Application Tests - Traefik #125
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Application Tests - Traefik | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| branch: | |
| description: 'Branch to run the workflow on' | |
| required: true | |
| default: 'main' | |
| run_id: | |
| description: 'Run ID of the producing workflow' | |
| required: true | |
| default: '0' | |
| sha: | |
| description: 'SHA of the commit to run the workflow on' | |
| required: true | |
| default: '' | |
| called_by_workflow: | |
| description: 'Name of the producing workflow' | |
| required: true | |
| default: 'manual-trigger' | |
| full_ref: | |
| description: 'Full git ref of the commit to run the workflow on' | |
| required: false | |
| default: '' | |
| jobs: | |
| # --------------------------------------------------------- | |
| # Quick guard to validate incoming payload | |
| # --------------------------------------------------------- | |
| guard: | |
| runs-on: ubuntu-latest | |
| if: ${{ inputs.sha != '' && inputs.run_id != '' && inputs.branch != '' && github.repository == 'grindsa/acme2certifier' }} | |
| steps: | |
| - run: | | |
| echo "Triggered by SHA: $SHA" | |
| echo "From branch: $BRANCH" | |
| echo "Producer run_id: $RUN_ID" | |
| env: | |
| SHA: ${{ inputs.sha }} | |
| BRANCH: ${{ inputs.branch }} | |
| RUN_ID: ${{ inputs.run_id }} | |
| # --------------------------------------------------------- | |
| # Test container images (matrix from payload) | |
| # --------------------------------------------------------- | |
| test-containers: | |
| needs: guard | |
| runs-on: ubuntu-latest | |
| if: github.repository == 'grindsa/acme2certifier' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| websrv: ['apache2', 'nginx'] | |
| dbhandler: ['wsgi', 'django'] | |
| challenge_type: [tlschallenge=true, httpchallenge.entrypoint=web] | |
| steps: | |
| - name: "checkout GIT" | |
| uses: actions/checkout@v6 | |
| - name: "get runner information" | |
| run: | | |
| echo RUNNER_IP=$(ip addr show eth0 | grep -i "inet " | cut -d ' ' -f 6 | cut -d '/' -f 1) >> $GITHUB_ENV | |
| echo RUNNER_HOSTNAME=$(hostname -f) >> $GITHUB_ENV | |
| - run: echo "runner IP is $RUNNER_IP" | |
| env: | |
| RUNNER_IP: ${{ env.RUNNER_IP }} | |
| - run: echo "runner hostname is ${{ env.RUNNER_HOSTNAME }}" | |
| env: | |
| RUNNER_HOSTNAME: ${{ env.RUNNER_HOSTNAME }} | |
| - name: "Download and import container" | |
| uses: ./.github/actions/container_load | |
| with: | |
| RUN_ID: ${{ inputs.run_id }} | |
| ARTIFACT_NAME: a2c-${{ inputs.run_id }}.${{ matrix.websrv }}.${{ matrix.dbhandler }}.tar | |
| DESTINATION_PATH: /tmp | |
| TOKEN: ${{ secrets.GH_WF_TOKEN }} | |
| REPO: ${{ github.repository }} | |
| - name: "Prepare container environment" | |
| uses: ./.github/actions/container_prep | |
| with: | |
| DB_HANDLER: ${{ matrix.dbhandler }} | |
| WEB_SRV: ${{ matrix.websrv }} | |
| CONTAINER_BUILD: false | |
| NAME_SPACE: acme | |
| - name: "Setup openssl ca_handler" | |
| run: | | |
| sudo mkdir -p examples/Docker/data/acme_ca/certs | |
| sudo cp test/ca/sub-ca-key.pem test/ca/sub-ca-crl.pem test/ca/sub-ca-cert.pem test/ca/root-ca-cert.pem examples/Docker/data/acme_ca/ | |
| sudo cp .github/openssl_ca_handler.py_acme_srv_choosen_handler.cfg examples/Docker/data/acme_srv.cfg | |
| - name: "Bring up a2c container" | |
| uses: ./.github/actions/container_up | |
| with: | |
| DB_HANDLER: ${{ matrix.dbhandler }} | |
| WEB_SRV: ${{ matrix.websrv }} | |
| - name: "Sleep for 10s" | |
| uses: juliangruber/sleep-action@v2.0.4 | |
| with: | |
| time: 10s | |
| - name: "Test http://acme-srv/directory is accessible" | |
| run: docker run -i --rm --network acme curlimages/curl -f http://acme-srv/directory | |
| - name: "Test if https://acme-srv/directory is accessible" | |
| run: docker run -i --rm --network acme curlimages/curl --insecure -f https://acme-srv/directory | |
| - name: "Setup and instanciate traefik" | |
| run: | | |
| mkdir -p traefik/certs/ | |
| sudo cp .github/acme2certifier_cabundle.pem traefik/certs/ | |
| sudo cp .github/traefik-matrix.yml traefik/docker-compose.yml | |
| sudo sed -i "s/whoami.acme/${{ env.RUNNER_HOSTNAME }}/g" traefik/docker-compose.yml | |
| sudo sed -i "s/CHALLENGE_TYPE/${{ matrix.challenge_type }}/g" traefik/docker-compose.yml | |
| cd traefik | |
| docker compose up -d | |
| - name: "Sleep for 30s" | |
| uses: juliangruber/sleep-action@v2.0.4 | |
| with: | |
| time: 30s | |
| - name: "Check for certificate" | |
| working-directory: traefik | |
| run: | | |
| sudo cat letsencrypt/acme.json | jq -r '.a2c | .Certificates | . [] | .certificate ' | base64 -d | awk 'BEGIN {c=0;} /BEGIN CERT/{c++} { print > "cert-" c ".pem"}' | |
| openssl verify -CAfile cert-3.pem -untrusted cert-2.pem cert-1.pem | |
| - name: "[ * ] Collecting test logs" | |
| if: ${{ failure() }} | |
| run: | | |
| mkdir -p ${{ github.workspace }}/artifact/upload | |
| docker logs traefik > traefik/traefik.log | |
| sudo cp -rp examples/Docker/data/ ${{ github.workspace }}/artifact/data/ | |
| sudo cp -rp traefik/ ${{ github.workspace }}/artifact/traefik/ | |
| cd examples/Docker | |
| docker compose logs > ${{ github.workspace }}/artifact/docker-compose.log | |
| sudo tar -C ${{ github.workspace }}/artifact/ -cvzf ${{ github.workspace }}/artifact/upload/artifact.tar.gz docker-compose.log data traefik | |
| - name: "[ * ] Uploading artifacts" | |
| uses: actions/upload-artifact@v7 | |
| if: ${{ failure() }} | |
| with: | |
| name: test-containers-${{ matrix.challenge_type }}-${{ matrix.websrv }}-${{ matrix.dbhandler }}.tar.gz | |
| path: ${{ github.workspace }}/artifact/upload/ | |
| # --------------------------------------------------------- | |
| # Test RPMs (EL8 & EL9) downloaded from the producer run | |
| # --------------------------------------------------------- | |
| test-rpm: | |
| needs: guard | |
| runs-on: ubuntu-latest | |
| if: github.repository == 'grindsa/acme2certifier' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| rhversion: [8, 9] | |
| execscript: ['rpm_tester.sh', 'django_tester.sh'] | |
| challenge_type: [tlschallenge=true, httpchallenge.entrypoint=web] | |
| steps: | |
| - name: "checkout GIT" | |
| uses: actions/checkout@v6 | |
| - name: "Parse JSON secret" | |
| uses: ./.github/actions/parse-json-secret | |
| with: | |
| json_secret: ${{ secrets.GH_CFG }} | |
| - name: "get runner information" | |
| run: | | |
| echo RUNNER_IP=$(ip addr show eth0 | grep -i "inet " | cut -d ' ' -f 6 | cut -d '/' -f 1) >> $GITHUB_ENV | |
| echo RUNNER_HOSTNAME=$(hostname -f) >> $GITHUB_ENV | |
| - run: echo "runner IP is $RUNNER_IP" | |
| env: | |
| RUNNER_IP: ${{ env.RUNNER_IP }} | |
| - run: echo "runner hostname is ${{ env.RUNNER_HOSTNAME }}" | |
| env: | |
| RUNNER_HOSTNAME: ${{ env.RUNNER_HOSTNAME }} | |
| - name: "Prepare Alma environment" | |
| uses: ./.github/actions/rpm_prep | |
| with: | |
| GH_USER: ${{ env.GH_USER }} | |
| GH_SBOM_REPO_TOKEN: ${{ env.GH_SBOM_REPO_TOKEN }} | |
| RH_VERSION: ${{ matrix.rhversion }} | |
| RPM_BUILD: false | |
| - name: "Download RPM artifact by name from build run" | |
| uses: ./.github/actions/download_artifact | |
| with: | |
| RUN_ID: ${{ inputs.run_id }} | |
| ARTIFACT_NAME: acme2certifier-${{ inputs.run_id }}.noarch.rpm | |
| DESTINATION_PATH: data/ | |
| TOKEN: ${{ secrets.GH_WF_TOKEN }} | |
| REPO: ${{ github.repository }} | |
| - name: "Setup openssl ca_handler" | |
| run: | | |
| sudo mkdir -p data/volume/acme_ca/certs | |
| sudo cp test/ca/sub-ca-key.pem test/ca/sub-ca-crl.pem test/ca/sub-ca-cert.pem test/ca/root-ca-cert.pem data/volume/acme_ca/ | |
| sudo cp .github/openssl_ca_handler.py_acme_srv_choosen_handler.cfg data/volume/acme_srv.cfg | |
| - name: "Execute install script" | |
| run: | | |
| docker exec acme-srv sh /tmp/acme2certifier/$EXEC_SCRIPT | |
| env: | |
| EXEC_SCRIPT: ${{ matrix.execscript }} | |
| - name: "Sleep for 10s" | |
| uses: juliangruber/sleep-action@v2.0.4 | |
| with: | |
| time: 10s | |
| - name: "Test http://acme-srv/directory is accessible" | |
| run: docker run -i --rm --network acme curlimages/curl -f http://acme-srv/directory | |
| - name: "Test if https://acme-srv/directory is accessible" | |
| run: docker run -i --rm --network acme curlimages/curl --insecure -f https://acme-srv/directory | |
| - name: "Setup and instanciate traefik" | |
| run: | | |
| curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --batch --yes --no-tty --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg | |
| echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null | |
| sudo apt update | |
| sudo apt install -y docker-compose-plugin | |
| mkdir -p traefik/certs/ | |
| sudo cp .github/acme2certifier_cabundle.pem traefik/certs/ | |
| sudo cp .github/traefik-matrix.yml traefik/docker-compose.yml | |
| sudo sed -i "s/whoami.acme/${{ env.RUNNER_HOSTNAME }}/g" traefik/docker-compose.yml | |
| sudo sed -i "s/CHALLENGE_TYPE/${{ matrix.challenge_type }}/g" traefik/docker-compose.yml | |
| cd traefik | |
| docker compose up -d | |
| - name: "Sleep for 30s" | |
| uses: juliangruber/sleep-action@v2.0.4 | |
| with: | |
| time: 30s | |
| - name: "Check for certificate" | |
| working-directory: traefik | |
| run: | | |
| sudo cat letsencrypt/acme.json | jq -r '.a2c | .Certificates | . [] | .certificate ' | base64 -d | awk 'BEGIN {c=0;} /BEGIN CERT/{c++} { print > "cert-" c ".pem"}' | |
| openssl verify -CAfile cert-3.pem -untrusted cert-2.pem cert-1.pem | |
| - name: "[ * ] Collecting test logs" | |
| if: ${{ failure() }} | |
| continue-on-error: true | |
| run: | | |
| mkdir -p ${{ github.workspace }}/artifact/upload | |
| mkdir -p ${{ github.workspace }}/artifact/clients | |
| docker exec acme-srv tar cvfz /tmp/acme2certifier/a2c.tgz /opt/acme2certifier | |
| sudo cp -rp data/ ${{ github.workspace }}/artifact/data/ | |
| # sudo cp *.pem ${{ github.workspace }}/artifact/data/ | |
| sudo cp -rp acme-sh/ ${{ github.workspace }}/artifact/clients/acme-sh/ | |
| sudo cp -rp certbot/ ${{ github.workspace }}/artifact/clients/certbot/ | |
| sudo cp -rp lego/ ${{ github.workspace }}/artifact/clients/lego/ | |
| sudo rm ${{ github.workspace }}/artifact/data/*.rpm | |
| docker exec acme-srv cat /etc/nginx/nginx.conf.orig > ${{ github.workspace }}/artifact/data/nginx.conf.orig | |
| docker exec acme-srv cat /etc/nginx/nginx.conf > ${{ github.workspace }}/artifact/data/nginx.conf | |
| docker exec acme-srv cat /var/log/messages > ${{ github.workspace }}/artifact/acme-srv.log | |
| sudo tar -C ${{ github.workspace }}/artifact/ -cvzf ${{ github.workspace }}/artifact/upload/artifact.tar.gz data clients acme-srv.log | |
| - name: "[ * ] Uploading artifacts" | |
| uses: actions/upload-artifact@v7 | |
| if: ${{ failure() }} | |
| with: | |
| name: test-rpms-rh${{ matrix.rhversion }}-${{ matrix.execscript}}.tar.gz | |
| path: ${{ github.workspace }}/artifact/upload/ | |
| # --------------------------------------------------------- | |
| # Test DEB downloaded from the producer run | |
| # --------------------------------------------------------- | |
| test-deb: | |
| needs: guard | |
| runs-on: ubuntu-latest | |
| if: github.repository == 'grindsa/acme2certifier' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| websrv: ['apache2', 'nginx'] | |
| execscript: ['deb_tester.sh','django_tester.sh'] | |
| challenge_type: [tlschallenge=true, httpchallenge.entrypoint=web] | |
| steps: | |
| - name: "checkout GIT" | |
| uses: actions/checkout@v6 | |
| - name: "get runner information" | |
| run: | | |
| echo RUNNER_IP=$(ip addr show eth0 | grep -i "inet " | cut -d ' ' -f 6 | cut -d '/' -f 1) >> $GITHUB_ENV | |
| echo RUNNER_HOSTNAME=$(hostname -f) >> $GITHUB_ENV | |
| - run: echo "runner IP is $RUNNER_IP" | |
| env: | |
| RUNNER_IP: ${{ env.RUNNER_IP }} | |
| - run: echo "runner hostname is ${{ env.RUNNER_HOSTNAME }}" | |
| env: | |
| RUNNER_HOSTNAME: ${{ env.RUNNER_HOSTNAME }} | |
| - name: "Prepare Ubuntu environment" | |
| if: matrix.execscript == 'deb_tester.sh' | |
| uses: ./.github/actions/deb_prep | |
| with: | |
| DEB_BUILD: false | |
| - name: "Prepare Ubuntu environment" | |
| if: matrix.execscript == 'django_tester.sh' | |
| uses: ./.github/actions/deb_prep | |
| with: | |
| DEB_BUILD: false | |
| DJANGO_DB: psql | |
| - name: "Download DEB artifact by name from build run" | |
| uses: ./.github/actions/download_artifact | |
| with: | |
| RUN_ID: ${{ inputs.run_id }} | |
| ARTIFACT_NAME: acme2certifier-${{ inputs.run_id }}-1_all.deb | |
| DESTINATION_PATH: data/ | |
| TOKEN: ${{ secrets.GH_WF_TOKEN }} | |
| REPO: ${{ github.repository }} | |
| - name: "Setup openssl ca_handler" | |
| run: | | |
| sudo mkdir -p data/volume/acme_ca/certs | |
| sudo cp test/ca/sub-ca-key.pem test/ca/sub-ca-crl.pem test/ca/sub-ca-cert.pem test/ca/root-ca-cert.pem data/volume/acme_ca/ | |
| sudo cp .github/openssl_ca_handler.py_acme_srv_choosen_handler.cfg data/volume/acme_srv.cfg | |
| sudo sed -i "s/examples\/ca_handler/\/var\/www\/acme2certifier\/examples\/ca_handler/g" data/volume/acme_srv.cfg | |
| sudo sed -i "s/volume/\/var\/www\/acme2certifier\/volume/g" data/volume/acme_srv.cfg | |
| - name: "Execute install script" | |
| run: | | |
| docker exec acme-srv bash /tmp/acme2certifier/$EXECSCRIPT install $WEBSRV | |
| env: | |
| WEBSRV: ${{ matrix.websrv }} | |
| EXECSCRIPT: ${{ matrix.execscript }} | |
| - name: "Sleep for 10s" | |
| uses: juliangruber/sleep-action@v2.0.4 | |
| with: | |
| time: 10s | |
| - name: "Test http://acme-srv/directory is accessible" | |
| run: docker run -i --rm --network acme curlimages/curl -f http://acme-srv/directory | |
| - name: "Test if https://acme-srv/directory is accessible" | |
| run: docker run -i --rm --network acme curlimages/curl --insecure -f https://acme-srv/directory | |
| - name: "Setup and instanciate traefik" | |
| run: | | |
| curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --batch --yes --no-tty --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg | |
| echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null | |
| sudo apt update | |
| sudo apt install -y docker-compose-plugin | |
| mkdir -p traefik/certs/ | |
| sudo cp .github/acme2certifier_cabundle.pem traefik/certs/ | |
| sudo cp .github/traefik-matrix.yml traefik/docker-compose.yml | |
| sudo sed -i "s/whoami.acme/${{ env.RUNNER_HOSTNAME }}/g" traefik/docker-compose.yml | |
| sudo sed -i "s/CHALLENGE_TYPE/${{ matrix.challenge_type }}/g" traefik/docker-compose.yml | |
| cd traefik | |
| docker compose up -d | |
| - name: "Sleep for 30s" | |
| uses: juliangruber/sleep-action@v2.0.4 | |
| with: | |
| time: 30s | |
| - name: "Check for certificate" | |
| working-directory: traefik | |
| run: | | |
| sudo cat letsencrypt/acme.json | jq -r '.a2c | .Certificates | . [] | .certificate ' | base64 -d | awk 'BEGIN {c=0;} /BEGIN CERT/{c++} { print > "cert-" c ".pem"}' | |
| openssl verify -CAfile cert-3.pem -untrusted cert-2.pem cert-1.pem | |
| - name: "[ * ] Collecting test logs" | |
| if: ${{ failure() }} | |
| run: | | |
| mkdir -p ${{ github.workspace }}/artifact/upload | |
| docker exec acme-srv tar cvfz /tmp/acme2certifier/a2c.tgz /var/www/acme2certifier | |
| sudo cp -rp data/ ${{ github.workspace }}/artifact/data/ | |
| sudo rm ${{ github.workspace }}/artifact/data/*.deb | |
| if [ ${{ matrix.websrv }} == "apache2" ]; then | |
| docker exec acme-srv cat /var/log/apache2/error.log > ${{ github.workspace }}/artifact/acme-srv.log | |
| else | |
| docker exec acme-srv cat /var/log/nginx/error.log > ${{ github.workspace }}/artifact/acme-srv.log | |
| fi | |
| docker exec acme-srv cat /var/log/syslog > ${{ github.workspace }}/artifact/syslog | |
| sudo tar -C ${{ github.workspace }}/artifact/ -cvzf ${{ github.workspace }}/artifact/upload/artifact.tar.gz data acme-srv.log syslog | |
| - name: "[ * ] Uploading artifacts" | |
| uses: actions/upload-artifact@v7 | |
| if: ${{ failure() }} | |
| with: | |
| name: test-deb-${{ matrix.websrv }}-${{ matrix.execscript }}.tar.gz | |
| path: ${{ github.workspace }}/artifact/upload/ |