overmind
/
matrix-docker-ansible-deploy
miroir de https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
Bifurcation 0
Code Tickets 0 Versions 0 Wiki Activité
Matrix Docker Ansible eploy
Vous ne pouvez pas sélectionner plus de 25 sujets Les noms de sujets doivent commencer par une lettre ou un nombre, peuvent contenir des tirets ('-') et peuvent comporter jusqu'à 35 caractères.
11930 Révisions
2 Branches
137 MiB
 
 
 
Aborescence: b90c8bb00f
Branches Tags
${ item.name }
Créer la branche ${ searchTerm }
de 'b90c8bb00f'
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-bot-honoroit/molecule/default/verify.yml

442 lignes
25 KiB
Brut Annotations Historique 

  1. # SPDX-FileCopyrightText: 2026 Slavi Pantaleev

  2. #

  3. # SPDX-License-Identifier: AGPL-3.0-or-later

  4. 

  5. ---

  6. - name: Verify matrix-bot-honoroit

  7.   hosts: all

  8.   become: true

  9.   vars_files:

  10.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"

  11.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"

  12.   vars:

  13.     matrix_bot_honoroit_health_body: "{{ matrix_bot_honoroit_health.stdout_lines[:-1] | join('\n') }}"

  14.     matrix_bot_honoroit_metrics_body: "{{ matrix_bot_honoroit_metrics.stdout_lines[:-1] | join('\n') }}"

  15.     matrix_bot_honoroit_metrics_lines: "{{ matrix_bot_honoroit_metrics_body.splitlines() | select | list }}"

  16.     matrix_bot_honoroit_rendered_env_lines: >-

  17.       {{ (matrix_bot_honoroit_env_file.content | b64decode).splitlines()

  18.          | select('match', '^[A-Z0-9_]+=') | list }}

  19.     matrix_bot_honoroit_rendered_env: >-

  20.       {{ dict(matrix_bot_honoroit_rendered_env_lines | map('split', '=', 1)) }}

  21.     matrix_bot_honoroit_rendered_labels_lines: >-

  22.       {{ (matrix_bot_honoroit_labels_file.content | b64decode).splitlines()

  23.          | select('match', '^[A-Za-z0-9_.-]+=') | list }}

  24.     matrix_bot_honoroit_rendered_labels: >-

  25.       {{ dict(matrix_bot_honoroit_rendered_labels_lines | map('split', '=', 1)) }}

  26.     matrix_bot_honoroit_runtime: "{{ (matrix_bot_honoroit_container_inspect.stdout | from_json) | first }}"

  27.     matrix_bot_honoroit_runtime_env: "{{ dict(matrix_bot_honoroit_runtime.Config.Env | map('split', '=', 1)) }}"

  28.     matrix_bot_honoroit_data_mounts: >-

  29.       {{ matrix_bot_honoroit_runtime.Mounts | selectattr('Destination', 'equalto', '/data') | list }}

  30.   gather_facts: false

  31.   tasks:

  32.     - name: Load the role's defaults under a separate name

  33.       ansible.builtin.include_vars:

  34.         file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"

  35.         name: matrix_bot_honoroit_role_defaults

  36. 

  37.     - name: Wait for the matrix-bot-honoroit service to become active

  38.       ansible.builtin.systemd_service:

  39.         name: matrix-bot-honoroit.service

  40.       register: matrix_bot_honoroit_service

  41.       until: matrix_bot_honoroit_service.status.ActiveState == 'active'

  42.       retries: 30

  43.       delay: 5

  44.       failed_when: false

  45. 

  46.     - name: Assert the service is active and has not restarted

  47.       ansible.builtin.assert:

  48.         that:

  49.           - matrix_bot_honoroit_service.status.ActiveState == 'active'

  50.           - matrix_bot_honoroit_service.status.NRestarts is defined

  51.           - matrix_bot_honoroit_service.status.NRestarts | int == 0

  52.         fail_msg: >-

  53.           matrix-bot-honoroit.service is

  54.           {{ matrix_bot_honoroit_service.status.ActiveState | default('unknown') }} after

  55.           {{ matrix_bot_honoroit_service.status.NRestarts | default('?') }} restart(s)

  56.         success_msg: "matrix-bot-honoroit.service is active and has not restarted"

  57. 

  58.     - name: Wait for Honoroit's health API

  59.       ansible.builtin.command:

  60.         argv:

  61.           - docker

  62.           - run

  63.           - --rm

  64.           - --network={{ matrix_bot_honoroit_container_network }}

  65.           - "{{ molecule_shared_image_curl }}"

  66.           - --silent

  67.           - --show-error

  68.           - --write-out

  69.           - "\nHTTP_STATUS=%{http_code}"

  70.           - "http://matrix-bot-honoroit:{{ matrix_bot_honoroit_container_port }}/_health"

  71.       register: matrix_bot_honoroit_health

  72.       changed_when: false

  73.       until: "'HTTP_STATUS=200' in matrix_bot_honoroit_health.stdout"

  74.       retries: 24

  75.       delay: 5

  76.       failed_when: false

  77. 

  78.     - name: Assert the configured health API is live and structurally valid

  79.       ansible.builtin.assert:

  80.         that:

  81.           - matrix_bot_honoroit_health.rc == 0

  82.           - matrix_bot_honoroit_health.stdout_lines[-1] == 'HTTP_STATUS=200'

  83.           - "matrix_bot_honoroit_health_body | from_json == {'status': 'ok'}"

  84.         fail_msg: >-

  85.           Honoroit's health API did not answer with its expected JSON

  86.           ({{ matrix_bot_honoroit_health.stdout | default('no output') }})

  87.         success_msg: "Honoroit's live health API answers with its structured status"

  88. 

  89.     - name: Ask the metrics endpoint without credentials

  90.       ansible.builtin.command:

  91.         argv:

  92.           - docker

  93.           - run

  94.           - --rm

  95.           - --network={{ matrix_bot_honoroit_container_network }}

  96.           - "{{ molecule_shared_image_curl }}"

  97.           - --silent

  98.           - --output

  99.           - /dev/null

  100.           - --write-out

  101.           - "HTTP_STATUS=%{http_code}"

  102.           - "http://matrix-bot-honoroit:{{ matrix_bot_honoroit_container_port }}/metrics"

  103.       register: matrix_bot_honoroit_unauthenticated_metrics

  104.       changed_when: false

  105.       failed_when: false

  106. 

  107.     - name: Assert the metrics endpoint requires authentication

  108.       ansible.builtin.assert:

  109.         that:

  110.           - matrix_bot_honoroit_unauthenticated_metrics.rc == 0

  111.           - matrix_bot_honoroit_unauthenticated_metrics.stdout == 'HTTP_STATUS=401'

  112.         fail_msg: "Honoroit's metrics endpoint did not reject an unauthenticated request"

  113.         success_msg: "Honoroit's metrics endpoint rejects unauthenticated requests"

  114. 

  115.     - name: Ask the metrics endpoint with incorrect credentials

  116.       ansible.builtin.command:

  117.         argv:

  118.           - docker

  119.           - run

  120.           - --rm

  121.           - --network={{ matrix_bot_honoroit_container_network }}

  122.           - "{{ molecule_shared_image_curl }}"

  123.           - --silent

  124.           - --user

  125.           - molecule-metrics-user:incorrect-molecule-password

  126.           - --output

  127.           - /dev/null

  128.           - --write-out

  129.           - "HTTP_STATUS=%{http_code}"

  130.           - "http://matrix-bot-honoroit:{{ matrix_bot_honoroit_container_port }}/metrics"

  131.       register: matrix_bot_honoroit_wrong_metrics_credentials

  132.       changed_when: false

  133.       failed_when: false

  134. 

  135.     - name: Assert the metrics endpoint rejects incorrect credentials

  136.       ansible.builtin.assert:

  137.         that:

  138.           - matrix_bot_honoroit_wrong_metrics_credentials.rc == 0

  139.           - matrix_bot_honoroit_wrong_metrics_credentials.stdout == 'HTTP_STATUS=401'

  140.         fail_msg: "Honoroit's metrics endpoint accepted incorrect credentials"

  141.         success_msg: "Honoroit's metrics endpoint rejects incorrect credentials"

  142. 

  143.     - name: Ask the metrics endpoint with the configured credentials

  144.       ansible.builtin.command:

  145.         argv:

  146.           - docker

  147.           - run

  148.           - --rm

  149.           - --network={{ matrix_bot_honoroit_container_network }}

  150.           - "{{ molecule_shared_image_curl }}"

  151.           - --silent

  152.           - --show-error

  153.           - --user

  154.           - molecule-metrics-user:molecule_metrics_password_c9ed32

  155.           - --write-out

  156.           - "\nHTTP_STATUS=%{http_code}"

  157.           - "http://matrix-bot-honoroit:{{ matrix_bot_honoroit_container_port }}/metrics"

  158.       register: matrix_bot_honoroit_metrics

  159.       changed_when: false

  160.       failed_when: false

  161. 

  162.     - name: Assert configured credentials unlock genuine Prometheus metrics

  163.       ansible.builtin.assert:

  164.         that:

  165.           - matrix_bot_honoroit_metrics.rc == 0

  166.           - matrix_bot_honoroit_metrics.stdout_lines[-1] == 'HTTP_STATUS=200'

  167.           - matrix_bot_honoroit_metrics_lines | select('match', '^honoroit_messages_operator [0-9]+$') | list | length == 1

  168.           - matrix_bot_honoroit_metrics_lines | select('match', '^honoroit_messages_total [0-9]+$') | list | length == 1

  169.           - matrix_bot_honoroit_metrics_lines | select('match', '^honoroit_request_done [0-9]+$') | list | length == 1

  170.           - matrix_bot_honoroit_metrics_lines | select('match', '^honoroit_request_new [0-9]+$') | list | length == 1

  171.         fail_msg: >-

  172.           Configured credentials did not unlock Honoroit's Prometheus metrics

  173.           ({{ matrix_bot_honoroit_metrics.stdout | default('no output') }})

  174.         success_msg: "Configured credentials unlock Honoroit's Prometheus metrics"

  175. 

  176.     - name: Read the environment file the role rendered

  177.       ansible.builtin.slurp:

  178.         src: "{{ matrix_bot_honoroit_config_path }}/env"

  179.       register: matrix_bot_honoroit_env_file

  180. 

  181.     - name: Assert the parsed environment contains the Matrix and Postgres wiring

  182.       ansible.builtin.assert:

  183.         that:

  184.           - matrix_bot_honoroit_rendered_env.HONOROIT_LOGIN == matrix_bot_honoroit_login

  185.           - matrix_bot_honoroit_rendered_env.HONOROIT_PASSWORD == matrix_bot_honoroit_password

  186.           - matrix_bot_honoroit_rendered_env.HONOROIT_HOMESERVER == matrix_bot_honoroit_homeserver

  187.           - matrix_bot_honoroit_rendered_env.HONOROIT_ROOMID == matrix_bot_honoroit_roomid

  188.           - matrix_bot_honoroit_rendered_env.HONOROIT_DB_DIALECT == 'postgres'

  189.           - matrix_bot_honoroit_rendered_env.HONOROIT_DB_DSN == 'postgres://molecule_honoroit_user:molecule_honoroit_password_8c45d1@matrix-postgres-molecule:5432/molecule_honoroit_database?sslmode=disable'

  190.         fail_msg: "The parsed environment lost the scenario's Matrix or Postgres wiring"

  191.         success_msg: "The parsed environment carries the scenario's Matrix and Postgres wiring"

  192. 

  193.     - name: Assert the parsed environment contains non-default bot behavior

  194.       ansible.builtin.assert:

  195.         that:

  196.           - matrix_bot_honoroit_rendered_env.HONOROIT_PREFIX == '!molecule-help'

  197.           - matrix_bot_honoroit_rendered_env.HONOROIT_NOENCRYPTIONWARNING | lower == 'true'

  198.           - matrix_bot_honoroit_rendered_env.HONOROIT_LOGLEVEL == 'DEBUG'

  199.           - matrix_bot_honoroit_rendered_env.HONOROIT_CACHESIZE == '317'

  200.           - matrix_bot_honoroit_rendered_env.HONOROIT_IGNORENOTHREAD | lower == 'true'

  201.           - matrix_bot_honoroit_rendered_env.HONOROIT_IGNOREDROOMS == '!molecule-ignored-one:molecule.local !molecule-ignored-two:molecule.local'

  202.           - matrix_bot_honoroit_rendered_env.HONOROIT_ALLOWEDUSERS == '@support-*:molecule.local @operator:molecule.local'

  203.           - matrix_bot_honoroit_rendered_env.HONOROIT_TEXT_PREFIX_OPEN == '[MOLECULE OPEN]'

  204.           - matrix_bot_honoroit_rendered_env.HONOROIT_TEXT_PREFIX_DONE == '[MOLECULE DONE]'

  205.           - matrix_bot_honoroit_rendered_env.HONOROIT_TEXT_GREETINGS == 'Molecule helpdesk greeting'

  206.           - matrix_bot_honoroit_rendered_env.HONOROIT_TEXT_DONE == 'Molecule helpdesk completion'

  207.         fail_msg: "The parsed environment lost non-default Honoroit behavior"

  208.         success_msg: "The parsed environment carries non-default Honoroit behavior"

  209. 

  210.     - name: Assert the parsed environment contains metrics auth and extension values

  211.       ansible.builtin.assert:

  212.         that:

  213.           - matrix_bot_honoroit_rendered_env.HONOROIT_AUTH_METRICS_LOGIN == 'molecule-metrics-user'

  214.           - matrix_bot_honoroit_rendered_env.HONOROIT_AUTH_METRICS_PASSWORD == 'molecule_metrics_password_c9ed32'

  215.           - matrix_bot_honoroit_rendered_env.HONOROIT_PORT == ':' ~ (matrix_bot_honoroit_container_port | string)

  216.           - matrix_bot_honoroit_rendered_env.MOLECULE_HONOROIT_MARKER == 'role-rendered-environment'

  217.         fail_msg: "The parsed environment lost the metrics auth or extension values"

  218.         success_msg: "The parsed environment carries metrics auth and extension values"

  219. 

  220.     - name: List the tables Honoroit created in Postgres

  221.       ansible.builtin.command:

  222.         argv:

  223.           - docker

  224.           - exec

  225.           - matrix-postgres-molecule

  226.           - psql

  227.           - --username={{ matrix_bot_honoroit_database_username }}

  228.           - --dbname={{ matrix_bot_honoroit_database_name }}

  229.           - --tuples-only

  230.           - --no-align

  231.           - --command=SELECT tablename FROM pg_tables WHERE schemaname = 'public' ORDER BY tablename

  232.       register: matrix_bot_honoroit_tables

  233.       changed_when: false

  234. 

  235.     - name: Assert Honoroit migrated a substantial schema into the configured Postgres database

  236.       ansible.builtin.assert:

  237.         that:

  238.           - matrix_bot_honoroit_tables.rc == 0

  239.           - "'crypto_account' in matrix_bot_honoroit_table_names"

  240.           - "'crypto_device' in matrix_bot_honoroit_table_names"

  241.           - "'crypto_megolm_inbound_session' in matrix_bot_honoroit_table_names"

  242.           - "'crypto_olm_session' in matrix_bot_honoroit_table_names"

  243.           - "'crypto_secrets' in matrix_bot_honoroit_table_names"

  244.           - "'crypto_version' in matrix_bot_honoroit_table_names"

  245.           - "'mx_registrations' in matrix_bot_honoroit_table_names"

  246.           - "'mx_room_state' in matrix_bot_honoroit_table_names"

  247.           - "'mx_user_profile' in matrix_bot_honoroit_table_names"

  248.           - "'mx_version' in matrix_bot_honoroit_table_names"

  249.           - matrix_bot_honoroit_table_names | length == 17

  250.         fail_msg: >-

  251.           Honoroit did not create its crypto schema in {{ matrix_bot_honoroit_database_name }}

  252.           (found {{ matrix_bot_honoroit_table_names | length }} table(s):

  253.           {{ matrix_bot_honoroit_table_names | join(', ') }})

  254.         success_msg: "Honoroit migrated its crypto schema into the configured Postgres database"

  255.       vars:

  256.         matrix_bot_honoroit_table_names: "{{ matrix_bot_honoroit_tables.stdout_lines | select | list }}"

  257. 

  258.     - name: Read Honoroit's database migration markers

  259.       ansible.builtin.command:

  260.         argv:

  261.           - docker

  262.           - exec

  263.           - matrix-postgres-molecule

  264.           - psql

  265.           - --username={{ matrix_bot_honoroit_database_username }}

  266.           - --dbname={{ matrix_bot_honoroit_database_name }}

  267.           - --tuples-only

  268.           - --no-align

  269.           - "--command=SELECT 'crypto:' || version || ':' || compat FROM crypto_version UNION ALL SELECT 'state:' || version || ':' || compat FROM mx_version ORDER BY 1"

  270.       register: matrix_bot_honoroit_migration_versions

  271.       changed_when: false

  272. 

  273.     - name: Assert Honoroit's Postgres migrations reached the pinned schema versions

  274.       ansible.builtin.assert:

  275.         that:

  276.           - matrix_bot_honoroit_migration_versions.rc == 0

  277.           - matrix_bot_honoroit_migration_versions.stdout_lines == ['crypto:19:15', 'state:10:3']

  278.         fail_msg: >-

  279.           Honoroit's database migration markers are missing or unexpected

  280.           ({{ matrix_bot_honoroit_migration_versions.stdout | default('no output') | trim }})

  281.         success_msg: "Honoroit's Postgres migrations reached the pinned schema versions"

  282. 

  283.     - name: Read Honoroit's full systemd journal

  284.       ansible.builtin.command:

  285.         argv:

  286.           - journalctl

  287.           - --unit=matrix-bot-honoroit.service

  288.           - --no-pager

  289.       register: matrix_bot_honoroit_journal

  290.       changed_when: false

  291. 

  292.     - name: Assert the journal records successful initialization and configured debug logging

  293.       ansible.builtin.assert:

  294.         that:

  295.           - "'Honoroit' in matrix_bot_honoroit_journal_plain"

  296.           - "'starting bot...' in matrix_bot_honoroit_journal_plain"

  297.           - "'client has been started' in matrix_bot_honoroit_journal_plain"

  298.           - "'cannot initialize the bot' not in matrix_bot_honoroit_journal_plain"

  299.           - "'matrix bot crashed' not in matrix_bot_honoroit_journal_plain"

  300.         fail_msg: "Honoroit's journal does not show a clean debug-level startup"

  301.         success_msg: "Honoroit's journal records a clean debug-level startup"

  302.       vars:

  303.         matrix_bot_honoroit_journal_plain: >-

  304.           {{ matrix_bot_honoroit_journal.stdout

  305.              | regex_replace('\x1B\[[0-?]*[ -/]*[@-~]', '') }}

  306. 

  307.     - name: Inspect the running Honoroit container

  308.       ansible.builtin.command:

  309.         argv:

  310.           - docker

  311.           - container

  312.           - inspect

  313.           - matrix-bot-honoroit

  314.       register: matrix_bot_honoroit_container_inspect

  315.       changed_when: false

  316. 

  317.     - name: Assert the running container uses the exact image pinned by the role

  318.       ansible.builtin.assert:

  319.         that:

  320.           - matrix_bot_honoroit_runtime.Config.Image == matrix_bot_honoroit_expected_image

  321.         fail_msg: >-

  322.           The running image is {{ matrix_bot_honoroit_runtime.Config.Image }}, expected

  323.           {{ matrix_bot_honoroit_expected_image }} from defaults/main.yml

  324.         success_msg: "The running container uses the exact image pinned by the role"

  325.       vars:

  326.         matrix_bot_honoroit_expected_image: >-

  327.           {{ matrix_bot_honoroit_role_defaults.matrix_bot_honoroit_container_image_registry_prefix_upstream_default }}etkecc/honoroit:{{ matrix_bot_honoroit_role_defaults.matrix_bot_honoroit_version }}

  328. 

  329.     - name: Assert the running container preserves the image and systemd lifecycle contract

  330.       ansible.builtin.assert:

  331.         that:

  332.           - matrix_bot_honoroit_runtime.Config.Entrypoint == ['/bin/honoroit']

  333.           - matrix_bot_honoroit_runtime.Config.Cmd is none

  334.           - matrix_bot_honoroit_runtime.Config.WorkingDir == '/'

  335.           - matrix_bot_honoroit_runtime.HostConfig.RestartPolicy.Name == 'no'

  336.           - matrix_bot_honoroit_runtime.HostConfig.AutoRemove is sameas true

  337.           - matrix_bot_honoroit_runtime.HostConfig.LogConfig.Type == 'none'

  338.         fail_msg: "The running container has an unexpected command or Docker lifecycle contract"

  339.         success_msg: "The running container preserves the image command and systemd lifecycle contract"

  340. 

  341.     - name: Assert the running container uses the configured identity and hardening

  342.       ansible.builtin.assert:

  343.         that:

  344.           - matrix_bot_honoroit_runtime.Config.User == '1234:1234'

  345.           - matrix_bot_honoroit_runtime.HostConfig.ReadonlyRootfs is sameas true

  346.           - matrix_bot_honoroit_runtime.HostConfig.CapDrop == ['ALL']

  347.           - matrix_bot_honoroit_runtime.HostConfig.PidsLimit == 73

  348.           - matrix_bot_honoroit_runtime.HostConfig.Tmpfs['/tmp'] == 'rw,noexec,nosuid,size=16m'

  349.         fail_msg: "The running container lost its configured identity or hardening"

  350.         success_msg: "The running container uses the configured identity and hardening"

  351. 

  352.     - name: Assert the running container has only private network attachments

  353.       ansible.builtin.assert:

  354.         that:

  355.           - matrix_bot_honoroit_runtime.HostConfig.NetworkMode == matrix_bot_honoroit_container_network

  356.           - matrix_bot_honoroit_runtime.NetworkSettings.Networks.keys() | sort == ([matrix_bot_honoroit_container_network] + matrix_bot_honoroit_container_additional_networks) | sort

  357.           - matrix_bot_honoroit_runtime.HostConfig.PortBindings | length == 0

  358.         fail_msg: "The running container lost a private network or published a host port"

  359.         success_msg: "The running container has both private networks and no published host ports"

  360. 

  361.     - name: Assert the writable data mount is scoped to Honoroit's data directory

  362.       ansible.builtin.assert:

  363.         that:

  364.           - matrix_bot_honoroit_runtime.Mounts | length == 1

  365.           - matrix_bot_honoroit_data_mounts | length == 1

  366.           - matrix_bot_honoroit_data_mounts[0].Source == matrix_bot_honoroit_data_path

  367.           - matrix_bot_honoroit_data_mounts[0].RW is sameas true

  368.         fail_msg: "The running container's /data mount does not match the role-managed data path"

  369.         success_msg: "The running container has the role-managed writable /data mount"

  370. 

  371.     - name: Assert the running process received the role-rendered environment

  372.       ansible.builtin.assert:

  373.         that:

  374.           - matrix_bot_honoroit_runtime_env.HONOROIT_DB_DSN == matrix_bot_honoroit_rendered_env.HONOROIT_DB_DSN

  375.           - matrix_bot_honoroit_runtime_env.HONOROIT_HOMESERVER == matrix_bot_honoroit_rendered_env.HONOROIT_HOMESERVER

  376.           - matrix_bot_honoroit_runtime_env.HONOROIT_AUTH_METRICS_LOGIN == matrix_bot_honoroit_rendered_env.HONOROIT_AUTH_METRICS_LOGIN

  377.           - matrix_bot_honoroit_runtime_env.HONOROIT_PORT == ':' ~ (matrix_bot_honoroit_container_port | string)

  378.           - matrix_bot_honoroit_runtime_env.MOLECULE_HONOROIT_MARKER == 'role-rendered-environment'

  379.         fail_msg: "The live container environment differs from the file the role rendered"

  380.         success_msg: "The live container received the role-rendered environment"

  381. 

  382.     - name: Read the labels file the role rendered

  383.       ansible.builtin.slurp:

  384.         src: "{{ matrix_bot_honoroit_config_path }}/labels"

  385.       register: matrix_bot_honoroit_labels_file

  386. 

  387.     - name: Assert the parsed labels contain the configured metrics router

  388.       ansible.builtin.assert:

  389.         that:

  390.           - matrix_bot_honoroit_rendered_labels['traefik.enable'] == 'true'

  391.           - matrix_bot_honoroit_rendered_labels['traefik.docker.network'] == matrix_bot_honoroit_container_network

  392.           - matrix_bot_honoroit_rendered_labels['traefik.http.services.matrix-bot-honoroit-metrics.loadbalancer.server.port'] == (matrix_bot_honoroit_container_port | string)

  393.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.rule'] == 'Host(`honoroit.molecule.local`) && Path(`/molecule-honoroit/molecule-metrics`)'

  394.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.priority'] == '710'

  395.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.service'] == 'matrix-bot-honoroit-metrics'

  396.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.entrypoints'] == 'molecule-web'

  397.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.tls'] == 'false'

  398.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.tls.certResolver'] is not defined

  399.         fail_msg: "The parsed labels lost the scenario's metrics router contract"

  400.         success_msg: "The parsed labels contain the configured metrics router"

  401. 

  402.     - name: Assert the parsed labels contain the configured middleware chain

  403.       ansible.builtin.assert:

  404.         that:

  405.           - matrix_bot_honoroit_rendered_labels['traefik.http.middlewares.matrix-bot-honoroit-slashless-redirect.redirectregex.regex'] == '(/molecule-honoroit)$'

  406.           - matrix_bot_honoroit_rendered_labels['traefik.http.middlewares.matrix-bot-honoroit-slashless-redirect.redirectregex.replacement'] == '${1}/'

  407.           - matrix_bot_honoroit_rendered_labels['traefik.http.middlewares.matrix-bot-honoroit-strip-prefix.stripprefix.prefixes'] == '/molecule-honoroit'

  408.           - matrix_bot_honoroit_rendered_labels['traefik.http.middlewares.matrix-bot-honoroit-add-headers.headers.customresponseheaders.X-Molecule-Honoroit'] == 'scenario'

  409.           - matrix_bot_honoroit_rendered_labels['traefik.http.middlewares.matrix-bot-honoroit-add-headers.headers.customresponseheaders.X-Robots-Tag'] == 'noindex'

  410.           - matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.middlewares'] == 'matrix-bot-honoroit-slashless-redirect,matrix-bot-honoroit-strip-prefix,matrix-bot-honoroit-add-headers'

  411.         fail_msg: "The parsed labels lost the scenario's path and response-header middlewares"

  412.         success_msg: "The parsed labels contain the configured middleware chain"

  413. 

  414.     - name: Assert the live container received the rendered router and middleware labels

  415.       ansible.builtin.assert:

  416.         that:

  417.           - matrix_bot_honoroit_runtime.Config.Labels['traefik.http.services.matrix-bot-honoroit-metrics.loadbalancer.server.port'] == (matrix_bot_honoroit_container_port | string)

  418.           - matrix_bot_honoroit_runtime.Config.Labels['traefik.http.routers.matrix-bot-honoroit-metrics.rule'] == matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.rule']

  419.           - matrix_bot_honoroit_runtime.Config.Labels['traefik.http.routers.matrix-bot-honoroit-metrics.priority'] == matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.priority']

  420.           - matrix_bot_honoroit_runtime.Config.Labels['traefik.http.routers.matrix-bot-honoroit-metrics.middlewares'] == matrix_bot_honoroit_rendered_labels['traefik.http.routers.matrix-bot-honoroit-metrics.middlewares']

  421.           - matrix_bot_honoroit_runtime.Config.Labels['traefik.http.middlewares.matrix-bot-honoroit-add-headers.headers.customresponseheaders.X-Molecule-Honoroit'] == 'scenario'

  422.           - matrix_bot_honoroit_runtime.Config.Labels['molecule.honoroit.scenario'] == 'live-postgres-and-metrics'

  423.         fail_msg: "The live container labels differ from the rendered routing contract"

  424.         success_msg: "The live container received the rendered router and middleware labels"

  425. 

  426.     - name: Inspect role-rendered support file ownership and permissions

  427.       ansible.builtin.stat:

  428.         path: "{{ item }}"

  429.       loop:

  430.         - "{{ matrix_bot_honoroit_config_path }}/env"

  431.         - "{{ matrix_bot_honoroit_config_path }}/labels"

  432.       register: matrix_bot_honoroit_support_files

  433. 

  434.     - name: Assert support files are owned by Matrix and not world-readable

  435.       ansible.builtin.assert:

  436.         that:

  437.           - matrix_bot_honoroit_support_files.results | map(attribute='stat.uid') | unique | list == [1234]

  438.           - matrix_bot_honoroit_support_files.results | map(attribute='stat.gid') | unique | list == [1234]

  439.           - matrix_bot_honoroit_support_files.results | map(attribute='stat.mode') | unique | list == ['0640']

  440.         fail_msg: "Honoroit's support files have unexpected ownership or permissions"

  441.         success_msg: "Honoroit's support files are Matrix-owned and mode 0640"