matrix-docker-ansible-deploy/roles/custom/matrix-ketesa/molecule/default/verify.yml

# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
#
# SPDX-License-Identifier: AGPL-3.0-or-later

---
# Ketesa is a static client. The weight-bearing checks are its real HTTP root and the
# config.json served from the bind mount; no live Synapse or credentials are involved.
- name: Verify matrix-ketesa
  hosts: all
  become: true
  vars_files:
    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"
    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
  vars:
    matrix_ketesa_rendered_config: "{{ matrix_ketesa_config_file.content | b64decode | from_json }}"
    matrix_ketesa_root_body: "{{ matrix_ketesa_root_http.stdout_lines[:-1] | join('\n') }}"
    matrix_ketesa_served_config_body: "{{ matrix_ketesa_config_http.stdout_lines[:-1] | join('\n') }}"
    matrix_ketesa_served_config: "{{ matrix_ketesa_served_config_body | from_json }}"
    matrix_ketesa_labels_lines: "{{ (matrix_ketesa_labels_file.content | b64decode).splitlines() }}"
    matrix_ketesa_runtime: "{{ (matrix_ketesa_container_inspect.stdout | from_json) | first }}"
    matrix_ketesa_config_mounts: "{{ matrix_ketesa_runtime.Mounts | selectattr('Destination', 'equalto', '/var/public/config.json') | list }}"
  gather_facts: false

  tasks:
    # Read the pin from the role rather than defining it in the scenario, so an image bump
    # changes the expected value and tests the image that the role actually ships.
    - name: Load the role's defaults under a separate name
      ansible.builtin.include_vars:
        file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"
        name: matrix_ketesa_role_defaults

    - name: Wait for the matrix-ketesa service to become active
      ansible.builtin.systemd_service:
        name: matrix-ketesa.service
      register: matrix_ketesa_service
      until: matrix_ketesa_service.status.ActiveState == 'active'
      retries: 30
      delay: 5
      failed_when: false

    # Restart=always makes ActiveState alone insufficient: a container can crash-loop while
    # systemd continues to report its unit as active.
    - name: Assert the service is active and has not restarted
      ansible.builtin.assert:
        that:
          - matrix_ketesa_service.status.ActiveState == 'active'
          - matrix_ketesa_service.status.NRestarts is defined
          - matrix_ketesa_service.status.NRestarts | int == 0
        fail_msg: >-
          matrix-ketesa.service is
          {{ matrix_ketesa_service.status.ActiveState | default('unknown') }} after
          {{ matrix_ketesa_service.status.NRestarts | default('?') }} restart(s)
        success_msg: "matrix-ketesa.service is active and has not restarted"

    - name: Read the configuration file the role rendered
      ansible.builtin.slurp:
        src: "{{ matrix_ketesa_config_path }}/config.json"
      register: matrix_ketesa_config_file

    - name: Assert the rendered JSON carries the scenario's Ketesa configuration
      ansible.builtin.assert:
        that:
          - matrix_ketesa_rendered_config.keys() | sort == ['asManagedUsers', 'corsCredentials', 'externalAuthProvider', 'menu', 'restrictBaseUrl', 'wellKnownDiscovery'] | sort
          - matrix_ketesa_rendered_config.restrictBaseUrl == matrix_ketesa_config_restrictBaseUrl
          - matrix_ketesa_rendered_config.externalAuthProvider is sameas true
          - matrix_ketesa_rendered_config.wellKnownDiscovery is sameas false
          - matrix_ketesa_rendered_config.corsCredentials == matrix_ketesa_config_corsCredentials
          - matrix_ketesa_rendered_config.asManagedUsers == matrix_ketesa_config_asManagedUsers_custom
          - matrix_ketesa_rendered_config.menu | length == 1
          - matrix_ketesa_rendered_config.menu[0].label == 'Molecule support'
          - matrix_ketesa_rendered_config.menu[0].i18n.de == 'Molekül-Support'
          - matrix_ketesa_rendered_config.menu[0].i18n.fr == 'Assistance Molécule'
          - matrix_ketesa_rendered_config.menu[0].icon == 'SupportAgent'
          - matrix_ketesa_rendered_config.menu[0].url == 'https://support.molecule.local/ketesa'
        fail_msg: "The rendered JSON does not carry the scenario's non-default Ketesa settings"
        success_msg: "The rendered JSON carries the scenario's non-default Ketesa settings"

    # Probe over the role's own network. Publishing a test-only host port would diverge from
    # the deployment path and would collide when scenarios run concurrently.
    - name: Wait for Ketesa to serve its application root
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_ketesa_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --show-error
          - --write-out
          - "\nHTTP_STATUS=%{http_code}"
          - http://matrix-ketesa:8080/
      register: matrix_ketesa_root_http
      changed_when: false
      until: "'HTTP_STATUS=200' in matrix_ketesa_root_http.stdout"
      retries: 24
      delay: 5
      failed_when: false

    - name: Assert the application root is real Ketesa HTML
      ansible.builtin.assert:
        that:
          - matrix_ketesa_root_http.rc == 0
          - matrix_ketesa_root_http.stdout_lines[-1] == 'HTTP_STATUS=200'
          - matrix_ketesa_root_body | trim | length > 100
          - "'<!doctype html' in matrix_ketesa_root_body | lower"
          - "'ketesa' in matrix_ketesa_root_body | lower"
        fail_msg: >-
          Ketesa did not return its application HTML from the container network
          (rc={{ matrix_ketesa_root_http.rc }}, status={{ matrix_ketesa_root_http.stdout_lines[-1] | default('missing') }})
        success_msg: "Ketesa serves its application root over HTTP"

    - name: Fetch the config.json that Ketesa serves
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_ketesa_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --show-error
          - --write-out
          - "\nHTTP_STATUS=%{http_code}"
          - http://matrix-ketesa:8080/config.json
      register: matrix_ketesa_config_http
      changed_when: false
      until: "'HTTP_STATUS=200' in matrix_ketesa_config_http.stdout"
      retries: 24
      delay: 5
      failed_when: false

    - name: Assert Ketesa serves the parsed JSON that the role rendered
      ansible.builtin.assert:
        that:
          - matrix_ketesa_config_http.rc == 0
          - matrix_ketesa_config_http.stdout_lines[-1] == 'HTTP_STATUS=200'
          - matrix_ketesa_served_config is mapping
          - matrix_ketesa_served_config == matrix_ketesa_rendered_config
        fail_msg: "The config.json served by Ketesa does not match the role's rendered JSON"
        success_msg: "Ketesa serves the exact parsed JSON that the role rendered"

    - name: Read the labels the role rendered
      ansible.builtin.slurp:
        src: "{{ matrix_ketesa_base_path }}/labels"
      register: matrix_ketesa_labels_file

    - name: Assert the labels carry the configured public exposure
      ansible.builtin.assert:
        that:
          - "'traefik.enable=true' in matrix_ketesa_labels_lines"
          - "'traefik.docker.network=matrix-ketesa-molecule' in matrix_ketesa_labels_lines"
          - "'traefik.http.services.matrix-ketesa.loadbalancer.server.port=8080' in matrix_ketesa_labels_lines"
          - "'traefik.http.middlewares.matrix-ketesa-ipallowlist.ipallowlist.sourcerange=192.0.2.0/24,2001:db8::/32' in matrix_ketesa_labels_lines"
          - "'traefik.http.middlewares.matrix-ketesa-strip-prefix.stripprefix.prefixes=/molecule-ketesa' in matrix_ketesa_labels_lines"
          - "'traefik.http.middlewares.matrix-ketesa-add-headers.headers.customresponseheaders.X-Molecule-Ketesa=role-scenario' in matrix_ketesa_labels_lines"
          - "'traefik.http.routers.matrix-ketesa.rule=Host(`ketesa-admin.molecule.local`) && PathPrefix(`/molecule-ketesa`)' in matrix_ketesa_labels_lines"
          - "'traefik.http.routers.matrix-ketesa.priority=731' in matrix_ketesa_labels_lines"
          - "'traefik.http.routers.matrix-ketesa.middlewares=matrix-ketesa-ipallowlist,matrix-ketesa-slashless-redirect,matrix-ketesa-strip-prefix,matrix-ketesa-add-headers' in matrix_ketesa_labels_lines"
          - "'traefik.http.routers.matrix-ketesa.entrypoints=web' in matrix_ketesa_labels_lines"
          - "'traefik.http.routers.matrix-ketesa.tls=false' in matrix_ketesa_labels_lines"
          - "'molecule.ketesa.coverage=enabled' in matrix_ketesa_labels_lines"
        fail_msg: "The role's label file does not carry the scenario's exposure settings"
        success_msg: "The role's label file carries the scenario's exposure settings"

    - name: Inspect the running Ketesa container
      ansible.builtin.command:
        argv:
          - docker
          - container
          - inspect
          - matrix-ketesa
      register: matrix_ketesa_container_inspect
      changed_when: false

    - name: Assert the running container uses the exact image pinned by the role
      ansible.builtin.assert:
        that:
          - matrix_ketesa_runtime.Config.Image == 'ghcr.io/etkecc/ketesa:' + matrix_ketesa_role_defaults.matrix_ketesa_version
        fail_msg: >-
          The running image {{ matrix_ketesa_runtime.Config.Image }} is not the exact
          ghcr.io/etkecc/ketesa:{{ matrix_ketesa_role_defaults.matrix_ketesa_version }} pin
        success_msg: "The running container uses the exact image pinned by the role"

    - name: Assert the running container uses the dedicated Ketesa identity
      ansible.builtin.assert:
        that:
          - matrix_ketesa_runtime.Config.User.split(':')[0] == matrix_ketesa_container_uid | string
          - matrix_ketesa_runtime.Config.User.split(':')[1] == matrix_ketesa_container_gid | string
        fail_msg: >-
          The running container uses {{ matrix_ketesa_runtime.Config.User }} instead of
          {{ matrix_ketesa_container_uid }}:{{ matrix_ketesa_container_gid }}
        success_msg: "The running container uses the dedicated Ketesa UID and GID"

    - name: Assert the container root filesystem is read-only
      ansible.builtin.assert:
        that:
          - matrix_ketesa_runtime.HostConfig.ReadonlyRootfs is sameas true
        fail_msg: "The Ketesa container root filesystem is writable"
        success_msg: "The Ketesa container root filesystem is read-only"

    - name: Assert the configuration bind mount is read-only
      ansible.builtin.assert:
        that:
          - matrix_ketesa_config_mounts | length == 1
          - matrix_ketesa_config_mounts[0].RW is sameas false
        fail_msg: "The Ketesa configuration bind mount is missing or writable"
        success_msg: "The Ketesa configuration bind mount is present and read-only"

    - name: Assert the container is attached only to its dedicated network
      ansible.builtin.assert:
        that:
          - matrix_ketesa_runtime.NetworkSettings.Networks is mapping
          - matrix_ketesa_runtime.NetworkSettings.Networks | length == 1
          - matrix_ketesa_container_network in matrix_ketesa_runtime.NetworkSettings.Networks
        fail_msg: >-
          Ketesa has unexpected network attachments:
          {{ matrix_ketesa_runtime.NetworkSettings.Networks.keys() | list }}
        success_msg: "The container is attached only to its dedicated network"

    - name: Ask Docker for Ketesa's published ports
      ansible.builtin.command:
        argv:
          - docker
          - container
          - port
          - matrix-ketesa
      register: matrix_ketesa_published_ports
      changed_when: false
      failed_when: false

    - name: Assert the role did not publish a host port
      ansible.builtin.assert:
        that:
          - matrix_ketesa_runtime.HostConfig.PortBindings | default({}, true) | length == 0
          - matrix_ketesa_published_ports.rc == 0
          - matrix_ketesa_published_ports.stdout | trim | length == 0
        fail_msg: >-
          Ketesa unexpectedly publishes a host port:
          {{ matrix_ketesa_published_ports.stdout | default('unknown') }}
        success_msg: "The role leaves Ketesa's HTTP port unpublished"

    - name: Assert Docker accepted the role's custom label
      ansible.builtin.assert:
        that:
          - matrix_ketesa_runtime.Config.Labels is mapping
          - matrix_ketesa_runtime.Config.Labels['molecule.ketesa.coverage'] == 'enabled'
        fail_msg: "Docker did not attach the custom label from the role's label file"
        success_msg: "Docker accepted the custom label from the role's label file"