recipe-maintainer: public snapshot (secrets + deployment plans removed, single commit)

Sanitized single-commit public mirror of recipe-maintainer. - Removed test-ssh/.testenv (live creds); added test-ssh/.testenv.example placeholders. - Removed plans/ and planned-updates/ (deployment-planning docs) so no client/ deployment domains appear in the public repo. - All other secret stores were already gitignored. - docs.coopcloud.tech retained as a submodule (public upstream).
2026-06-16 20:18:24 +00:00
commit f283a371bb
253 changed files with 15975 additions and 0 deletions
@@ -0,0 +1,140 @@
+# Authentik Migration Test
+
+Test that upgrading from 10.1.4+2025.10.2 (using `media:/media` mount) to 10.2.0+2026.2.1 (using `media:/data/media` mount) works correctly and preserves data.
+
+## Overview
+
+1. Deploy the old version
+2. Seed test data into the media volume
+3. Upgrade to the new version
+4. Verify media files are accessible at the new path
+
+## Steps
+
+### 1. Deploy old version
+
+Check out the pre-migration tag and deploy:
+
+```bash
+cd ~/.abra/recipes/authentik
+git checkout 10.1.4+2025.10.2
+```
+
+Deploy:
+
+```bash
+abra app deploy authentik.<DOMAIN_SUFFIX> --chaos --force --no-input
+```
+
+Wait for the app to become healthy:
+
+```bash
+abra app ps authentik.<DOMAIN_SUFFIX> --chaos --no-input -m
+```
+
+### 2. Seed test data into the media volume
+
+Create a marker file in the old `/media` volume:
+
+```bash
+script -qefc "abra app run authentik.<DOMAIN_SUFFIX> app -- sh -c 'echo migration-test-marker > /media/test-migration-marker.txt && echo created'" /dev/null
+```
+
+Verify the file was created:
+
+```bash
+script -qefc "abra app run authentik.<DOMAIN_SUFFIX> app -- cat /media/test-migration-marker.txt" /dev/null
+```
+
+Expected output: `migration-test-marker`
+
+Record existing files in `/media` for comparison:
+
+```bash
+script -qefc "abra app run authentik.<DOMAIN_SUFFIX> app -- ls -la /media/" /dev/null
+```
+
+### 3. Upgrade to new version
+
+Switch to the new version (with `media:/data/media` mount point change):
+
+```bash
+cd ~/.abra/recipes/authentik
+git checkout <new-tag-or-branch>
+```
+
+Deploy the upgrade:
+
+```bash
+abra app deploy authentik.<DOMAIN_SUFFIX> --chaos --force --no-input
+```
+
+Wait for convergence (authentik runs database migrations on startup):
+
+```bash
+sleep 60
+abra app ps authentik.<DOMAIN_SUFFIX> --chaos --no-input -m
+```
+
+### 4. Verify post-upgrade state
+
+#### 4a. Health check
+
+```bash
+python3 recipe-info/authentik/tests/health_check.py
+```
+
+#### 4b. Marker file preserved at new path
+
+The mount point change means `media:/data/media` — files that were at the volume root now appear under `/data/media/`:
+
+```bash
+script -qefc "abra app run authentik.<DOMAIN_SUFFIX> app -- cat /data/media/test-migration-marker.txt" /dev/null
+```
+
+Expected output: `migration-test-marker`
+
+#### 4c. Directory listing
+
+Verify the old files are now under `/data/media/`:
+
+```bash
+script -qefc "abra app run authentik.<DOMAIN_SUFFIX> app -- ls -la /data/media/" /dev/null
+```
+
+Compare with the listing from step 2 — all files from the old `/media/` should now appear under `/data/media/`.
+
+#### 4d. Version label
+
+```bash
+abra app ps authentik.<DOMAIN_SUFFIX> --chaos --no-input -m
+```
+
+Confirm the version label shows `10.2.0+2026.2.1`.
+
+#### 4e. Full test suite
+
+```bash
+python3 recipe-info/authentik/tests/health_check.py
+python3 recipe-info/authentik/tests/oidc_integration.py
+```
+
+### 5. Clean up test marker
+
+```bash
+script -qefc "abra app run authentik.<DOMAIN_SUFFIX> app -- rm /data/media/test-migration-marker.txt" /dev/null
+```
+
+## Pass/fail criteria
+
+| Check | Expected |
+|-------|----------|
+| Pre-upgrade health check | HTTP 200 |
+| Marker file created in old `/media` | `migration-test-marker` |
+| Post-upgrade health check | HTTP 200 |
+| Marker file at `/data/media/test-migration-marker.txt` | `migration-test-marker` |
+| `/data/media/` contains old files | Matches pre-upgrade listing |
+| Version label updated | `10.2.0+2026.2.1` |
+| OIDC integration test | PASS |
+
+All checks must pass for the migration test to pass.