🧱 dev-stack: switch local TLS to mkcert nip.io domains

**Problem**

The local dev stack ships a committed self-signed CA and certificates
for `*.docker.dev-franceconnect.fr`, a TLD that only works because the
root CA is trusted manually on each machine. The stack also carries
Cypress fixtures and a workflow for the retired integ01 environment.

**Proposal**

Move the local stack onto `*.proconnect.127.0.0.1.nip.io`, which
resolves to 127.0.0.1 without hosts-file entries, and generate the TLS
certificates on the fly with mkcert: the root CA lives in the local
trust store, certs are gitignored, and `dks up` / a new `dks ssl`
command refresh them when they expire. Drop the integ01 and k8s
Cypress fixtures, their tag hooks, and the integration-tests workflow,
and install mkcert in the CI stack jobs.

Author: douglasduteil

.github/actions/install-mkcert/action.yml

@@ -0,0 +1,12 @@
+name: Install mkcert
+description: Download and install the mkcert binary
+
+runs:
+  using: composite
+  steps:
+    - name: Install mkcert
+      shell: bash
+      run: |
+        curl -JLO "https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-amd64"
+        chmod +x mkcert-v1.4.4-linux-amd64
+        sudo mv mkcert-v1.4.4-linux-amd64 /usr/local/bin/mkcert

.github/workflows/ci-admin-tests.yml

@@ -78,13 +78,16 @@ jobs:
       - name: Set ADMIN_ROOT environment variable
         run: echo "ADMIN_ROOT=$(pwd)" >> $GITHUB_ENV
 
+      - name: Install mkcert
+        uses: ./.github/actions/install-mkcert
+
       - name: Start docker stack
         working-directory: ./docker
         run: |
           ./docker-stack prune-ci
           ./docker-stack compose build core
           ./docker-stack up admin
-          ./docker-stack wait "admin" "https://exploitation-fca-low.docker.dev-franceconnect.fr/login" "240"
+          ./docker-stack wait "admin" "https://admin-local.proconnect.127.0.0.1.nip.io/login" "240"
 
       - name: Start tests
         run: yarn test:e2e -c video=false

.github/workflows/ci-tests.yml

@@ -117,6 +117,9 @@ jobs:
         working-directory: ./docker
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
+      - name: Install mkcert
+        uses: ./.github/actions/install-mkcert
+
       - name: Start docker stack
         working-directory: ./docker
         run: |
@@ -195,6 +198,9 @@ jobs:
         run: |
           echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
+      - name: Install mkcert
+        uses: ./.github/actions/install-mkcert
+
       - name: Start docker stack
         working-directory: ./docker
         run: |

.github/workflows/integration-tests.yml

@@ -71,7 +71,7 @@ git clone git@github.com:proconnect-gouv/federation.git
 dks switch small
 ```
 
-On https://fsa1-low.docker.dev-franceconnect.fr/, you can test the connexion with: `test@fia1.fr`
+On https://sp1-local.proconnect.127.0.0.1.nip.io/, you can test the connexion with: `test@fia1.fr`
 
 You are now connected to fsa1!
 
@@ -85,7 +85,7 @@ Start it with:
 dks switch medium
 ```
 
-Then go to https://exploitation-fca-low.docker.dev-franceconnect.fr/login.
+Then go to https://admin-local.proconnect.127.0.0.1.nip.io/login.
 
 Login with:
 
@@ -97,9 +97,9 @@ More credentials can be found here : `federation-admin/shared/fixtures/User.yml`
 
 ### Testing the installation
 
-You will then find a list of accessible URLs here: https://hello.docker.dev-franceconnect.fr.
+You will then find a list of accessible URLs here: https://proconnect.127.0.0.1.nip.io.
 
-Most URLs follow the same pattern <app-name>.docker.dev-franceconnect.fr
+Most URLs follow the pattern <role>-local.proconnect.127.0.0.1.nip.io
 
 On any URL, if you got a 502, it might still be booting, wait one minute, then reload.
 
@@ -246,14 +246,6 @@ cd $PC_ROOT/federation/admin
 yarn lint --fix
 ```
 
-## Run test against integ01 env
-
-```bash
-cd $PC_ROOT/federation/quality
-# Get the credentials from a team member
-CYPRESS_TEST_ENV=integ01 CYPRESS_EXPLOIT_USER_NAME=proconnect-test-local CYPRESS_EXPLOIT_USER_PASS='xxx' CYPRESS_EXPLOIT_USER_TOTP='xxx' yarn test:e2e:studio
-```
-
 ## Add a migration script
 
 We use [migrate-mongo](https://www.npmjs.com/package/migrate-mongo) to manage the database migrations.

README.md

@@ -7,7 +7,7 @@ const REPOSITORY_ROOT = path.resolve(import.meta.dirname, "..");
 export default defineConfig({
   chromeWebSecurity: false,
   e2e: {
-    baseUrl: "https://exploitation-fca-low.docker.dev-franceconnect.fr",
+    baseUrl: "https://admin-local.proconnect.127.0.0.1.nip.io",
     excludeSpecPattern: "cypress/integration/**/*.utils.js",
     experimentalRunAllSpecs: true,
     retries: 2,
@@ -20,13 +20,13 @@ export default defineConfig({
   },
   env: {
     APP_FORBIDDEN_PAGE:
-      "https://exploitation-fca-low.docker.dev-franceconnect.fr/service-provider",
+      "https://admin-local.proconnect.127.0.0.1.nip.io/service-provider",
     APP_HOME_ROLE_ADMIN:
-      "https://exploitation-fca-low.docker.dev-franceconnect.fr/account",
+      "https://admin-local.proconnect.127.0.0.1.nip.io/account",
     APP_HOME_ROLE_OPERATOR:
-      "https://exploitation-fca-low.docker.dev-franceconnect.fr/service-provider",
+      "https://admin-local.proconnect.127.0.0.1.nip.io/service-provider",
     APP_HOME_ROLE_SECURITY:
-      "https://exploitation-fca-low.docker.dev-franceconnect.fr/service-provider",
+      "https://admin-local.proconnect.127.0.0.1.nip.io/service-provider",
     APP_NAME: "admin",
     FEDERATION_DIR: REPOSITORY_ROOT,
     LOG_FILE_PATH: `${REPOSITORY_ROOT}/docker/volumes/log/fcexploitation.log`,

admin/cypress.config.js

@@ -8,7 +8,7 @@ import {
 
 describe("Account", () => {
   before(() => cy.resetEnv("postgres"));
-  it("should redirect the not connected user to https://fc-exploitation.docker.dev-franceconnect.fr/login", () => {
+  it("should redirect the not connected user to https://admin-local.proconnect.127.0.0.1.nip.io/login", () => {
     cy.visit(`/account`);
     cy.url().should("contain", `/login`);
   });

admin/cypress/integration/account/account-roles.spec.js

@@ -38,7 +38,7 @@ describe("update a service-provider", () => {
       // Assert
       cy.url().should(
         "eq",
-        "https://exploitation-fca-low.docker.dev-franceconnect.fr/service-provider",
+        "https://admin-local.proconnect.127.0.0.1.nip.io/service-provider",
       );
       cy.contains(
         `Le fournisseur de service ${fs.name} a été créé avec succès !`,

admin/cypress/integration/service-provider/service-provider-generate-new-client-secret.spec.js

@@ -22,9 +22,12 @@ const fs2 = { ...fs, name: "CypressFS2" };
 const fs3 = { ...fs, name: "CypressFS3" };
 
 describe("Service provider list", () => {
+  let creationDate;
+
   before(() => {
     cy.resetEnv("mongo");
     cy.login(USER_OPERATOR, USER_PASS);
+    creationDate = getTodayDate();
     createServiceProvider(fs, basicConfiguration);
     createServiceProvider(fs2, basicConfiguration);
     createServiceProvider(fs3, basicConfiguration);
@@ -44,9 +47,8 @@ describe("Service provider list", () => {
       cy.get(".time-client-id")
         .last()
         .then((item) => {
-          const todayDate = getTodayDate();
           const test = item[0].textContent;
-          expect(todayDate).to.equal(test);
+          expect(creationDate).to.equal(test);
         });
     });
 
@@ -59,9 +61,8 @@ describe("Service provider list", () => {
       cy.get(".time-secret")
         .last()
         .then((item) => {
-          const todayDate = getTodayDate();
           const test = item[0].textContent;
-          expect(todayDate).to.equal(test);
+          expect(creationDate).to.equal(test);
         });
     });
 

admin/cypress/integration/service-provider/service-provider-list.spec.js

@@ -3,8 +3,7 @@ import { Platform } from "../utils/instance.enum";
 
 export default {
   appName: process.env.APP_NAME || "Admin ProConnect",
-  appFqdn:
-    process.env.APP_FQDN || "fc-exploitation.docker.dev-franceconnect.fr",
+  appFqdn: process.env.APP_FQDN || "admin-local.proconnect.127.0.0.1.nip.io",
   environment: process.env.ENV_NAME || "development",
   app_root: process.env.APP_ROOT || "",
   commitUrlPrefix: