overmind
/
matrix-docker-ansible-deploy
огледало од https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
Креирај огранак 0
Код Дискусије 0 Издања 0 Вики Activity
Matrix Docker Ansible eploy
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
11939 Комити
2 Гране
137 MiB
 
 
 
Дрво: c8087f4f20
Гране Ознаке
${ item.name }
Create branch ${ searchTerm }
from 'c8087f4f20'
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-element-call/molecule/default/verify.yml

319 lines
17 KiB
Датотека Blame Историја 

  1. # SPDX-FileCopyrightText: 2026 Slavi Pantaleev

  2. #

  3. # SPDX-License-Identifier: AGPL-3.0-or-later

  4. 

  5. ---

  6. # Element Call is a static browser application. Its live JSON configuration and

  7. # a browser bundle are the weight-bearing probes; no Matrix or LiveKit account is needed.

  8. - name: Verify matrix-element-call

  9.   hosts: all

  10.   become: true

  11.   vars_files:

  12.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"

  13.     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"

  14.   vars:

  15.     matrix_element_call_root_body: "{{ matrix_element_call_root_http.stdout_lines[:-1] | join('\n') }}"

  16.     matrix_element_call_runtime: "{{ (matrix_element_call_container_inspect.stdout | from_json) | first }}"

  17.   gather_facts: false

  18. 

  19.   tasks:

  20.     # A Renovate bump changes this source of truth and therefore the image expectation.

  21.     - name: Load the role's defaults under a separate name

  22.       ansible.builtin.include_vars:

  23.         file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"

  24.         name: matrix_element_call_role_defaults

  25. 

  26.     - name: Wait for the matrix-element-call service to become active

  27.       ansible.builtin.systemd_service:

  28.         name: matrix-element-call.service

  29.       register: matrix_element_call_service

  30.       until: matrix_element_call_service.status.ActiveState == 'active'

  31.       retries: 30

  32.       delay: 5

  33.       failed_when: false

  34. 

  35.     # Restart=always makes ActiveState insufficient for detecting a crash loop.

  36.     - name: Assert the service is active and has not restarted

  37.       ansible.builtin.assert:

  38.         that:

  39.           - matrix_element_call_service.status.ActiveState == 'active'

  40.           - matrix_element_call_service.status.NRestarts is defined

  41.           - matrix_element_call_service.status.NRestarts | int == 0

  42.         fail_msg: >-

  43.           matrix-element-call.service is

  44.           {{ matrix_element_call_service.status.ActiveState | default('unknown') }} after

  45.           {{ matrix_element_call_service.status.NRestarts | default('?') }} restart(s)

  46.         success_msg: "matrix-element-call.service is active and has not restarted"

  47. 

  48.     # Probe through the private container network, matching the deployment path from Traefik.

  49.     - name: Wait for Element Call to serve its application root

  50.       ansible.builtin.command:

  51.         argv:

  52.           - docker

  53.           - run

  54.           - --rm

  55.           - --network={{ matrix_element_call_container_network }}

  56.           - "{{ molecule_shared_image_curl }}"

  57.           - --silent

  58.           - --show-error

  59.           - --write-out

  60.           - "\nHTTP_STATUS=%{http_code}"

  61.           - http://matrix-element-call:8080/

  62.       register: matrix_element_call_root_http

  63.       changed_when: false

  64.       until: "'HTTP_STATUS=200' in matrix_element_call_root_http.stdout"

  65.       retries: 24

  66.       delay: 5

  67.       failed_when: false

  68. 

  69.     - name: Assert the application root is real Element Call HTML

  70.       ansible.builtin.assert:

  71.         that:

  72.           - matrix_element_call_root_http.rc == 0

  73.           - matrix_element_call_root_http.stdout_lines[-1] == 'HTTP_STATUS=200'

  74.           - matrix_element_call_root_body | trim | length > 500

  75.           - "'<!doctype html' in matrix_element_call_root_body | lower"

  76.           - "'element call' in matrix_element_call_root_body | lower"

  77.         fail_msg: "Element Call did not return its real application HTML over the container network"

  78.         success_msg: "Element Call serves its real application root over HTTP"

  79. 

  80.     - name: Fetch Element Call's live browser configuration

  81.       ansible.builtin.command:

  82.         argv:

  83.           - docker

  84.           - run

  85.           - --rm

  86.           - --network={{ matrix_element_call_container_network }}

  87.           - "{{ molecule_shared_image_curl }}"

  88.           - --silent

  89.           - --show-error

  90.           - --write-out

  91.           - "\nHTTP_STATUS=%{http_code}\nCONTENT_TYPE=%{content_type}"

  92.           - http://matrix-element-call:8080/config.json

  93.       register: matrix_element_call_config_http

  94.       changed_when: false

  95.       failed_when: false

  96. 

  97.     - name: Assert the live browser configuration is served as JSON

  98.       ansible.builtin.assert:

  99.         that:

  100.           - matrix_element_call_config_http.rc == 0

  101.           - "'HTTP_STATUS=200' in matrix_element_call_config_http.stdout_lines"

  102.           - matrix_element_call_config_http.stdout | regex_search('(?m)^CONTENT_TYPE=application/json(?:;|$)') is not none

  103.         fail_msg: "Element Call did not serve its live browser configuration as JSON"

  104.         success_msg: "Element Call serves its live browser configuration as JSON"

  105. 

  106.     - name: Parse the live browser configuration

  107.       ansible.builtin.set_fact:

  108.         matrix_element_call_live_config: >-

  109.           {{ matrix_element_call_config_http.stdout | regex_replace('\nHTTP_STATUS=[0-9]+\nCONTENT_TYPE=.*$', '') | from_json }}

  110. 

  111.     - name: Assert the live configuration carries the configured homeserver and LiveKit service

  112.       ansible.builtin.assert:

  113.         that:

  114.           - matrix_element_call_live_config is mapping

  115.           - matrix_element_call_live_config.default_server_config['m.homeserver'].base_url == matrix_element_call_config_default_server_config_m_homeserver_base_url

  116.           - matrix_element_call_live_config.default_server_config['m.homeserver'].server_name == matrix_element_call_config_default_server_config_m_homeserver_server_name

  117.           - matrix_element_call_live_config.livekit.livekit_service_url == matrix_element_call_config_livekit_livekit_service_url

  118.         fail_msg: "The live config.json does not carry the non-default values rendered by the role"

  119.         success_msg: "The live config.json carries the configured homeserver and LiveKit service"

  120. 

  121.     - name: Read the configuration file the role rendered

  122.       ansible.builtin.slurp:

  123.         src: "{{ matrix_element_call_base_path }}/config.json"

  124.       register: matrix_element_call_rendered_config_file

  125. 

  126.     - name: Assert the served and rendered structured configurations are identical

  127.       ansible.builtin.assert:

  128.         that:

  129.           - matrix_element_call_rendered_config == matrix_element_call_live_config

  130.         fail_msg: "The live configuration differs from the parsed file the role rendered"

  131.         success_msg: "The running service exposes the exact structured configuration the role rendered"

  132.       vars:

  133.         matrix_element_call_rendered_config: >-

  134.           {{ matrix_element_call_rendered_config_file.content | b64decode | from_json }}

  135. 

  136.     # Fetch a browser bundle named by the live HTML, proving the image contains the application.

  137.     - name: Extract a live Element Call JavaScript asset path

  138.       ansible.builtin.set_fact:

  139.         matrix_element_call_application_asset_path: >-

  140.           {{ matrix_element_call_root_body | regex_search('(?<=src=")[^"]+[.]js(?=")') }}

  141. 

  142.     - name: Fetch the live Element Call application asset

  143.       ansible.builtin.command:

  144.         argv:

  145.           - docker

  146.           - run

  147.           - --rm

  148.           - --network={{ matrix_element_call_container_network }}

  149.           - "{{ molecule_shared_image_curl }}"

  150.           - --silent

  151.           - --show-error

  152.           - --output

  153.           - /dev/null

  154.           - --write-out

  155.           - "HTTP_STATUS=%{http_code}\nCONTENT_TYPE=%{content_type}\nSIZE=%{size_download}"

  156.           - "http://matrix-element-call:8080/{{ matrix_element_call_application_asset_path | regex_replace('^/', '') }}"

  157.       register: matrix_element_call_asset_http

  158.       changed_when: false

  159.       failed_when: false

  160. 

  161.     - name: Assert a real Element Call application asset is served

  162.       ansible.builtin.assert:

  163.         that:

  164.           - matrix_element_call_application_asset_path | length > 0

  165.           - matrix_element_call_asset_http.rc == 0

  166.           - "'HTTP_STATUS=200' in matrix_element_call_asset_http.stdout_lines"

  167.           - matrix_element_call_asset_http.stdout | regex_search('(?m)^CONTENT_TYPE=(?:application|text)/javascript(?:;|$)') is not none

  168.           - matrix_element_call_asset_http.stdout | regex_search('(?m)^SIZE=([1-9][0-9]{4,})$') is not none

  169.         fail_msg: "Element Call did not serve the substantial JavaScript asset referenced by its live HTML"

  170.         success_msg: "Element Call serves a substantial live application asset"

  171. 

  172.     - name: Read the labels file the role rendered

  173.       ansible.builtin.slurp:

  174.         src: "{{ matrix_element_call_base_path }}/labels"

  175.       register: matrix_element_call_labels_file

  176. 

  177.     - name: Initialize the parsed labels

  178.       ansible.builtin.set_fact:

  179.         matrix_element_call_labels_parsed: {}

  180. 

  181.     - name: Parse the rendered labels

  182.       ansible.builtin.set_fact:

  183.         matrix_element_call_labels_parsed: >-

  184.           {{ matrix_element_call_labels_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }}

  185.       loop: "{{ (matrix_element_call_labels_file.content | b64decode).splitlines() | reject('equalto', '') }}"

  186.       when: "'=' in item"

  187.       no_log: true

  188. 

  189.     - name: Assert the rendered labels carry the public routing contract

  190.       ansible.builtin.assert:

  191.         that:

  192.           - matrix_element_call_labels_parsed['traefik.enable'] == 'true'

  193.           - matrix_element_call_labels_parsed['traefik.docker.network'] == matrix_element_call_container_network

  194.           - matrix_element_call_labels_parsed['traefik.http.services.matrix-element-call.loadbalancer.server.port'] == '8080'

  195.           - matrix_element_call_labels_parsed['traefik.http.routers.matrix-element-call.rule'] == 'Host(`call.molecule.local`)'

  196.           - matrix_element_call_labels_parsed['traefik.http.routers.matrix-element-call.priority'] == '827'

  197.           - matrix_element_call_labels_parsed['traefik.http.routers.matrix-element-call.entrypoints'] == 'web'

  198.           - matrix_element_call_labels_parsed['traefik.http.routers.matrix-element-call.tls'] == 'false'

  199.           - matrix_element_call_labels_parsed['traefik.http.routers.matrix-element-call.middlewares'] == 'matrix-element-call-add-headers'

  200.           - matrix_element_call_labels_parsed['molecule.element-call.coverage'] == 'enabled'

  201.         fail_msg: "The parsed labels do not carry the scenario's routing contract"

  202.         success_msg: "The parsed labels carry the scenario's routing contract"

  203. 

  204.     - name: Assert the rendered labels carry the configured response headers

  205.       ansible.builtin.assert:

  206.         that:

  207.           - matrix_element_call_labels_parsed['traefik.http.middlewares.matrix-element-call-add-headers.headers.customresponseheaders.X-XSS-Protection'] == '0'

  208.           - matrix_element_call_labels_parsed['traefik.http.middlewares.matrix-element-call-add-headers.headers.customresponseheaders.X-Content-Type-Options'] == 'molecule-nosniff'

  209.           - matrix_element_call_labels_parsed['traefik.http.middlewares.matrix-element-call-add-headers.headers.customresponseheaders.Content-Security-Policy'] == 'frame-ancestors https://embed.call.molecule.local'

  210.           - matrix_element_call_labels_parsed['traefik.http.middlewares.matrix-element-call-add-headers.headers.customresponseheaders.Permission-Policy'] == 'camera=(self), microphone=(self)'

  211.           - "'traefik.http.middlewares.matrix-element-call-add-headers.headers.customresponseheaders.Strict-Transport-Security' not in matrix_element_call_labels_parsed"

  212.         fail_msg: "The parsed labels lost response headers or incorrectly enable HSTS without TLS"

  213.         success_msg: "The parsed labels carry the configured response-header contract"

  214. 

  215.     - name: Inspect the running Element Call container

  216.       ansible.builtin.command:

  217.         argv:

  218.           - docker

  219.           - container

  220.           - inspect

  221.           - matrix-element-call

  222.       register: matrix_element_call_container_inspect

  223.       changed_when: false

  224. 

  225.     - name: Assert the running container uses the exact image pinned by the role

  226.       ansible.builtin.assert:

  227.         that:

  228.           - matrix_element_call_runtime.Config.Image == matrix_element_call_expected_image

  229.         fail_msg: >-

  230.           The running container uses {{ matrix_element_call_runtime.Config.Image }}, expected

  231.           {{ matrix_element_call_expected_image }}

  232.         success_msg: "The running container uses the exact image pinned by the role"

  233.       vars:

  234.         matrix_element_call_expected_image: >-

  235.           {{ matrix_element_call_role_defaults.matrix_element_call_container_image_registry_prefix_upstream_default }}element-hq/element-call:{{ matrix_element_call_role_defaults.matrix_element_call_version }}

  236. 

  237.     - name: Assert the running container uses the playbook-supplied runtime

  238.       ansible.builtin.assert:

  239.         that:

  240.           - matrix_element_call_runtime.Config.User == (matrix_user_uid | string) ~ ':' ~ (matrix_user_gid | string)

  241.           - matrix_element_call_runtime.HostConfig.RestartPolicy.Name == 'no'

  242.           - matrix_element_call_runtime.HostConfig.AutoRemove is sameas true

  243.           - matrix_element_call_runtime.HostConfig.LogConfig.Type == 'none'

  244.         fail_msg: "The running container does not use the role's identity and Docker lifecycle contract"

  245.         success_msg: "The running container uses the role's identity and Docker lifecycle contract"

  246. 

  247.     - name: Assert the running container has the intended privilege isolation

  248.       ansible.builtin.assert:

  249.         that:

  250.           - matrix_element_call_runtime.HostConfig.Privileged is sameas false

  251.           - matrix_element_call_runtime.HostConfig.CapAdd | default([], true) | length == 0

  252.           - matrix_element_call_runtime.HostConfig.CapDrop == ['ALL']

  253.         fail_msg: "The running container does not have the intended privilege isolation"

  254.         success_msg: "The running container drops all capabilities and is unprivileged"

  255. 

  256.     - name: Assert the role's configuration is the sole read-only bind mount

  257.       ansible.builtin.assert:

  258.         that:

  259.           - matrix_element_call_runtime.Mounts | length == 1

  260.           - matrix_element_call_runtime.Mounts[0].Type == 'bind'

  261.           - matrix_element_call_runtime.Mounts[0].Source == matrix_element_call_base_path ~ '/config.json'

  262.           - matrix_element_call_runtime.Mounts[0].Destination == '/app/config.json'

  263.           - matrix_element_call_runtime.Mounts[0].RW is sameas false

  264.         fail_msg: "The role-rendered config.json is not the container's sole read-only bind mount"

  265.         success_msg: "The role-rendered config.json is mounted read-only at the image's live path"

  266. 

  267.     - name: Assert the rendered and extra labels reached the running container

  268.       ansible.builtin.assert:

  269.         that:

  270.           - matrix_element_call_runtime.Config.Labels['traefik.enable'] == 'true'

  271.           - matrix_element_call_runtime.Config.Labels['traefik.docker.network'] == matrix_element_call_container_network

  272.           - matrix_element_call_runtime.Config.Labels['traefik.http.services.matrix-element-call.loadbalancer.server.port'] == '8080'

  273.           - matrix_element_call_runtime.Config.Labels['traefik.http.routers.matrix-element-call.priority'] == '827'

  274.           - matrix_element_call_runtime.Config.Labels['molecule.element-call.coverage'] == 'enabled'

  275.           - matrix_element_call_runtime.Config.Labels['molecule.element-call.extra-argument'] == 'reached'

  276.         fail_msg: "The running container does not carry the labels the role rendered and passed"

  277.         success_msg: "The configured labels reached the running container"

  278. 

  279.     - name: Assert the running container is attached only to its dedicated network

  280.       ansible.builtin.assert:

  281.         that:

  282.           - matrix_element_call_runtime.HostConfig.NetworkMode == matrix_element_call_container_network

  283.           - matrix_element_call_runtime.NetworkSettings.Networks is mapping

  284.           - matrix_element_call_runtime.NetworkSettings.Networks | length == 1

  285.           - matrix_element_call_container_network in matrix_element_call_runtime.NetworkSettings.Networks

  286.         fail_msg: >-

  287.           Element Call has unexpected network attachments:

  288.           {{ matrix_element_call_runtime.NetworkSettings.Networks.keys() | list }}

  289.         success_msg: "The running container is attached only to its dedicated network"

  290. 

  291.     - name: Assert the observable extra runtime argument reached Docker

  292.       ansible.builtin.assert:

  293.         that:

  294.           - matrix_element_call_runtime.Config.Hostname == 'element-call-molecule-runtime'

  295.         fail_msg: "The configured container hostname extra argument did not reach Docker"

  296.         success_msg: "The configured container extra argument reached Docker"

  297. 

  298.     - name: Ask Docker for Element Call's published ports

  299.       ansible.builtin.command:

  300.         argv:

  301.           - docker

  302.           - container

  303.           - port

  304.           - matrix-element-call

  305.       register: matrix_element_call_published_ports

  306.       changed_when: false

  307.       failed_when: false

  308. 

  309.     - name: Assert the role publishes no host ports

  310.       ansible.builtin.assert:

  311.         that:

  312.           - matrix_element_call_runtime.HostConfig.PortBindings | default({}, true) | length == 0

  313.           - matrix_element_call_published_ports.rc == 0

  314.           - matrix_element_call_published_ports.stdout | trim | length == 0

  315.         fail_msg: >-

  316.           Element Call unexpectedly publishes a host port:

  317.           {{ matrix_element_call_published_ports.stdout | default('unknown') }}

  318.         success_msg: "The role leaves Element Call's HTTP port unpublished"