test (3340B)
1 #!/bin/bash 2 set -euo pipefail 3 export ANSIBLE_NOCOWS=1 4 5 repo_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd) 6 cd "$repo_dir" 7 8 test_image=ansible-taler-test 9 test_container=ansible-taler-test-$$ 10 test_state_dir=$(mktemp -d) 11 12 cleanup() { 13 if [[ ${TALER_TEST_KEEP_CONTAINER:-0} == 1 ]]; then 14 echo "Kept test container $test_container and test files $test_state_dir" 15 return 16 fi 17 podman rm --force "$test_container" >/dev/null 2>&1 || true 18 rm -rf -- "${test_state_dir:?}" 19 } 20 trap cleanup EXIT 21 22 ssh-keygen -q -t ed25519 -N "" -f "$test_state_dir/id_ed25519" 23 24 # Fast isolated regressions run before the complete deployment. 25 python3 contrib/tests/test_backup.py 26 python3 contrib/tests/test_upgrade_policy.py 27 python3 contrib/tests/test_monitoring_listeners.py 28 29 # Build our image 30 podman build -f Containerfile -t "$test_image" 31 32 # Run in background (-d) with systemd init. Taler's hardened systemd units 33 # require capabilities that Podman otherwise removes from the container. 34 podman run \ 35 --rm \ 36 --name "$test_container" \ 37 -p 127.0.0.1:8022:22 \ 38 --systemd=always \ 39 --privileged \ 40 -d "localhost/$test_image" sh -c "exec /usr/sbin/init --show-status" 41 42 # Use a disposable key because the deployment correctly disables SSH password 43 # authentication, and check mode runs in a separate SSH session afterwards. 44 podman exec "$test_container" install -d -m 0700 /root/.ssh 45 podman cp "$test_state_dir/id_ed25519.pub" "$test_container:/root/.ssh/authorized_keys" 46 podman exec "$test_container" chmod 0600 /root/.ssh/authorized_keys 47 48 # Print to log that container is running 49 podman ps 50 51 export ANSIBLE_CONFIG="$repo_dir/test-ansible.cfg" 52 export ANSIBLE_SSH_ARGS="-o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o UserKnownHostsFile=$test_state_dir/known_hosts" 53 54 for attempt in {1..30}; do 55 if ssh \ 56 -i "$test_state_dir/id_ed25519" \ 57 -p 8022 \ 58 -o StrictHostKeyChecking=no \ 59 -o "UserKnownHostsFile=$test_state_dir/known_hosts" \ 60 root@127.0.0.1 true; then 61 break 62 fi 63 if (( attempt == 30 )); then 64 echo "SSH did not become ready in the test container" >&2 65 exit 1 66 fi 67 sleep 1 68 done 69 70 ansible_args=( 71 -i inventories/default 72 -l podman-localhost 73 --user root 74 --private-key "$test_state_dir/id_ed25519" 75 playbooks/setup.yml 76 ) 77 78 # Provision, then prove that a separate check-mode run can inspect the result. 79 ansible-playbook --verbose --diff "${ansible_args[@]}" | tee "$test_state_dir/setup.log" 80 python3 contrib/tests/test_deployment.py \ 81 "$test_container" "$test_state_dir/id_ed25519" "$test_state_dir/setup.log" 82 python3 contrib/tests/test_monitoring.py \ 83 "$test_container" "$test_state_dir/id_ed25519" 84 85 # Basic smoke checks independent of Ansible's post-deployment checks. 86 podman exec "$test_container" systemctl is-active --quiet \ 87 taler-exchange.target \ 88 taler-exchange-httpd.service \ 89 libeufin-nexus-httpd.service \ 90 taler-auditor-httpd.service 91 podman exec "$test_container" curl --fail --silent --show-error \ 92 --unix-socket /var/run/taler-exchange/httpd/exchange-http.sock \ 93 http://localhost/config >/dev/null 94 podman exec "$test_container" curl --fail --silent --show-error \ 95 http://127.0.0.1:8082/taler-prepared-transfer/config >/dev/null 96 podman exec "$test_container" curl --fail --silent --show-error \ 97 --unix-socket /var/run/taler-auditor/httpd/auditor-http.sock \ 98 http://localhost/config >/dev/null