recipe-maintainer: public snapshot (secrets + deployment plans removed, single commit)
Sanitized single-commit public mirror of recipe-maintainer. - Removed test-ssh/.testenv (live creds); added test-ssh/.testenv.example placeholders. - Removed plans/ and planned-updates/ (deployment-planning docs) so no client/ deployment domains appear in the public repo. - All other secret stores were already gitignored. - docs.coopcloud.tech retained as a submodule (public upstream).
This commit is contained in:
+84
@@ -0,0 +1,84 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Create a test admin account on Bluesky PDS."""
|
||||
import argparse
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
|
||||
sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', '..'))
|
||||
from utils.tests.helpers import run, resolve_domain
|
||||
|
||||
|
||||
def run_in_container(domain, cmd):
|
||||
"""Run a command inside the app container via abra."""
|
||||
result = run(
|
||||
f'''script -qefc "abra app run {domain} app --no-tty -- sh -c '{cmd}' 2>&1" /dev/null''',
|
||||
check=False, timeout=120,
|
||||
)
|
||||
return result.stdout
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--domain', default=os.environ.get('TEST_DOMAIN'))
|
||||
args = parser.parse_args()
|
||||
domain = args.domain or resolve_domain('bluesky-pds')
|
||||
|
||||
test_handle = f"testadmin.{domain}"
|
||||
test_email = f"testadmin@{domain}"
|
||||
# Generate a random password
|
||||
import secrets
|
||||
test_password = f"manual-test-{secrets.token_hex(8)}"
|
||||
pds_host = "http://localhost:3000"
|
||||
admin_pw_flag = "--admin-password \\$(cat /run/secrets/pds_admin_password)"
|
||||
pds_flag = f"--pds-host {pds_host}"
|
||||
creds_file = os.path.join(os.path.dirname(__file__), '..', f'test-account-{domain}.json')
|
||||
|
||||
# Check if the account already exists
|
||||
print("Checking for existing test account ...")
|
||||
account_list = run_in_container(domain, f"goat pds admin account list {admin_pw_flag} {pds_flag} 2>&1")
|
||||
|
||||
for did in re.findall(r'did:plc:\w+', account_list):
|
||||
info = run_in_container(domain, f"goat pds admin account info {did} {admin_pw_flag} {pds_flag} 2>&1")
|
||||
if f'"handle": "{test_handle}"' in info:
|
||||
print(f"Test account already exists ({did}, handle: {test_handle}).")
|
||||
print("To recreate, delete it first:")
|
||||
print(f" abra app run {domain} app -- goat pds admin account delete {did} --admin-password \\$(cat /run/secrets/pds_admin_password) --pds-host {pds_host}")
|
||||
return
|
||||
|
||||
# Create the account
|
||||
print(f"Creating test account ({test_handle}) ...")
|
||||
create_output = run_in_container(
|
||||
domain,
|
||||
f"goat pds admin account create {admin_pw_flag} {pds_flag} --handle {test_handle} --email {test_email} --password '{test_password}' 2>&1",
|
||||
)
|
||||
|
||||
test_did_match = re.search(r'did:plc:\w+', create_output)
|
||||
if not test_did_match:
|
||||
print("FAIL: Could not create test account")
|
||||
print(f"Output: {create_output}")
|
||||
sys.exit(1)
|
||||
test_did = test_did_match.group()
|
||||
|
||||
# Save credentials
|
||||
creds = {
|
||||
"handle": test_handle,
|
||||
"email": test_email,
|
||||
"password": test_password,
|
||||
"did": test_did,
|
||||
"pds": f"https://{domain}",
|
||||
}
|
||||
with open(creds_file, 'w') as f:
|
||||
json.dump(creds, f, indent=2)
|
||||
f.write('\n')
|
||||
|
||||
print(f"Account created and credentials saved to {creds_file}")
|
||||
print(f" Handle: {test_handle}")
|
||||
print(f" Email: {test_email}")
|
||||
print(f" DID: {test_did}")
|
||||
print(f" Password: {test_password}")
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
+95
@@ -0,0 +1,95 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Bluesky PDS goat account test — create, list, delete accounts via goat CLI."""
|
||||
import argparse
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
|
||||
sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', '..'))
|
||||
from utils.tests.helpers import run, resolve_domain
|
||||
|
||||
|
||||
def run_in_container(domain, cmd):
|
||||
"""Run a command inside the app container via abra."""
|
||||
result = run(
|
||||
f'''script -qefc "abra app run {domain} app --no-tty -- sh -c '{cmd}' 2>&1" /dev/null''',
|
||||
check=False, timeout=120,
|
||||
)
|
||||
return result.stdout
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--domain', default=os.environ.get('TEST_DOMAIN'))
|
||||
args = parser.parse_args()
|
||||
domain = args.domain or resolve_domain('bluesky-pds')
|
||||
|
||||
test_handle = f"smoketest.{domain}"
|
||||
test_email = f"smoketest@{domain}"
|
||||
test_password = "testpass-goat-account-check"
|
||||
pds_host = "http://localhost:3000"
|
||||
admin_pw_flag = "--admin-password \\$(cat /run/secrets/pds_admin_password)"
|
||||
pds_flag = f"--pds-host {pds_host}"
|
||||
|
||||
# Step 1: PDS describe
|
||||
print("Step 1: Checking PDS describe ...")
|
||||
describe_output = run_in_container(domain, f"goat pds describe {pds_host} 2>&1")
|
||||
if f"did:web:{domain}" in describe_output:
|
||||
print(f"PASS: PDS describe returned expected DID (did:web:{domain})")
|
||||
else:
|
||||
print("FAIL: PDS describe did not contain expected DID")
|
||||
print(f"Output: {describe_output}")
|
||||
sys.exit(1)
|
||||
|
||||
# Step 2: Cleanup previous test account if it exists
|
||||
print("Step 2: Cleaning up previous test account if present ...")
|
||||
account_list = run_in_container(domain, f"goat pds admin account list {admin_pw_flag} {pds_flag} 2>&1")
|
||||
for did in re.findall(r'did:plc:\w+', account_list):
|
||||
info = run_in_container(domain, f"goat pds admin account info {did} {admin_pw_flag} {pds_flag} 2>&1")
|
||||
if f'"handle": "{test_handle}"' in info:
|
||||
print(f" Found existing test account ({did}), deleting ...")
|
||||
run_in_container(domain, f"goat pds admin account delete {did} {admin_pw_flag} {pds_flag} 2>&1")
|
||||
print(" Deleted.")
|
||||
|
||||
# Step 3: Create a test account
|
||||
print(f"Step 3: Creating test account ({test_handle}) ...")
|
||||
create_output = run_in_container(
|
||||
domain,
|
||||
f"goat pds admin account create {admin_pw_flag} {pds_flag} --handle {test_handle} --email {test_email} --password {test_password} 2>&1",
|
||||
)
|
||||
test_did_match = re.search(r'did:plc:\w+', create_output)
|
||||
if not test_did_match:
|
||||
print("FAIL: Could not create test account")
|
||||
print(f"Output: {create_output}")
|
||||
sys.exit(1)
|
||||
test_did = test_did_match.group()
|
||||
print(f" Account created: {create_output.strip()}")
|
||||
print(f" DID: {test_did}")
|
||||
|
||||
# Step 4: List accounts and verify the test DID is present
|
||||
print("Step 4: Verifying test account appears in account list ...")
|
||||
account_list = run_in_container(domain, f"goat pds admin account list {admin_pw_flag} {pds_flag} 2>&1")
|
||||
if test_did in account_list:
|
||||
print("PASS: Test account found in account list")
|
||||
else:
|
||||
print("FAIL: Test account not found in account list")
|
||||
sys.exit(1)
|
||||
|
||||
# Step 5: Delete the test account
|
||||
print("Step 5: Deleting test account ...")
|
||||
delete_output = run_in_container(domain, f"goat pds admin account delete {test_did} {admin_pw_flag} {pds_flag} 2>&1")
|
||||
print(f" Deleted: {delete_output.strip()}")
|
||||
|
||||
# Step 6: Verify deletion
|
||||
print("Step 6: Verifying test account is gone ...")
|
||||
account_list = run_in_container(domain, f"goat pds admin account list {admin_pw_flag} {pds_flag} 2>&1")
|
||||
if test_did in account_list:
|
||||
print("FAIL: Test account still present after deletion")
|
||||
sys.exit(1)
|
||||
print("PASS: Test account successfully deleted")
|
||||
|
||||
print("PASS: All goat account tests passed")
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Health check for Bluesky PDS."""
|
||||
import argparse
|
||||
import os
|
||||
import sys
|
||||
|
||||
sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', '..'))
|
||||
from utils.tests.helpers import http_get, resolve_domain
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--domain', default=os.environ.get('TEST_DOMAIN'))
|
||||
args = parser.parse_args()
|
||||
domain = args.domain or resolve_domain('bluesky-pds')
|
||||
url = f"https://{domain}/xrpc/_health"
|
||||
|
||||
print(f"Checking Bluesky PDS at {url} ...")
|
||||
status, _ = http_get(url)
|
||||
if status == 200:
|
||||
print(f"PASS: Bluesky PDS returned HTTP {status}")
|
||||
else:
|
||||
print(f"FAIL: Bluesky PDS returned HTTP {status} (expected 200)")
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
+135
@@ -0,0 +1,135 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Test: verify Caddy obtains a valid TLS certificate for a subdomain handle."""
|
||||
import argparse
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
import time
|
||||
|
||||
sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', '..'))
|
||||
from utils.tests.helpers import run, resolve_domain
|
||||
|
||||
|
||||
def run_in_container(domain, cmd):
|
||||
"""Run a command inside the app container via abra."""
|
||||
result = run(
|
||||
f'''script -qefc "abra app run {domain} app --no-tty -- sh -c '{cmd}' 2>&1" /dev/null''',
|
||||
check=False, timeout=120,
|
||||
)
|
||||
return result.stdout
|
||||
|
||||
|
||||
def delete_account(domain, did, admin_pw_flag, pds_flag):
|
||||
print(f" Deleting {did} ...")
|
||||
run_in_container(domain, f"goat pds admin account delete {did} {admin_pw_flag} {pds_flag} 2>&1")
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--domain', default=os.environ.get('TEST_DOMAIN'))
|
||||
args = parser.parse_args()
|
||||
domain = args.domain or resolve_domain('bluesky-pds')
|
||||
|
||||
suffix = str(int(time.time()))
|
||||
test_handle = f"tlstest{suffix}.{domain}"
|
||||
test_email = f"tlstest{suffix}@{domain}"
|
||||
test_password = "testpass-subdomain-tls-check"
|
||||
pds_host = "http://localhost:3000"
|
||||
admin_pw_flag = "--admin-password \\$(cat /run/secrets/pds_admin_password)"
|
||||
pds_flag = f"--pds-host {pds_host}"
|
||||
max_attempts = 12
|
||||
retry_interval = 10
|
||||
|
||||
# Step 1: Clean up old tlstest accounts
|
||||
print("Step 1: Cleaning up old tlstest accounts if present ...")
|
||||
# List all accounts, then check each one for tlstest handles
|
||||
account_list = run_in_container(
|
||||
domain,
|
||||
f"goat pds admin account list {admin_pw_flag} {pds_flag} 2>&1",
|
||||
)
|
||||
deleted = []
|
||||
for did in re.findall(r'did:plc:\w+', account_list):
|
||||
info = run_in_container(
|
||||
domain,
|
||||
f"goat pds admin account info {did} {admin_pw_flag} {pds_flag} 2>&1",
|
||||
)
|
||||
if re.search(r'"handle": "tlstest\d+\.', info):
|
||||
print(f" Found old tlstest account ({did}), deleting ...")
|
||||
run_in_container(
|
||||
domain,
|
||||
f"goat pds admin account delete {did} {admin_pw_flag} {pds_flag} 2>&1",
|
||||
)
|
||||
deleted.append(did)
|
||||
if not deleted:
|
||||
print(" No old accounts found.")
|
||||
|
||||
# Step 2: Create the test account
|
||||
print(f"Step 2: Creating test account ({test_handle}) ...")
|
||||
create_output = run_in_container(
|
||||
domain,
|
||||
f"goat pds admin account create {admin_pw_flag} {pds_flag} --handle {test_handle} --email {test_email} --password {test_password} 2>&1",
|
||||
)
|
||||
test_did_match = re.search(r'did:plc:\w+', create_output)
|
||||
if not test_did_match:
|
||||
print("FAIL: Could not create test account")
|
||||
print(f"Output: {create_output}")
|
||||
sys.exit(1)
|
||||
test_did = test_did_match.group()
|
||||
print(f" Created account {test_did}")
|
||||
|
||||
# Step 3: Wait for Caddy to obtain a valid TLS cert
|
||||
print(f"Step 3: Waiting for valid TLS cert on https://{test_handle} ...")
|
||||
cert_ok = False
|
||||
for attempt in range(1, max_attempts + 1):
|
||||
print(f" Attempt {attempt}/{max_attempts} ...")
|
||||
result = run(
|
||||
f'curl -sf --max-time 15 "https://{test_handle}/xrpc/_health" -o /dev/null',
|
||||
check=False, timeout=20,
|
||||
)
|
||||
if result.returncode == 0:
|
||||
cert_ok = True
|
||||
break
|
||||
if attempt < max_attempts:
|
||||
time.sleep(retry_interval)
|
||||
|
||||
if not cert_ok:
|
||||
print(f"FAIL: Caddy did not obtain a valid TLS cert for {test_handle} after {max_attempts * retry_interval}s")
|
||||
delete_account(domain, test_did, admin_pw_flag, pds_flag)
|
||||
sys.exit(1)
|
||||
|
||||
print(f"PASS: Valid TLS cert obtained for {test_handle}")
|
||||
|
||||
# Step 4: Verify cert details
|
||||
print("Step 4: Checking certificate subject ...")
|
||||
result = run(
|
||||
f'echo | openssl s_client -servername {test_handle} -connect {test_handle}:443 2>/dev/null | openssl x509 -noout -subject 2>/dev/null',
|
||||
check=False, timeout=15,
|
||||
)
|
||||
cert_subject = result.stdout.strip()
|
||||
print(f" {cert_subject}")
|
||||
|
||||
if test_handle in cert_subject:
|
||||
print(f"PASS: Certificate subject matches {test_handle}")
|
||||
else:
|
||||
# Check SANs
|
||||
result = run(
|
||||
f'echo | openssl s_client -servername {test_handle} -connect {test_handle}:443 2>/dev/null | openssl x509 -noout -text 2>/dev/null | grep -A1 "Subject Alternative Name"',
|
||||
check=False, timeout=15,
|
||||
)
|
||||
cert_san = result.stdout.strip()
|
||||
print(f" SANs: {cert_san}")
|
||||
if test_handle in cert_san:
|
||||
print(f"PASS: Certificate SAN matches {test_handle}")
|
||||
else:
|
||||
print(f"FAIL: Certificate does not match {test_handle}")
|
||||
delete_account(domain, test_did, admin_pw_flag, pds_flag)
|
||||
sys.exit(1)
|
||||
|
||||
# Step 5: Cleanup
|
||||
delete_account(domain, test_did, admin_pw_flag, pds_flag)
|
||||
|
||||
print("PASS: Subdomain TLS test passed")
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
Reference in New Issue
Block a user