overmind
/
matrix-docker-ansible-deploy
огледало од https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
Креирај огранак 0
Код Дискусије 0 Издања 0 Вики Activity
Matrix Docker Ansible eploy
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
11939 Комити
2 Гране
137 MiB
 
 
 
Дрво: c8087f4f20
Гране Ознаке
${ item.name }
Create branch ${ searchTerm }
from 'c8087f4f20'
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-element-admin/molecule/default/verify.yml

308 lines
16 KiB
Датотека Blame Историја 

  1. # SPDX-FileCopyrightText: 2026 Slavi Pantaleev

  2. #

  3. # SPDX-License-Identifier: AGPL-3.0-or-later

  4. 

  5. ---

  6. # Element Admin is a static browser client. Its real application root and the live

  7. # configuration embedded from the role's env file are the weight-bearing checks; no

  8. # homeserver or third-party credentials are needed for the process to start.

  9. - name: Verify matrix-element-admin

  10.   hosts: all

  11.   become: true

  12.   vars_files:

  13.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"

  14.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"

  15.   vars:

  16.     matrix_element_admin_root_body: "{{ matrix_element_admin_root_http.stdout_lines[:-1] | join('\n') }}"

  17.     matrix_element_admin_runtime: "{{ (matrix_element_admin_container_inspect.stdout | from_json) | first }}"

  18.   gather_facts: false

  19. 

  20.   tasks:

  21.     # Loading the pin from the role keeps this scenario coupled to the shipped image

  22.     # without duplicating a version which could silently drift.

  23.     - name: Load the role's defaults under a separate name

  24.       ansible.builtin.include_vars:

  25.         file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"

  26.         name: matrix_element_admin_role_defaults

  27. 

  28.     - name: Wait for the matrix-element-admin service to become active

  29.       ansible.builtin.systemd_service:

  30.         name: matrix-element-admin.service

  31.       register: matrix_element_admin_service

  32.       until: matrix_element_admin_service.status.ActiveState == 'active'

  33.       retries: 30

  34.       delay: 5

  35.       failed_when: false

  36. 

  37.     # Restart=always means ActiveState alone can be green while the container crash-loops.

  38.     - name: Assert the service is active and has not restarted

  39.       ansible.builtin.assert:

  40.         that:

  41.           - matrix_element_admin_service.status.ActiveState == 'active'

  42.           - matrix_element_admin_service.status.NRestarts is defined

  43.           - matrix_element_admin_service.status.NRestarts | int == 0

  44.         fail_msg: >-

  45.           matrix-element-admin.service is

  46.           {{ matrix_element_admin_service.status.ActiveState | default('unknown') }} after

  47.           {{ matrix_element_admin_service.status.NRestarts | default('?') }} restart(s)

  48.         success_msg: "matrix-element-admin.service is active and has not restarted"

  49. 

  50.     # Probe over the dedicated container network. Publishing a host port only for the

  51.     # test would diverge from how Traefik reaches the service in real installations.

  52.     - name: Wait for Element Admin to serve its application root

  53.       ansible.builtin.command:

  54.         argv:

  55.           - docker

  56.           - run

  57.           - --rm

  58.           - --network={{ matrix_element_admin_container_network }}

  59.           - "{{ molecule_shared_image_curl }}"

  60.           - --silent

  61.           - --show-error

  62.           - --write-out

  63.           - "\nHTTP_STATUS=%{http_code}"

  64.           - http://matrix-element-admin:8080/

  65.       register: matrix_element_admin_root_http

  66.       changed_when: false

  67.       until: "'HTTP_STATUS=200' in matrix_element_admin_root_http.stdout"

  68.       retries: 24

  69.       delay: 5

  70.       failed_when: false

  71. 

  72.     - name: Assert the application root is real Element Admin HTML

  73.       ansible.builtin.assert:

  74.         that:

  75.           - matrix_element_admin_root_http.rc == 0

  76.           - matrix_element_admin_root_http.stdout_lines[-1] == 'HTTP_STATUS=200'

  77.           - matrix_element_admin_root_body | trim | length > 100

  78.           - "'<!doctype html' in matrix_element_admin_root_body | lower"

  79.           - "'element admin' in matrix_element_admin_root_body | lower"

  80.         fail_msg: >-

  81.           Element Admin did not return its application HTML from the container network

  82.           (rc={{ matrix_element_admin_root_http.rc }}, status={{ matrix_element_admin_root_http.stdout_lines[-1] | default('missing') }})

  83.         success_msg: "Element Admin serves its real application root over HTTP"

  84. 

  85.     # The image entrypoint base64-embeds JSON in index.html from SERVER_NAME. Decode

  86.     # that exact live value instead of trusting that the environment merely exists.

  87.     - name: Extract the live configuration and application asset path

  88.       ansible.builtin.set_fact:

  89.         matrix_element_admin_embedded_config_base64: >-

  90.           {{ matrix_element_admin_root_body | regex_search('(?<=window.APP_CONFIG_BASE64 = ")[^"]+(?=";)') }}

  91.         matrix_element_admin_application_asset_path: >-

  92.           {{ matrix_element_admin_root_body | regex_search('(?<=src=")[/]assets[/][^"]+(?=")') }}

  93. 

  94.     - name: Decode the live Element Admin configuration

  95.       ansible.builtin.set_fact:

  96.         matrix_element_admin_embedded_config: >-

  97.           {{ matrix_element_admin_embedded_config_base64 | b64decode | from_json }}

  98. 

  99.     - name: Assert the live configuration carries the configured homeserver name

  100.       ansible.builtin.assert:

  101.         that:

  102.           - matrix_element_admin_embedded_config is mapping

  103.           - matrix_element_admin_embedded_config.keys() | list == ['serverName']

  104.           - matrix_element_admin_embedded_config.serverName == matrix_element_admin_environment_variable_server_name

  105.         fail_msg: >-

  106.           Element Admin's live embedded configuration does not carry the SERVER_NAME value rendered by the role

  107.         success_msg: "The live application configuration carries the configured homeserver name"

  108. 

  109.     # Fetch a hashed application bundle referenced by the live HTML. This exercises a

  110.     # real non-root HTTP path without claiming support for an invalid public subpath.

  111.     - name: Fetch a live Element Admin application asset

  112.       ansible.builtin.command:

  113.         argv:

  114.           - docker

  115.           - run

  116.           - --rm

  117.           - --network={{ matrix_element_admin_container_network }}

  118.           - "{{ molecule_shared_image_curl }}"

  119.           - --silent

  120.           - --show-error

  121.           - --output

  122.           - /dev/null

  123.           - --write-out

  124.           - "HTTP_STATUS=%{http_code}\nCONTENT_TYPE=%{content_type}\nSIZE=%{size_download}"

  125.           - "http://matrix-element-admin:8080{{ matrix_element_admin_application_asset_path }}"

  126.       register: matrix_element_admin_asset_http

  127.       changed_when: false

  128.       failed_when: false

  129. 

  130.     - name: Assert the non-root application asset is served

  131.       ansible.builtin.assert:

  132.         that:

  133.           - matrix_element_admin_asset_http.rc == 0

  134.           - "'HTTP_STATUS=200' in matrix_element_admin_asset_http.stdout_lines"

  135.           - matrix_element_admin_asset_http.stdout | regex_search('(?m)^CONTENT_TYPE=application/javascript(?:;|$)') is not none

  136.           - matrix_element_admin_asset_http.stdout | regex_search('SIZE=([1-9][0-9]{2,})') is not none

  137.         fail_msg: "Element Admin did not serve the application bundle referenced by its live HTML"

  138.         success_msg: "Element Admin serves a real non-root application asset"

  139. 

  140.     - name: Read the environment file the role rendered

  141.       ansible.builtin.slurp:

  142.         src: "{{ matrix_element_admin_base_path }}/env"

  143.       register: matrix_element_admin_env_file

  144. 

  145.     - name: Initialize the parsed environment

  146.       ansible.builtin.set_fact:

  147.         matrix_element_admin_env_parsed: {}

  148. 

  149.     - name: Parse the rendered environment

  150.       ansible.builtin.set_fact:

  151.         matrix_element_admin_env_parsed: >-

  152.           {{ matrix_element_admin_env_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }}

  153.       loop: "{{ (matrix_element_admin_env_file.content | b64decode).splitlines() | reject('equalto', '') }}"

  154.       when: "'=' in item"

  155.       no_log: true

  156. 

  157.     - name: Assert the rendered environment carries the scenario settings

  158.       ansible.builtin.assert:

  159.         that:

  160.           - matrix_element_admin_env_parsed.SERVER_NAME == matrix_element_admin_environment_variable_server_name

  161.           - matrix_element_admin_env_parsed.MOLECULE_ELEMENT_ADMIN_MARKER == 'environment-reached'

  162.         fail_msg: "The parsed environment does not carry the scenario's values"

  163.         success_msg: "The parsed environment carries the scenario's values"

  164. 

  165.     - name: Read the labels file the role rendered

  166.       ansible.builtin.slurp:

  167.         src: "{{ matrix_element_admin_base_path }}/labels"

  168.       register: matrix_element_admin_labels_file

  169. 

  170.     - name: Initialize the parsed labels

  171.       ansible.builtin.set_fact:

  172.         matrix_element_admin_labels_parsed: {}

  173. 

  174.     - name: Parse the rendered labels

  175.       ansible.builtin.set_fact:

  176.         matrix_element_admin_labels_parsed: >-

  177.           {{ matrix_element_admin_labels_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }}

  178.       loop: "{{ (matrix_element_admin_labels_file.content | b64decode).splitlines() | reject('equalto', '') }}"

  179.       when: "'=' in item"

  180.       no_log: true

  181. 

  182.     - name: Assert the rendered labels carry the public routing contract

  183.       ansible.builtin.assert:

  184.         that:

  185.           - matrix_element_admin_labels_parsed['traefik.enable'] == 'true'

  186.           - matrix_element_admin_labels_parsed['traefik.docker.network'] == matrix_element_admin_container_network

  187.           - matrix_element_admin_labels_parsed['traefik.http.services.matrix-element-admin.loadbalancer.server.port'] == '8080'

  188.           - matrix_element_admin_labels_parsed['traefik.http.routers.matrix-element-admin.rule'] == 'Host(`element-admin-console.molecule.local`)'

  189.           - matrix_element_admin_labels_parsed['traefik.http.routers.matrix-element-admin.priority'] == '619'

  190.           - matrix_element_admin_labels_parsed['traefik.http.routers.matrix-element-admin.entrypoints'] == 'web'

  191.           - matrix_element_admin_labels_parsed['traefik.http.routers.matrix-element-admin.tls'] == 'false'

  192.           - matrix_element_admin_labels_parsed['molecule.element-admin.coverage'] == 'enabled'

  193.         fail_msg: "The rendered labels do not carry the scenario's routing values"

  194.         success_msg: "The rendered labels carry the scenario's routing values"

  195. 

  196.     - name: Inspect the running Element Admin container

  197.       ansible.builtin.command:

  198.         argv:

  199.           - docker

  200.           - container

  201.           - inspect

  202.           - matrix-element-admin

  203.       register: matrix_element_admin_container_inspect

  204.       changed_when: false

  205. 

  206.     - name: Assert the configured environment reached the running container

  207.       ansible.builtin.assert:

  208.         that:

  209.           - "('SERVER_NAME=' ~ matrix_element_admin_environment_variable_server_name) in matrix_element_admin_runtime.Config.Env"

  210.           - "'MOLECULE_ELEMENT_ADMIN_MARKER=environment-reached' in matrix_element_admin_runtime.Config.Env"

  211.         fail_msg: "The running container environment does not carry the scenario's settings"

  212.         success_msg: "The configured environment reached the running container"

  213. 

  214.     - name: Assert the rendered labels reached the running container

  215.       ansible.builtin.assert:

  216.         that:

  217.           - matrix_element_admin_runtime.Config.Labels['traefik.enable'] == 'true'

  218.           - matrix_element_admin_runtime.Config.Labels['traefik.docker.network'] == matrix_element_admin_container_network

  219.           - matrix_element_admin_runtime.Config.Labels['traefik.http.routers.matrix-element-admin.priority'] == '619'

  220.           - matrix_element_admin_runtime.Config.Labels['molecule.element-admin.coverage'] == 'enabled'

  221.         fail_msg: "The running container does not carry the labels the role rendered"

  222.         success_msg: "The rendered labels reached the running container"

  223. 

  224.     - name: Assert the running container uses the exact image and version the role pins

  225.       ansible.builtin.assert:

  226.         that:

  227.           - matrix_element_admin_runtime.Config.Image == matrix_element_admin_expected_image

  228.         fail_msg: >-

  229.           The running container uses {{ matrix_element_admin_runtime.Config.Image }},

  230.           expected {{ matrix_element_admin_expected_image }}

  231.         success_msg: "The running container uses the exact image and version defaults/main.yml pins"

  232.       vars:

  233.         matrix_element_admin_expected_image: >-

  234.           {{ matrix_element_admin_role_defaults.matrix_element_admin_container_image_registry_prefix_upstream_default }}element-admin:{{ matrix_element_admin_role_defaults.matrix_element_admin_version }}

  235. 

  236.     - name: Assert the running container uses the configured UID and GID

  237.       ansible.builtin.assert:

  238.         that:

  239.           - matrix_element_admin_runtime.Config.User == (matrix_user_uid | string) ~ ':' ~ (matrix_user_gid | string)

  240.         fail_msg: >-

  241.           The running container uses {{ matrix_element_admin_runtime.Config.User }},

  242.           expected {{ matrix_user_uid }}:{{ matrix_user_gid }}

  243.         success_msg: "The running container uses the configured UID and GID"

  244. 

  245.     - name: Assert the running container command contract

  246.       ansible.builtin.assert:

  247.         that:

  248.           - matrix_element_admin_runtime.Config.Entrypoint == ['/docker-entrypoint.sh']

  249.           - matrix_element_admin_runtime.Config.Cmd == ['nginx', '-g', 'daemon off;']

  250.         fail_msg: >-

  251.           The running container has unexpected entrypoint/command values:

  252.           {{ matrix_element_admin_runtime.Config.Entrypoint }} {{ matrix_element_admin_runtime.Config.Cmd }}

  253.         success_msg: "The role preserves the image's Element Admin entrypoint and command"

  254. 

  255.     - name: Assert the running container security contract

  256.       ansible.builtin.assert:

  257.         that:

  258.           - matrix_element_admin_runtime.HostConfig.ReadonlyRootfs is sameas true

  259.           - matrix_element_admin_runtime.HostConfig.Privileged is sameas false

  260.           - matrix_element_admin_runtime.HostConfig.CapAdd | default([], true) | length == 0

  261.           - matrix_element_admin_runtime.HostConfig.CapDrop == ['ALL']

  262.         fail_msg: "The Element Admin container is missing its read-only root or dropped capabilities"

  263.         success_msg: "The Element Admin container has a read-only root and all capabilities dropped"

  264. 

  265.     - name: Assert the intended writable path is a constrained tmpfs mount

  266.       ansible.builtin.assert:

  267.         that:

  268.           - matrix_element_admin_runtime.Mounts | length == 0

  269.           - matrix_element_admin_runtime.HostConfig.Binds | default([], true) | length == 0

  270.           - matrix_element_admin_runtime.HostConfig.Tmpfs.keys() | list == ['/tmp']

  271.           - matrix_element_admin_runtime.HostConfig.Tmpfs['/tmp'] == 'rw,noexec,nosuid,size=1024m'

  272.         fail_msg: "The running container does not have the role's exact /tmp tmpfs contract"

  273.         success_msg: "The running container has the exact constrained /tmp tmpfs mount"

  274. 

  275.     - name: Assert the running container is attached only to its dedicated network

  276.       ansible.builtin.assert:

  277.         that:

  278.           - matrix_element_admin_runtime.NetworkSettings.Networks is mapping

  279.           - matrix_element_admin_runtime.NetworkSettings.Networks | length == 1

  280.           - matrix_element_admin_container_network in matrix_element_admin_runtime.NetworkSettings.Networks

  281.         fail_msg: >-

  282.           Element Admin has unexpected network attachments:

  283.           {{ matrix_element_admin_runtime.NetworkSettings.Networks.keys() | list }}

  284.         success_msg: "The running container is attached only to its dedicated network"

  285. 

  286.     - name: Ask Docker for Element Admin's published ports

  287.       ansible.builtin.command:

  288.         argv:

  289.           - docker

  290.           - container

  291.           - port

  292.           - matrix-element-admin

  293.       register: matrix_element_admin_published_ports

  294.       changed_when: false

  295.       failed_when: false

  296. 

  297.     - name: Assert the role publishes no host ports

  298.       ansible.builtin.assert:

  299.         that:

  300.           - matrix_element_admin_runtime.Config.ExposedPorts.keys() | list == ['8080/tcp']

  301.           - matrix_element_admin_runtime.HostConfig.PortBindings | default({}, true) | length == 0

  302.           - matrix_element_admin_published_ports.rc == 0

  303.           - matrix_element_admin_published_ports.stdout | trim | length == 0

  304.         fail_msg: >-

  305.           Element Admin unexpectedly publishes a host port:

  306.           {{ matrix_element_admin_published_ports.stdout | default('unknown') }}

  307.         success_msg: "The role leaves Element Admin's HTTP port unpublished"