tks-separate-test.yml

name: TKS on separate instance

on: workflow_call

env:
  DS_IMAGE: ${{ vars.DS_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve PKI images
        uses: actions/cache@v4
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up CA DS container
        run: |
          tests/bin/ds-create.sh \
              --image=${{ env.DS_IMAGE }} \
              --hostname=cads.example.com \
              --password=Secret.123 \
              cads

      - name: Connect CA DS container to network
        run: docker network connect example cads --alias cads.example.com

      - name: Set up CA container
        run: |
          tests/bin/runner-init.sh ca
        env:
          HOSTNAME: ca.example.com

      - name: Connect CA container to network
        run: docker network connect example ca --alias ca.example.com

      - name: Install CA in CA container
        run: |
          docker exec ca pkispawn \
              -f /usr/share/pki/server/examples/installation/ca.cfg \
              -s CA \
              -D pki_ds_url=ldap://cads.example.com:3389 \
              -v

          docker exec ca pki-server cert-find

      - name: Install banner in CA container
        run: docker exec ca cp /usr/share/pki/server/examples/banner/banner.txt /var/lib/pki/pki-tomcat/conf

      - name: Set up TKS DS container
        run: |
          tests/bin/ds-create.sh \
              --image=${{ env.DS_IMAGE }} \
              --hostname=tksds.example.com \
              --password=Secret.123 \
              tksds

      - name: Connect TKS DS container to network
        run: docker network connect example tksds --alias tksds.example.com

      - name: Set up TKS container
        run: |
          tests/bin/runner-init.sh tks
        env:
          HOSTNAME: tks.example.com

      - name: Connect TKS container to network
        run: docker network connect example tks --alias tks.example.com

      - name: Install TKS in TKS container
        run: |
          docker exec ca pki-server cert-export ca_signing --cert-file ${SHARED}/ca_signing.crt
          docker exec ca cp /root/.dogtag/pki-tomcat/ca_admin.cert ${SHARED}/ca_admin.cert
          docker exec tks pkispawn \
              -f /usr/share/pki/server/examples/installation/tks.cfg \
              -s TKS \
              -D pki_security_domain_hostname=ca.example.com \
              -D pki_cert_chain_nickname=ca_signing \
              -D pki_cert_chain_path=${SHARED}/ca_signing.crt \
              -D pki_admin_cert_file=${SHARED}/ca_admin.cert \
              -D pki_ds_url=ldap://tksds.example.com:3389 \
              -v

          docker exec tks pki-server cert-find

      - name: Install banner in TKS container
        run: docker exec tks cp /usr/share/pki/server/examples/banner/banner.txt /var/lib/pki/pki-tomcat/conf

      - name: Run PKI healthcheck
        run: docker exec tks pki-healthcheck --failures-only

      - name: Verify TKS admin
        run: |
          docker exec ca cp /root/.dogtag/pki-tomcat/ca_admin_cert.p12 ${SHARED}/ca_admin_cert.p12

          docker exec tks pki nss-cert-import \
              --cert $SHARED/ca_signing.crt \
              --trust CT,C,C \
              ca_signing

          docker exec tks pki pkcs12-import \
              --pkcs12 ${SHARED}/ca_admin_cert.p12 \
              --pkcs12-password Secret.123
          docker exec tks pki -n caadmin --ignore-banner tks-user-show tksadmin

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh cads
          tests/bin/pki-artifacts-save.sh ca
          tests/bin/ds-artifacts-save.sh tksds
          tests/bin/pki-artifacts-save.sh tks
        continue-on-error: true

      - name: Remove TKS
        run: docker exec tks pkidestroy -s TKS -v

      - name: Remove CA
        run: docker exec ca pkidestroy -s CA -v

      - name: Check CA DS server systemd journal
        if: always()
        run: |
          docker exec cads journalctl -x --no-pager -u dirsrv@localhost.service

      - name: Check CA DS container logs
        if: always()
        run: |
          docker logs cads

      - name: Check CA systemd journal
        if: always()
        run: |
          docker exec ca journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check CA debug log
        if: always()
        run: |
          docker exec ca find /var/lib/pki/pki-tomcat/logs/ca -name "debug.*" -exec cat {} \;

      - name: Check TKS DS server systemd journal
        if: always()
        run: |
          docker exec tksds journalctl -x --no-pager -u dirsrv@localhost.service

      - name: Check TKS DS container logs
        if: always()
        run: |
          docker logs tksds

      - name: Check TKS systemd journal
        if: always()
        run: |
          docker exec tks journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check TKS debug log
        if: always()
        run: |
          docker exec tks find /var/lib/pki/pki-tomcat/logs/tks -name "debug.*" -exec cat {} \;

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: tks-separate
          path: /tmp/artifacts