matrix-docker-ansible-deploy/roles/custom/matrix-ketesa/molecule/default/molecule.yml

# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
#
# SPDX-License-Identifier: AGPL-3.0-or-later

---
dependency:
  name: galaxy
  options:
    requirements-file: requirements.yml
    force: true
driver:
  name: docker
platforms:
  - name: matrix-ketesa-${MOLECULE_DISTRO:-ubuntu2604}-default
    image: "geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2604}-ansible:latest"
    command: ${MOLECULE_DOCKER_COMMAND:-""}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    cgroupns_mode: host
    privileged: true
    pre_build_image: true
provisioner:
  name: ansible
  config_options:
    defaults:
      callback_result_format: yaml
  inventory:
    group_vars:
      all:
        # Ketesa is a Synapse administration client. The complete playbook supplies this
        # selection before the role runs; a role-scoped scenario must do so directly.
        matrix_homeserver_implementation: synapse

        # verify.yml is a separate play where the role's defaults are out of scope, so
        # paths which it reads are pinned to the values the role derives during converge.
        matrix_ketesa_base_path: /matrix/ketesa
        matrix_ketesa_config_path: /matrix/ketesa/config

        # Use a scenario-specific network and a container identity unlike both the matrix
        # user and the image defaults, so the runtime assertions cannot pass by coincidence.
        matrix_ketesa_container_network: matrix-ketesa-molecule
        matrix_ketesa_container_uid: 28080
        matrix_ketesa_container_gid: 28081
        matrix_ketesa_container_http_host_bind_port: ''

        # These values differ from both Ketesa and role defaults. No Synapse is expected at
        # this URL: the static client only publishes it to the browser in config.json.
        matrix_ketesa_config_restrictBaseUrl: https://admin-api.molecule.local  # noqa var-naming
        matrix_ketesa_config_externalAuthProvider: true  # noqa var-naming
        matrix_ketesa_config_wellKnownDiscovery: false  # noqa var-naming
        matrix_ketesa_config_corsCredentials: include  # noqa var-naming
        matrix_ketesa_config_asManagedUsers_custom:  # noqa var-naming
          # Molecule applies shell-style interpolation to this file, so `$$` becomes the
          # single end-of-string anchor which reaches Ansible and the rendered JSON.
          - '^@molecule_bridge_[a-z0-9]+:molecule\.local$$'
        matrix_ketesa_config_menu:
          - label: Molecule support
            i18n:
              de: Molekül-Support
              fr: Assistance Molécule
            icon: SupportAgent
            url: https://support.molecule.local/ketesa

        # Traefik itself is not needed. The deliberately non-default exposure values make
        # the label file a precise record of the public wiring the role would deploy.
        matrix_ketesa_hostname: ketesa-admin.molecule.local
        matrix_ketesa_path_prefix: /molecule-ketesa
        matrix_ketesa_container_labels_traefik_enabled: true
        matrix_ketesa_container_labels_traefik_docker_network: matrix-ketesa-molecule
        matrix_ketesa_container_labels_traefik_priority: 731
        matrix_ketesa_container_labels_traefik_entrypoints: web
        matrix_ketesa_container_labels_traefik_tls: false
        matrix_ketesa_container_labels_traefik_ipallowlist_sourcerange:
          - 192.0.2.0/24
          - 2001:db8::/32
        matrix_ketesa_container_labels_traefik_additional_response_headers_custom:
          X-Molecule-Ketesa: role-scenario
        matrix_ketesa_container_labels_additional_labels: |
          molecule.ketesa.coverage=enabled
  env:
    # Workaround for https://github.com/ansible/molecule/issues/4391
    ANSIBLE_ROLES_PATH: ${MOLECULE_PROJECT_DIRECTORY}/../..:/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:${ANSIBLE_HOME:-~/.ansible}/roles
scenario:
  test_sequence:
    - dependency
    - cleanup
    - destroy
    - syntax
    - create
    - prepare
    - converge
    - idempotence
    - verify
    - cleanup
    - destroy
verifier:
  name: ansible