fail_msg: >-

  172.           Configured credentials did not unlock Honoroit's Prometheus metrics

  173.           ({{ matrix_bot_honoroit_metrics.stdout | default('no output') }})

  174.         success_msg: "Configured credentials unlock Honoroit's Prometheus metrics"

  175. 

  176.     - name: Read the environment file the role rendered

  177.       ansible.builtin.slurp:

  178.         src: "{{ matrix_bot_honoroit_config_path }}/env"

  179.       register: matrix_bot_honoroit_env_file

  180. 

  181.     - name: Assert the parsed environment contains the Matrix and Postgres wiring

  182.       ansible.builtin.assert:

  183.         that:

  184.           - matrix_bot_honoroit_rendered_env.HONOROIT_LOGIN == matrix_bot_honoroit_login

  185.           - matrix_bot_honoroit_rendered_env.HONOROIT_PASSWORD == matrix_bot_honoroit_password

  186.           - matrix_bot_honoroit_rendered_env.HONOROIT_HOMESERVER == matrix_bot_honoroit_homeserver

  187.           - matrix_bot_honoroit_rendered_env.HONOROIT_ROOMID == matrix_bot_honoroit_roomid

  188.           - matrix_bot_honoroit_rendered_env.HONOROIT_DB_DIALECT == 'postgres'

  189.           - matrix_bot_honoroit_rendered_env.HONOROIT_DB_DSN == 'postgres://molecule_honoroit_user:molecule_honoroit_password_8c45d1@matrix-postgres-molecule:5432/molecule_honoroit_database?sslmode=disable'

  190.         fail_msg: "The parsed environment lost the scenario's Matrix or Postgres wiring"

  191.         success_msg: "The parsed environment carries the scenario's Matrix and Postgres wiring"

  192. 

  193.     - name: Assert the parsed environment contains non-default bot behavior

  194.       ansible.builtin.assert:

  195.         that:

  196.           - matrix_bot_honoroit_rendered_env.HONOROIT_PREFIX == '!molecule-help'

  197.           - matrix_bot_honoroit_rendered_env.HONOROIT_NOENCRYPTIONWARNING | lower == 'true'

  198.           - matrix_bot_honoroit_rendered_env.HONOROIT_LOGLEVEL == 'DEBUG'

  199.           - matrix_bot_honoroit_rendered_env.HONOROIT_CACHESIZE == '317'

  200.           - matrix_bot_honoroit_rendered_env.HONOROIT_IGNORENOTHREAD | lower == 'true'

  201.           - matrix_bot_honoroit_rendered_env.HONOROIT_IGNOREDROOMS == '!molecule-ignored-one:molecule.local !molecule-ignored-two:molecule.local'

  202.           - matrix_bot_honoroit_rendered_env.HONOROIT_ALLOWEDUSERS == '@support-*:molecule.local @operator:molecule.local'

  203.           - matrix_bot_honoroit_rendered_env.HONOROIT_TEXT_PREFIX_OPEN == '[MOLECULE OPEN]'

  204.           - matrix_bot_honoroit_rendered_env.HONOROIT_TEXT_PREFIX_DONE == '[MOLECULE DONE]'

  205.           - matrix_bot_honoroit_rendered_env.HONOROIT_TEXT_GREETINGS == 'Molecule helpdesk greeting'

  206.           - matrix_bot_honoroit_rendered_env.HONOROIT_TEXT_DONE == 'Molecule helpdesk completion'

  207.         fail_msg: "The parsed environment lost non-default Honoroit behavior"

  208.         success_msg: "The parsed environment carries non-default Honoroit behavior"

  209. 

  210.     - name: Assert the parsed environment contains metrics auth and extension values

  211.       ansible.builtin.assert:

  212.         that:

  213.           - matrix_bot_honoroit_rendered_env.HONOROIT_AUTH_METRICS_LOGIN == 'molecule-metrics-user'

  214.           - matrix_bot_honoroit_rendered_env.HONOROIT_AUTH_METRICS_PASSWORD == 'molecule_metrics_password_c9ed32'

  215.           - matrix_bot_honoroit_rendered_env.HONOROIT_PORT == ':' ~ (matrix_bot_honoroit_container_port | string)

  216.           - matrix_bot_honoroit_rendered_env.MOLECULE_HONOROIT_MARKER == 'role-rendered-environment'

  217.         fail_msg: "The parsed environment lost the metrics auth or extension values"

  218.         success_msg: "The parsed environment carries metrics auth and extension values"

  219. 

  220.     - name: List the tables Honoroit created in Postgres

  221.       ansible.builtin.command:

  222.         argv:

  223.           - docker

  224.           - exec

  225.           - matrix-postgres-molecule

  226.           - psql

  227.           - --username={{ matrix_bot_honoroit_database_username }}

  228.           - --dbname={{ matrix_bot_honoroit_database_name }}

  229.           - --tuples-only

  230.           - --no-align

  231.           - --command=SELECT tablename FROM pg_tables WHERE schemaname = 'public' ORDER BY tablename

  232.       register: matrix_bot_honoroit_tables

  233.       changed_when: false

  234. 

  235.     - name: Assert Honoroit migrated a substantial schema into the configured Postgres database

  236.       ansible.builtin.assert:

  237.         that:

  238.           - matrix_bot_honoroit_tables.rc == 0

  239.           - "'crypto_account' in matrix_bot_honoroit_table_names"

  240.           - "'crypto_device' in matrix_bot_honoroit_table_names"

  241.           - "'crypto_megolm_inbound_session' in matrix_bot_honoroit_table_names"

  242.           - "'crypto_olm_session' in matrix_bot_honoroit_table_names"

  243.           - "'crypto_secrets' in matrix_bot_honoroit_table_names"

  244.           - "'crypto_version' in matrix_bot_honoroit_table_names"

  245.           - "'mx_registrations' in matrix_bot_honoroit_table_names"

  246.           - "'mx_room_state' in matrix_bot_honoroit_table_names"

  247.           - "'mx_user_profile' in matrix_bot_honoroit_table_names"

  248.           - "'mx_version' in matrix_bot_honoroit_table_names"

  249.           - matrix_bot_honoroit_table_names | length == 17

  250.         fail_msg: >-

  251.           Honoroit did not create its crypto schema in {{ matrix_bot_honoroit_database_name }}

  252.           (found {{ matrix_bot_honoroit_table_names | length }} table(s):

  253.           {{ matrix_bot_honoroit_table_names | join(', ') }})

  254.         success_msg: "Honoroit migrated its crypto schema into the configured Postgres database"

  255.       vars:

  256.         matrix_bot_honoroit_table_names: "{{ matrix_bot_honoroit_tables.stdout_lines | select | list }}"

  257. 

  258.     - name: Read Honoroit's database migration markers

  259.       ansible.builtin.command:

  260.         argv:

  261.           - docker

  262.           - exec

  263.           - matrix-postgres-molecule

  264.           - psql

  265.           - --username={{ matrix_bot_honoroit_database_username }}

  266.           - --dbname={{ matrix_bot_honoroit_database_name }}

  267.           - --tuples-only

  268.           - --no-align

  269.           - "--command=SELECT 'crypto:' || version || ':' || compat FROM crypto_version UNION ALL SELECT 'state:' || version || ':' || compat FROM mx_version ORDER BY 1"

  270.       register: matrix_bot_honoroit_migration_versions

  271.       changed_when: false

  272. 

  273.     - name: Assert Honoroit's Postgres migrations reached the pinned schema versions

  274.       ansible.builtin.assert:

  275.         that:

  276.           - matrix_bot_honoroit_migration_versions.rc == 0

  277.           - matrix_bot_honoroit_migration_versions.stdout_lines == ['crypto:19:15', 'state:10:3']

  278.         fail_msg: >-

  279.           Honoroit's database migration markers are missing or unexpected

  280.           ({{ matrix_bot_honoroit_migration_versions.stdout | default('no output') | trim }})

  281.         success_msg: "Honoroit's Postgres migrations reached the pinned schema versions"

  282. 

  283.     - name: Read Honoroit's full systemd journal

  284.       ansible.builtin.command:

  285.         argv:

  286.           - journalctl

  287.           - --unit=matrix-bot-honoroit.service

  288.           - --no-pager

  289.       register: matrix_bot_honoroit_journal

  290.       changed_when: false

  291. 

  292.     - name: Assert the journal records successful initialization and configured debug logging

  293.       ansible.builtin.assert:

  294.         that:

  295.           - "'Honoroit' in matrix_bot_honoroit_journal_plain"

  296.           - "'starting bot...' in matrix_bot_honoroit_journal_plain"

  297.           - "'client has been started' in matrix_bot_honoroit_journal_plain"

  298.           - "'cannot initialize the bot' not in matrix_bot_honoroit_journal_plain"

  299.           - "'matrix bot crashed' not in matrix_bot_honoroit_journal_plain"

  300.         fail_msg: "Honoroit's journal does not show a clean debug-level startup"

  301.         success_msg: "Honoroit's journal records a clean debug-level startup"

  302.       vars:

  303.         matrix_bot_honoroit_journal_plain: >-

  304.           {{ matrix_bot_honoroit_journal.stdout

  305.              | regex_replace('\x1B\[[0-?]*[ -/]*[@-~]', '') }}

  306. 

  307.     - name: Inspect the running Honoroit container

  308.       ansible.builtin.command:

  309.         argv:

  310.           - docker

  311.           - container

  312.           - inspect

  313.           - matrix-bot-honoroit

  314.       register: matrix_bot_honoroit_container_inspect

  315.       changed_when: false

  316. 

  317.     - name: Assert the running container uses the exact image pinned by the role

  318.       ansible.builtin.assert:

  319.         that:

  320.           - matrix_bot_honoroit_runtime.Config.Image == matrix_bot_honoroit_expected_image

  321.         fail_msg: >-

  322.           The running image is {{ matrix_bot_honoroit_runtime.Config.Image }}, expected

  323.           {{ matrix_bot_honoroit_expected_image }} from defaults/main.yml

  324.         success_msg: "The running container uses the exact image pinned by the role"

  325.       vars:

  326.         matrix_bot_honoroit_expected_image: >-

  327.           {{ matrix_bot_honoroit_role_defaults.matrix_bot_honoroit_container_image_registry_prefix_upstream_default }}etkecc/honoroit:{{ matrix_bot_honoroit_role_defaults.matrix_bot_honoroit_version }}

  328. 

  329.     - name: Assert the running container preserves the image and systemd lifecycle contract

  330.       ansible.builtin.assert:

  331.         that:

  332.           - matrix_bot_honoroit_runtime.Config.Entrypoint == ['/bin/honoroit']

  333.           - matrix_bot_honoroit_runtime.Config.Cmd is none

  334.           - matrix_bot_honoroit_runtime.Config.WorkingDir == '/'

  335.           - matrix_bot_honoroit_runtime.HostConfig.RestartPolicy.Name == 'no'

  336.           - matrix_bot_honoroit_runtime.HostConfig.AutoRemove is sameas true

  337.           - matrix_bot_honoroit_runtime.HostConfig.LogConfig.Type == 'none'

  338.         fail_msg: "The running container has an unexpected command or Docker lifecycle contract"

  339.         success_msg: "The running container preserves the image command and systemd lifecycle contract"

  340. 

  341.     - name: Assert the running container uses the configured identity and hardening

  342.       ansible.builtin.assert:

  343.         that:

  344.           - matrix_bot_honoroit_runtime.Config.User == '1234:1234'

  345.           - matrix_bot_honoroit_runtime.HostConfig.ReadonlyRootfs is sameas true

  346.           - matrix_bot_honoroit_runtime.HostConfig.CapDrop == ['ALL']

  347.           - matrix_bot_honoroit_runtime.HostConfig.PidsLimit == 73

  348.           - matrix_bot_honoroit_runtime.HostConfig.Tmpfs['/tmp'] == 'rw,noexec,nosuid,size=16m'

  349.         fail_msg: "The running container lost its configured identity or hardening"

  350.         success_msg: "The running container uses the configured identity and hardening"

  351. 

  352.     - name: Assert the running container has only private network attachments

  353.       ansible.builtin.assert:

  354.         that:

  355.           - matrix_bot_honoroit_runtime.HostConfig.NetworkMode == matrix_bot_honoroit_container_network

  356.           - matrix_bot_honoroit_runtime.NetworkSettings.Networks.keys() | sort == ([matrix_bot_honoroit_container_network] + matrix_bot_honoroit_container_additional_networks) | sort

  357.           - matrix_bot_honoroit_runtime.HostConfig.PortBindings | length == 0

  358.         fail_msg: "The running container lost a private network or published a host port"

  359.         success_msg: "The running container has both private networks and no published host ports"

  360. 

  361.     - name: Assert the writable data mount is scoped to Honoroit's data directory

  362.       ansible.builtin.assert:

  363.         that:

  364.           - matrix_bot_honoroit_runtime.Mounts | length == 1

  365.           - matrix_bot_honoroit_data_mounts | length == 1

  366.           - matrix_bot_honoroit_data_mounts[0].Source == matrix_bot_honoroit_data_path

  367.           - matrix_bot_honoroit_data_mounts[0].RW is sameas true

  368.         fail_msg: "The running container's /data mount does not match the role-managed data path"

  369.         success_msg: "The running container has the role-managed writable /data mount"

  370. 

  371.     - name: Assert the running process received the role-rendered environment

  372.       ansible.builtin.assert:

  373.         that:

  374.           - matrix_bot_honoroit_runtime_env.HONOROIT_DB_DSN == matrix_bot_honoroit_rendered_env.HONOROIT_DB_DSN

  375.           - matrix_bot_honoroit_runtime_env.HONOROIT_HOMESERVER == matrix_bot_honoroit_rendered_env.HONOROIT_HOMESERVER

  376.           - matrix_bot_honoroit_runtime_env.HONOROIT_AUTH_METRICS_LOGIN == matrix_bot_honoroit_rendered_env.HONOROIT_AUTH_METRICS_LOGIN

  377.           - matrix_bot_honoroit_runtime_env.HONOROIT_PORT == ':' ~ (matrix_bot_honoroit_container_port | string)

  378.           - matrix_bot_honoroit_runtime_env.MOLECULE_HONOROIT_MARKER == 'role-rendered-environment'

  379.         fail_msg: "The live container environment differs from the file the role rendered"

  380.         success_msg: "The live container received the role-rendered environment"

  381. 

  382.     - name: Read the labels file the role rendered

  383.       ansible.builtin.slurp:

  384.         src: "{{ matrix_bot_honoroit_config_path }}/labels"

  385.       register: matrix_bot_honoroit_labels_file

  386. 

  387.     - name: Assert the parsed labels contain the configured metrics router

  388.       ansible.builtin.assert:

  389.         that:

  390.           - matrix_bot_honoroit_rendered_labels['traefik.enable'] == 'true'

  391.           - matrix_bot_honoroit_rendered_labels['traefik.docker.network'] == matrix_bot_honoroit_container_network

  392.           - matrix_bot_honoroit_rendered_labels['traefik.http.services.matrix-bot-honoroit-metrics.loadbalancer.server.port'] == (matrix_bot_honoroit_container_port | string)

  393.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.rule'] == 'Host(`honoroit.molecule.local`) && Path(`/molecule-honoroit/molecule-metrics`)'

  394.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.priority'] == '710'

  395.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.service'] == 'matrix-bot-honoroit-metrics'

  396.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.entrypoints'] == 'molecule-web'

  397.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.tls'] == 'false'

  398.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.tls.certResolver'] is not defined

  399.         fail_msg: "The parsed labels lost the scenario's metrics router contract"

  400.         success_msg: "The parsed labels contain the configured metrics router"

  401. 

  402.     - name: Assert the parsed labels contain the configured middleware chain

  403.       ansible.builtin.assert:

  404.         that:

  405.           - matrix_bot_honoroit_rendered_labels['traefik.http.middlewares.matrix-bot-honoroit-slashless-redirect.redirectregex.regex'] == '(/molecule-honoroit)$'

  406.           - matrix_bot_honoroit_rendered_labels['traefik.http.middlewares.matrix-bot-honoroit-slashless-redirect.redirectregex.replacement'] == '${1}/'

  407.           - matrix_bot_honoroit_rendered_labels['traefik.http.middlewares.matrix-bot-honoroit-strip-prefix.stripprefix.prefixes'] == '/molecule-honoroit'

  408.           - matrix_bot_honoroit_rendered_labels['traefik.http.middlewares.matrix-bot-honoroit-add-headers.headers.customresponseheaders.X-Molecule-Honoroit'] == 'scenario'

  409.           - matrix_bot_honoroit_rendered_labels['traefik.http.middlewares.matrix-bot-honoroit-add-headers.headers.customresponseheaders.X-Robots-Tag'] == 'noindex'

  410.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.middlewares'] == 'matrix-bot-honoroit-slashless-redirect,matrix-bot-honoroit-strip-prefix,matrix-bot-honoroit-add-headers'

  411.         fail_msg: "The parsed labels lost the scenario's path and response-header middlewares"

  412.         success_msg: "The parsed labels contain the configured middleware chain"

  413. 

  414.     - name: Assert the live container received the rendered router and middleware labels

  415.       ansible.builtin.assert:

  416.         that:

  417.           - matrix_bot_honoroit_runtime.Config.Labels['traefik.http.services.matrix-bot-honoroit-metrics.loadbalancer.server.port'] == (matrix_bot_honoroit_container_port | string)

  418.           - matrix_bot_honoroit_runtime.Config.Labels['traefik.http.routers.matrix-bot-honoroit-metrics.rule'] == matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.rule']

  419.           - matrix_bot_honoroit_runtime.Config.Labels['traefik.http.routers.matrix-bot-honoroit-metrics.priority'] == matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.priority']

  420.           - matrix_bot_honoroit_runtime.Config.Labels['traefik.http.routers.matrix-bot-honoroit-metrics.middlewares'] == matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.middlewares']

  421.           - matrix_bot_honoroit_runtime.Config.Labels['traefik.http.middlewares.matrix-bot-honoroit-add-headers.headers.customresponseheaders.X-Molecule-Honoroit'] == 'scenario'

  422.           - matrix_bot_honoroit_runtime.Config.Labels['molecule.honoroit.scenario'] == 'live-postgres-and-metrics'

  423.         fail_msg: "The live container labels differ from the rendered routing contract"

  424.         success_msg: "The live container received the rendered router and middleware labels"

  425. 

  426.     - name: Inspect role-rendered support file ownership and permissions

  427.       ansible.builtin.stat:

  428.         path: "{{ item }}"

  429.       loop:

  430.         - "{{ matrix_bot_honoroit_config_path }}/env"

  431.         - "{{ matrix_bot_honoroit_config_path }}/labels"

  432.       register: matrix_bot_honoroit_support_files

  433. 

  434.     - name: Assert support files are owned by Matrix and not world-readable

  435.       ansible.builtin.assert:

  436.         that:

  437.           - matrix_bot_honoroit_support_files.results | map(attribute='stat.uid') | unique | list == [1234]

  438.           - matrix_bot_honoroit_support_files.results | map(attribute='stat.gid') | unique | list == [1234]

  439.           - matrix_bot_honoroit_support_files.results | map(attribute='stat.mode') | unique | list == ['0640']

  440.         fail_msg: "Honoroit's support files have unexpected ownership or permissions"

  441.         success_msg: "Honoroit's support files are Matrix-owned and mode 0640"