server-container-test.yml

name: Server container

on: workflow_call

env:
  DS_IMAGE: ${{ vars.DS_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  # https://github.com/dogtagpki/pki/wiki/Deploying-PKI-Server-Container
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Install dependencies
        run: |
          sudo apt-get update

          # replace docker with podman
          sudo apt-get -y purge --auto-remove docker-ce-cli
          sudo apt-get -y install podman-docker

      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve PKI images
        uses: actions/cache@v4
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Create shared folders
        run: |
          mkdir certs
          mkdir conf
          mkdir logs

      - name: Set up client container
        run: |
          tests/bin/runner-init.sh \
              --hostname=client.example.com \
              --network=example \
              client

      - name: Set up server container
        run: |
          docker run \
              --name server \
              --hostname pki.example.com \
              --network example \
              --network-alias pki.example.com \
              -v $PWD/certs:/certs \
              -v $PWD/conf:/conf \
              -v $PWD/logs:/logs \
              --detach \
              pki-server

          # wait for server to start
          docker exec client curl \
              --retry 60 \
              --retry-delay 0 \
              --retry-connrefused \
              -s \
              -k \
              -o /dev/null \
              https://pki.example.com:8443

      - name: Check conf dir
        if: always()
        run: |
          ls -l conf \
              | sed \
                  -e '/^total/d' \
                  -e 's/^\(\S*\) *\S* *\S* *\(\S*\) *\S* *\S* *\S* *\S* *\(.*\)$/\1 \2 \3/' \
              | tee output

          # everything should be owned by docker group
          # TODO: review owners/permissions
          cat > expected << EOF
          drwxrwxrwx docker Catalina
          drwxrwxrwx docker alias
          -rw-rw-rw- docker catalina.policy
          lrwxrwxrwx docker catalina.properties -> /usr/share/pki/server/conf/catalina.properties
          drwxrwxrwx docker certs
          lrwxrwxrwx docker context.xml -> /etc/tomcat/context.xml
          -rw-rw-rw- docker jss.conf
          lrwxrwxrwx docker logging.properties -> /usr/share/pki/server/conf/logging.properties
          -rw-rw-rw- docker password.conf
          -rw-rw-rw- docker server.xml
          -rw-rw-rw- docker tomcat.conf
          lrwxrwxrwx docker web.xml -> /etc/tomcat/web.xml
          EOF

          diff expected output

      - name: Check logs dir
        if: always()
        run: |
          ls -l logs \
              | sed \
                  -e '/^total/d' \
                  -e 's/^\(\S*\) *\S* *\S* *\(\S*\) *\S* *\S* *\S* *\S* *\(.*\)$/\1 \2 \3/' \
              | tee output

          DATE=$(date +'%Y-%m-%d')

          # everything should be owned by docker group
          # TODO: review owners/permissions
          cat > expected << EOF
          drwxrwx--- docker backup
          -rw-rw-rw- docker catalina.$DATE.log
          -rw-rw-rw- docker host-manager.$DATE.log
          -rw-rw-rw- docker localhost.$DATE.log
          -rw-rw-rw- docker localhost_access_log.$DATE.txt
          -rw-rw-rw- docker manager.$DATE.log
          drwxrwxrwx docker pki
          EOF

          diff expected output

      - name: Check server info
        run: |
          docker exec server pki \
              -d /conf/alias \
              -f /conf/password.conf \
              nss-cert-export \
              --output-file ca_signing.crt \
              ca_signing

          docker cp server:ca_signing.crt .

          docker exec client pki nss-cert-import \
              --cert $SHARED/ca_signing.crt \
              --trust CT,C,C \
              ca_signing

          docker exec client pki \
              -U https://pki.example.com:8443 \
              info

      - name: Restart server
        run: |
          docker restart server
          sleep 10

          docker network reload --all

          # wait for server to restart
          docker exec client curl \
              --retry 60 \
              --retry-delay 0 \
              --retry-connrefused \
              -s \
              -k \
              -o /dev/null \
              https://pki.example.com:8443

      - name: Check server info again
        run: |
          docker exec client pki \
              -U https://pki.example.com:8443 \
              info

      - name: Check server container logs
        if: always()
        run: |
          docker logs server 2>&1

      - name: Gather artifacts
        if: always()
        run: |
          mkdir -p /tmp/artifacts/server
          cp -r certs /tmp/artifacts/server
          cp -r conf /tmp/artifacts/server
          cp -r logs /tmp/artifacts/server

          docker logs server > /tmp/artifacts/server/container.out 2> /tmp/artifacts/server/container.err

          mkdir -p /tmp/artifacts/client
          docker logs client > /tmp/artifacts/client/container.out 2> /tmp/artifacts/client/container.err
        continue-on-error: true

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: server-container
          path: /tmp/artifacts