kevinveenbirkenbach/computer-playbook
1
0 Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-08 11:46:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(domains): read the primary domain from default.env in every test

Browse Source 
The hardcoded-primary-domain lint exempted tests/ and scripts/tests/, so test
fixtures kept their own copy of the domain and would drift from
INFINITO_DOMAIN the moment it changes. The lint now scans both trees, and a
unit test pins its scope: only default.env, Markdown, inventories/, .claude/
and build/ may name the domain.

Python tests take the value from default_domain_primary(), and the workspace
helper builds its dashboard and Matomo URLs from INFINITO_DOMAIN once the repo
.env is loaded.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kevinveenbirkenbachandClaude Opus 5.5 committed 2026-09-24 22:53:54 +02:00
1 parent e8cb94e246
commit e2beab9f1c
34 files changed
+371 -290
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

scripts/tests/workspace/utils/common.sh
+5 -3
View File
@@ -9,10 +9,8 @@ DASHBOARD_APP="web-app-dashboard"
MATOMO_APP="web-app-matomo"
MARIADB_APP="svc-db-mariadb"
POSTGRES_APP="svc-db-postgres"
DASHBOARD_URL="https://dashboard.infinito.test"
MATOMO_URL="https://matomo.infinito.test"
: "${DASHBOARD_APP}" "${MATOMO_APP}" "${MARIADB_APP}" "${POSTGRES_APP}" "${DASHBOARD_URL}" "${MATOMO_URL}"
: "${DASHBOARD_APP}" "${MATOMO_APP}" "${MARIADB_APP}" "${POSTGRES_APP}"
UTILS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "${UTILS_DIR}/../../../.." && pwd)"
@@ -57,6 +55,10 @@ load_repo_env() {
load_repo_env
ensure_git_safe_directory
DASHBOARD_URL="https://dashboard.${INFINITO_DOMAIN:?INFINITO_DOMAIN comes from the .env scripts/meta/env/load.sh sources}"
MATOMO_URL="https://matomo.${INFINITO_DOMAIN:?INFINITO_DOMAIN comes from the .env scripts/meta/env/load.sh sources}"
: "${DASHBOARD_URL}" "${MATOMO_URL}"
# Print the generated inventory and host_vars for debugging and verification.
#
# Matrix-variant deploys write `${INFINITO_INVENTORY_DIR}-0/devices.yml`,
tests/integration/ansible/lookups/test_objstore_consumers.py
+4 -2
View File
@@ -21,11 +21,13 @@ from plugins.lookup.applications import (
)
from plugins.lookup.objstore_consumers import LookupModule as ObjstoreConsumersLookup
from utils.cache.files import read_text
from utils.domains.default_primary import default_domain_primary
from utils.roles.mapping import ROLE_FILE_META_SERVICES
from . import PROJECT_ROOT
ROLES_DIR = PROJECT_ROOT / "roles"
DOMAIN = default_domain_primary()
PROVIDER = "web-app-seaweedfs"
DECLARED_CONSUMER = "web-app-matrix"
OVERRIDE_CONSUMER = "web-app-hugo"
@@ -42,8 +44,8 @@ def _variables(applications: dict, group_names: list[str]) -> dict:
return {
"applications": applications,
"users": {},
"DOMAIN_PRIMARY": "infinito.test",
"SYSTEM_EMAIL_DOMAIN": "infinito.test",
"DOMAIN_PRIMARY": DOMAIN,
"SYSTEM_EMAIL_DOMAIN": DOMAIN,
"DIR_COMPOSITIONS": "/opt/compose/",
"group_names": list(group_names),
}
tests/integration/roles/test-e2e-cli/test_mcp_env_render.py
+2 -1
View File
@@ -34,6 +34,7 @@ from ansible.template import Templar, trust_as_template
from utils.cache.applications import get_application_defaults
from utils.cache.files import PROJECT_ROOT, read_text
from utils.cache.yaml import load_yaml_any
from utils.domains.default_primary import default_domain_primary
from utils.roles.mapping import (
ROLE_FILE_DEFAULTS_MAIN,
ROLE_FILE_META_MCP,
@@ -42,7 +43,7 @@ from utils.roles.mapping import (
)
_SHARED = "roles/test-e2e-cli/templates/mcp/test.env.j2"
_DOMAIN = "infinito.test"
_DOMAIN = default_domain_primary()
_SERVER_DIRECTIONS = frozenset({"server", "both"})
_CLIENT_DIRECTIONS = frozenset({"client"})
_MODES = ("compose", "swarm")
tests/lint/repository/spot/test_no_hardcoded_primary_domain.py
+27 -7
View File
@@ -17,11 +17,12 @@ The value searched for is read from ``default.env`` at test time, so this rule
follows the SPOT rather than repeating it.
Scope: every git-tracked file except ``default.env`` itself, ``.md``
documentation, and three places where a concrete host is the point rather than a
copy -- the test trees (``tests/`` and ``scripts/tests/``) whose fixtures assert
against a named host, and ``inventories/``, where declaring the real values is
what an inventory is for. Gitignored build output is skipped too: a generated
``.env`` carries the value because it correctly derived it.
documentation, and ``inventories/``, where declaring the real values is what an
inventory is for. Tests derive the domain like everything else, so their
fixtures follow the SPOT when it changes: Python through
``default_domain_primary()``, JavaScript unit tests through
``tests/unit/javascript/utils/domain.js``. Gitignored build output is skipped
too: a generated ``.env`` carries the value because it correctly derived it.
Per-line opt-out: ``# nocheck: hardcoded-primary-domain`` on the offending line
or the immediately preceding non-empty line, with a reason. Legitimate cases are
@@ -43,7 +44,7 @@ from . import PROJECT_ROOT
_RULE = "hardcoded-primary-domain"
_SPOT_FILE = "default.env"
_SPOT_KEY = "INFINITO_DOMAIN"
_SKIP_DIRS = (".claude/", "build/", "inventories/", "scripts/tests/")
_SKIP_DIRS = (".claude/", "build/", "inventories/")
def _spot_domain() -> str:
@@ -64,7 +65,7 @@ def _is_scan_target(rel_path: str) -> bool:
def _collect_findings(domain: str) -> list[tuple[str, int, str]]:
findings: list[tuple[str, int, str]] = []
for path_str in iter_non_ignored_files(exclude_tests=True):
for path_str in iter_non_ignored_files():
rel = Path(path_str).relative_to(PROJECT_ROOT).as_posix()
if not _is_scan_target(rel):
continue
@@ -85,6 +86,24 @@ def _collect_findings(domain: str) -> list[tuple[str, int, str]]:
class TestNoHardcodedPrimaryDomain(unittest.TestCase):
def test_code_and_tests_alike_must_derive_the_domain(self) -> None:
for rel in (
"roles/web-app-x/files/playwright/spec.js",
"roles/web-app-x/files/python/script.py",
"scripts/tests/workspace/utils/common.sh",
"scripts/system/tls/trust/wsl2.sh",
"plugins/lookup/x.py",
"cli/meta/x.py",
"tests/unit/javascript/roles/x/network.test.js",
"tests/lint/x.py",
"tests/integration/x.sh",
):
with self.subTest(rel=rel):
self.assertTrue(_is_scan_target(rel), f"{rel} must be scanned")
for rel in ("default.env", "docs/x.md", "inventories/x/host_vars/a.yml"):
with self.subTest(rel=rel):
self.assertFalse(_is_scan_target(rel), f"{rel} may name the domain")
def test_primary_domain_is_derived_not_written_out(self) -> None:
domain = _spot_domain()
self.assertTrue(domain, f"{_SPOT_KEY} is empty in {_SPOT_FILE}")
@@ -102,6 +121,7 @@ class TestNoHardcodedPrimaryDomain(unittest.TestCase):
"a second copy is one nobody updates.\n\n"
" Ansible: DOMAIN_PRIMARY\n"
" Python: utils.domains.default_primary.default_domain_primary()\n"
" JS tests: tests/unit/javascript/utils/domain.js\n"
" shell: the generated .env\n\n"
f"Affected:\n{formatted}\n\n"
f"Per-line opt-out: `# nocheck: {_RULE}` with a reason."
tests/performance/test_runtime_performance.py
+4 -2
View File
@@ -33,10 +33,12 @@ from plugins.lookup.domains import (
from plugins.lookup.domains import (
_reset_cache_for_tests as _reset_domains_cache,
)
from utils.domains.default_primary import default_domain_primary
from . import PROJECT_ROOT
ROLES_DIR = PROJECT_ROOT / "roles"
DOMAIN = default_domain_primary()
def _simulate_ansible_variables(
@@ -52,8 +54,8 @@ def _simulate_ansible_variables(
return {
"applications": shared_applications,
"users": shared_users,
"DOMAIN_PRIMARY": "infinito.test",
"SYSTEM_EMAIL_DOMAIN": "infinito.test",
"DOMAIN_PRIMARY": DOMAIN,
"SYSTEM_EMAIL_DOMAIN": DOMAIN,
"group_names": [],
}
tests/unit/python/cli/administration/deploy/development/test_coredns.py
+8 -5
View File
@@ -1,20 +1,23 @@
from __future__ import annotations
import re
import tempfile
import unittest
from pathlib import Path
from cli.administration.deploy.development.coredns import CoreDNSCorefileRenderer
from utils.cache.files import PROJECT_ROOT, read_text
from utils.domains.default_primary import default_domain_primary
TEMPLATE = "compose/coredns/Corefile.tmpl"
DOMAIN = default_domain_primary()
def _render() -> str:
with tempfile.TemporaryDirectory() as tmp:
root = Path(tmp)
(root / ".env").write_text(
'INFINITO_DOMAIN=infinito.test\nINFINITO_IP4="172.30.0.10"\n',
f'INFINITO_DOMAIN={DOMAIN}\nINFINITO_IP4="172.30.0.10"\n',
encoding="utf-8",
)
template = root / TEMPLATE
@@ -27,16 +30,16 @@ def _render() -> str:
class TestCoreDNSCorefileRenderer(unittest.TestCase):
def test_the_domain_regex_is_derived_from_the_domain_escaped_once(self) -> None:
corefile = _render()
self.assertIn("match ^infinito\\.test\\.$", corefile)
self.assertIn("match ^(.*)\\.infinito\\.test\\.$", corefile)
self.assertIn(f"match ^{re.escape(DOMAIN)}\\.$", corefile)
self.assertIn(f"match ^(.*)\\.{re.escape(DOMAIN)}\\.$", corefile)
self.assertNotIn("\\\\", corefile)
self.assertNotIn("${", corefile)
def test_the_deployment_zone_answers_every_type_itself(self) -> None:
corefile = _render()
catch_all = "template IN ANY infinito.test {"
catch_all = f"template IN ANY {DOMAIN} {{"
self.assertIn(catch_all, corefile)
self.assertIn("IN SOA ns.infinito.test. hostmaster.infinito.test.", corefile)
self.assertIn(f"IN SOA ns.{DOMAIN}. hostmaster.{DOMAIN}.", corefile)
lines = corefile.splitlines()
self.assertLess(
max(
tests/unit/python/cli/meta/domains/test_main.py
+10 -7
View File
@@ -8,8 +8,11 @@ from unittest.mock import patch
import cli.meta.domains.__main__ as mod
from utils.cache.yaml import dump_yaml_str
from utils.domains.default_primary import default_domain_primary
from utils.roles.mapping import ROLE_FILE_META_DOMAINS, ROLE_FILE_VARS_MAIN
DOMAIN = default_domain_primary()
class TestCliMetaApplicationsDomains(TestCase):
def write_role(
@@ -60,7 +63,7 @@ class TestCliMetaApplicationsDomains(TestCase):
code, out, err = self._run(
[
"--domain-primary",
"infinito.test",
DOMAIN,
"--alias",
"--www",
]
@@ -71,12 +74,12 @@ class TestCliMetaApplicationsDomains(TestCase):
self.assertEqual(
out.strip().splitlines(),
[
"alias.infinito.test",
"dashboard.infinito.test",
"test.infinito.test",
"www.alias.infinito.test",
"www.dashboard.infinito.test",
"www.test.infinito.test",
f"alias.{DOMAIN}",
f"dashboard.{DOMAIN}",
f"test.{DOMAIN}",
f"www.alias.{DOMAIN}",
f"www.dashboard.{DOMAIN}",
f"www.test.{DOMAIN}",
],
)
tests/unit/python/plugins/filter/test_cookie_scope.py
+25 -28
View File
@@ -1,82 +1,79 @@
import unittest
from plugins.filter.cookie_scope import common_dns_suffix, domain_strings
from utils.domains.default_primary import default_domain_primary
DOMAIN = default_domain_primary()
class CommonDnsSuffixTests(unittest.TestCase):
def test_domain_pipeline_normalizes_every_supported_shape(self):
mapping = {
"filer": "filer.seaweedfs.s3.infinito.test",
"master": "master.seaweedfs.s3.infinito.test",
"filer": f"filer.seaweedfs.s3.{DOMAIN}",
"master": f"master.seaweedfs.s3.{DOMAIN}",
}
self.assertEqual(
common_dns_suffix(domain_strings(mapping)),
"seaweedfs.s3.infinito.test",
f"seaweedfs.s3.{DOMAIN}",
)
self.assertEqual(
common_dns_suffix(domain_strings("cloud.infinito.test")),
"cloud.infinito.test",
common_dns_suffix(domain_strings(f"cloud.{DOMAIN}")),
f"cloud.{DOMAIN}",
)
mixed = domain_strings(
["cloud.infinito.test", "cloud.examplelongonionaddress.onion"]
[f"cloud.{DOMAIN}", "cloud.examplelongonionaddress.onion"]
)
clearnet = [domain for domain in mixed if not domain.endswith(".onion")]
self.assertEqual(common_dns_suffix(clearnet), "cloud.infinito.test")
self.assertEqual(common_dns_suffix(clearnet), f"cloud.{DOMAIN}")
def test_single_domain_returned_unchanged(self):
self.assertEqual(
common_dns_suffix(["cloud.infinito.test"]), "cloud.infinito.test"
)
self.assertEqual(common_dns_suffix([f"cloud.{DOMAIN}"]), f"cloud.{DOMAIN}")
def test_multi_domain_collapses_to_shared_parent(self):
self.assertEqual(
common_dns_suffix(
[
"api.seaweedfs.s3.infinito.test",
"filer.seaweedfs.s3.infinito.test",
"master.seaweedfs.s3.infinito.test",
f"api.seaweedfs.s3.{DOMAIN}",
f"filer.seaweedfs.s3.{DOMAIN}",
f"master.seaweedfs.s3.{DOMAIN}",
]
),
"seaweedfs.s3.infinito.test",
f"seaweedfs.s3.{DOMAIN}",
)
def test_subdomain_alias_keeps_minimal_shared_suffix(self):
self.assertEqual(
common_dns_suffix(["app.infinito.test", "www.app.infinito.test"]),
"app.infinito.test",
common_dns_suffix([f"app.{DOMAIN}", f"www.app.{DOMAIN}"]),
f"app.{DOMAIN}",
)
def test_dict_input_uses_values_multi(self):
self.assertEqual(
common_dns_suffix(
{
"filer": "filer.seaweedfs.s3.infinito.test",
"master": "master.seaweedfs.s3.infinito.test",
"api": "api.seaweedfs.s3.infinito.test",
"filer": f"filer.seaweedfs.s3.{DOMAIN}",
"master": f"master.seaweedfs.s3.{DOMAIN}",
"api": f"api.seaweedfs.s3.{DOMAIN}",
}
),
"seaweedfs.s3.infinito.test",
f"seaweedfs.s3.{DOMAIN}",
)
def test_dict_input_single_value(self):
self.assertEqual(
common_dns_suffix({"web": "cloud.infinito.test"}),
"cloud.infinito.test",
common_dns_suffix({"web": f"cloud.{DOMAIN}"}),
f"cloud.{DOMAIN}",
)
def test_string_input(self):
self.assertEqual(
common_dns_suffix("cloud.infinito.test"), "cloud.infinito.test"
)
self.assertEqual(common_dns_suffix(f"cloud.{DOMAIN}"), f"cloud.{DOMAIN}")
def test_empty_input_returns_empty_string(self):
self.assertEqual(common_dns_suffix([]), "")
self.assertEqual(common_dns_suffix(None), "")
def test_blank_entries_ignored(self):
self.assertEqual(
common_dns_suffix(["", "cloud.infinito.test"]), "cloud.infinito.test"
)
self.assertEqual(common_dns_suffix(["", f"cloud.{DOMAIN}"]), f"cloud.{DOMAIN}")
if __name__ == "__main__":
tests/unit/python/plugins/filter/test_csp_filters/test_onion_mirror.py
+2 -1
View File
@@ -2,9 +2,10 @@ import copy
import unittest
from plugins.filter.csp_filters import FilterModule
from utils.domains.default_primary import default_domain_primary
NODE = "ndck3kzcxbcem2oskbhytxwevvpzwn7j5dj6q36vbijyrnw3rjf2heqd.onion"
PRIMARY = "infinito.test"
PRIMARY = default_domain_primary()
class TestCspOnionMirror(unittest.TestCase):
tests/unit/python/plugins/filter/test_domain_filters_canonical.py
+5 -2
View File
@@ -3,6 +3,9 @@ import unittest
from ansible.errors import AnsibleFilterError
from plugins.filter.canonical_domains_map import FilterModule
from utils.domains.default_primary import default_domain_primary
DOMAIN = default_domain_primary()
class TestDomainFilters(unittest.TestCase):
@@ -117,14 +120,14 @@ class TestDomainFilters(unittest.TestCase):
import os
prev = os.environ.get("DOMAIN")
os.environ["DOMAIN"] = "infinito.test"
os.environ["DOMAIN"] = DOMAIN
try:
primary = (
"{{ lookup('env', 'DOMAIN') | default('infinito.localhost', true) }}"
)
apps = {"web-app-app1": {}}
result = self.filter_module.canonical_domains_map(apps, primary)
self.assertEqual(result, {"web-app-app1": ["app1.infinito.test"]})
self.assertEqual(result, {"web-app-app1": [f"app1.{DOMAIN}"]})
finally:
if prev is None:
os.environ.pop("DOMAIN", None)
tests/unit/python/plugins/filter/test_network_of.py
+7 -9
View File
@@ -1,8 +1,10 @@
import unittest
from plugins.filter.network_of import FilterModule
from utils.domains.default_primary import default_domain_primary
ONION = "abc123def456ghij789klmno000pqrstuvwx111yz222abc333def444gh.onion"
DOMAIN = default_domain_primary()
class TestNetworkFilters(unittest.TestCase):
@@ -11,13 +13,11 @@ class TestNetworkFilters(unittest.TestCase):
def test_network_of_is_the_registry_lookup(self):
self.assertEqual(self.filters["network_of"]("x.abc.onion"), "tor")
self.assertEqual(self.filters["network_of"]("x.infinito.test"), "clearnet")
self.assertEqual(self.filters["network_of"](f"x.{DOMAIN}"), "clearnet")
def test_network_sibling_translates_the_primary(self):
self.assertEqual(
self.filters["network_sibling"](
"infinito.test", "tor", "infinito.test", ONION
),
self.filters["network_sibling"](DOMAIN, "tor", DOMAIN, ONION),
ONION,
)
@@ -32,18 +32,16 @@ class TestNetworkFilters(unittest.TestCase):
self.assertEqual(self.filters["network_suffixes"](["clearnet"]), {})
def test_in_network_keeps_the_domains_of_one_network(self):
domains = ["a.infinito.test", f"a.{ONION}", "b.infinito.test"]
domains = [f"a.{DOMAIN}", f"a.{ONION}", f"b.{DOMAIN}"]
self.assertEqual(
self.filters["in_network"](domains, "clearnet"),
["a.infinito.test", "b.infinito.test"],
[f"a.{DOMAIN}", f"b.{DOMAIN}"],
)
self.assertEqual(self.filters["in_network"](domains, "tor"), [f"a.{ONION}"])
def test_network_sibling_is_empty_without_a_node(self):
self.assertEqual(
self.filters["network_sibling"](
"infinito.test", "tor", "infinito.test", ""
),
self.filters["network_sibling"](DOMAIN, "tor", DOMAIN, ""),
"",
)
tests/unit/python/plugins/lookup/test_container_dns.py
+1 -1
View File
@@ -168,7 +168,7 @@ class TestTheBridgeSurvivesTheFirstRun(unittest.TestCase):
``ansible_facts.docker0`` is still absent. Deriving the address from the
fact alone emitted the clearnet resolver on its own, and the inner
containers then asked a public resolver for a domain only the node dnsmasq
knows: ``server can't find infinito.test: NXDOMAIN``.
knows: ``server can't find <domain>: NXDOMAIN``.
"""
POOLS: ClassVar[list] = [{"base": "10.208.0.0/12", "size": 24}]
tests/unit/python/plugins/lookup/test_current_play_redirect_domains.py
+23 -20
View File
@@ -4,6 +4,9 @@ import unittest
from unittest.mock import MagicMock, patch
from plugins.lookup.current_play_redirect_domains import LookupModule
from utils.domains.default_primary import default_domain_primary
DOMAIN = default_domain_primary()
class _DummyTemplar:
@@ -57,7 +60,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
def test_primary_redirect_appended_when_both_domains_set(self):
lm = self._make_lookup()
variables = {
"DOMAIN_PRIMARY": "infinito.test",
"DOMAIN_PRIMARY": DOMAIN,
"DOMAIN_HOMEPAGE": "infinito.nexus",
}
with self._patch_lookups(
@@ -65,28 +68,28 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
):
result = lm.run(terms=[], variables=variables)[0]
self.assertIn(
{"source": "infinito.test", "target": "infinito.nexus"},
{"source": DOMAIN, "target": "infinito.nexus"},
result,
)
def test_primary_redirect_appended_even_when_rdr_domains_not_in_deployed(self):
lm = self._make_lookup()
variables = {
"DOMAIN_PRIMARY": "infinito.test",
"DOMAIN_PRIMARY": DOMAIN,
"DOMAIN_HOMEPAGE": "infinito.nexus",
}
with self._patch_lookups(deployed=["web-opt-rdr-www"], current_play_apps={}):
result = lm.run(terms=[], variables=variables)[0]
self.assertEqual(
result,
[{"source": "infinito.test", "target": "infinito.nexus"}],
[{"source": DOMAIN, "target": "infinito.nexus"}],
)
def test_primary_redirect_absent_when_primary_equals_homepage(self):
lm = self._make_lookup()
variables = {
"DOMAIN_PRIMARY": "infinito.test",
"DOMAIN_HOMEPAGE": "infinito.test",
"DOMAIN_PRIMARY": DOMAIN,
"DOMAIN_HOMEPAGE": DOMAIN,
}
with self._patch_lookups(
deployed=["web-opt-rdr-domains"], current_play_apps={}
@@ -96,7 +99,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
def test_primary_redirect_absent_when_domain_homepage_missing(self):
lm = self._make_lookup()
variables = {"DOMAIN_PRIMARY": "infinito.test"}
variables = {"DOMAIN_PRIMARY": DOMAIN}
with self._patch_lookups(
deployed=["web-opt-rdr-domains"], current_play_apps={}
):
@@ -167,7 +170,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
}
}
variables = {
"DOMAIN_PRIMARY": "infinito.test",
"DOMAIN_PRIMARY": DOMAIN,
"DOMAIN_HOMEPAGE": "infinito.nexus",
"AUTO_BUILD_ALIASES": False,
"redirect_domain_mappings": [
@@ -180,7 +183,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
result = lm.run(terms=[], variables=variables)[0]
sources = {entry["source"]: entry["target"] for entry in result}
self.assertEqual(sources.get("legacy.example.com"), "current.example.com")
self.assertEqual(sources.get("infinito.test"), "infinito.nexus")
self.assertEqual(sources.get(DOMAIN), "infinito.nexus")
self.assertEqual(sources.get("alt-foo.example.com"), "foo.example.com")
def test_non_list_redirect_domain_mappings_treated_as_empty(self):
@@ -193,7 +196,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
def test_non_mapping_applications_current_play_skipped(self):
lm = self._make_lookup()
variables = {
"DOMAIN_PRIMARY": "infinito.test",
"DOMAIN_PRIMARY": DOMAIN,
"DOMAIN_HOMEPAGE": "infinito.nexus",
}
with self._patch_lookups(
@@ -202,7 +205,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
result = lm.run(terms=[], variables=variables)[0]
self.assertEqual(
result,
[{"source": "infinito.test", "target": "infinito.nexus"}],
[{"source": DOMAIN, "target": "infinito.nexus"}],
)
def test_jinja_tagged_domain_primary_is_templated(self):
@@ -219,7 +222,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
lm = LookupModule()
lm._templar = _ResolvingTemplar(
{
"{{ lookup('env','INFINITO_DOMAIN') }}": "infinito.test",
"{{ lookup('env','INFINITO_DOMAIN') }}": DOMAIN,
"{{ lookup('domain','web-app-dashboard') }}": "infinito.nexus",
}
)
@@ -235,7 +238,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
self.assertEqual(
result,
[{"source": "infinito.test", "target": "infinito.nexus"}],
[{"source": DOMAIN, "target": "infinito.nexus"}],
)
self.assertIn(
"{{ lookup('env','INFINITO_DOMAIN') }}",
@@ -244,7 +247,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
def _onion_variables(self, **overrides):
variables = {
"DOMAIN_PRIMARY": "infinito.test",
"DOMAIN_PRIMARY": DOMAIN,
"DOMAIN_HOMEPAGE": "dashboard.abcdefonion.onion",
"group_names": ["svc-net-tor", "web-app-dashboard"],
"applications": {
@@ -267,7 +270,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
result,
[
{
"source": "infinito.test",
"source": DOMAIN,
"target": "dashboard.abcdefonion.onion",
},
{
@@ -288,7 +291,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
result,
[
{
"source": "infinito.test",
"source": DOMAIN,
"target": "dashboard.abcdefonion.onion",
},
],
@@ -307,7 +310,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
result,
[
{
"source": "infinito.test",
"source": DOMAIN,
"target": "dashboard.abcdefonion.onion",
},
],
@@ -331,7 +334,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
result = lm.run(terms=[], variables=variables)[0]
self.assertEqual(
result,
[{"source": "infinito.test", "target": "abcdefonion.onion"}],
[{"source": DOMAIN, "target": "abcdefonion.onion"}],
)
def test_onion_apex_node_value_templated(self):
@@ -374,7 +377,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
lm._templar = _FailingTemplar()
lm._loader = None
variables = {
"DOMAIN_PRIMARY": "infinito.test",
"DOMAIN_PRIMARY": DOMAIN,
"DOMAIN_HOMEPAGE": "infinito.nexus",
}
with self._patch_lookups(
@@ -383,7 +386,7 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
result = lm.run(terms=[], variables=variables)[0]
self.assertEqual(
result,
[{"source": "infinito.test", "target": "infinito.nexus"}],
[{"source": DOMAIN, "target": "infinito.nexus"}],
)
tests/unit/python/plugins/lookup/test_network_siblings.py
+17 -16
View File
@@ -6,48 +6,49 @@ from __future__ import annotations
import unittest
from plugins.lookup.network_siblings import served_siblings
from utils.domains.default_primary import default_domain_primary
ONION = "abc123def456ghij789klmno000pqrstuvwx111yz222abc333def444gh.onion"
PRIMARY = "infinito.test"
PRIMARY = default_domain_primary()
class TestServedSiblings(unittest.TestCase):
def test_multi_app_renders_both_networks_from_the_canonical_domain(self) -> None:
domains = {"web-app-x": ["x.infinito.test", f"x.{ONION}"]}
domains = {"web-app-x": [f"x.{PRIMARY}", f"x.{ONION}"]}
self.assertEqual(
served_siblings("x.infinito.test", domains, PRIMARY, ONION),
["x.infinito.test", f"x.{ONION}"],
served_siblings(f"x.{PRIMARY}", domains, PRIMARY, ONION),
[f"x.{PRIMARY}", f"x.{ONION}"],
)
def test_multi_app_skips_the_non_canonical_sibling(self) -> None:
domains = {"web-app-x": ["x.infinito.test", f"x.{ONION}"]}
domains = {"web-app-x": [f"x.{PRIMARY}", f"x.{ONION}"]}
self.assertEqual(served_siblings(f"x.{ONION}", domains, PRIMARY, ONION), [])
def test_tor_only_app_maps_a_raw_clearnet_domain_to_its_onion(self) -> None:
domains = {"web-app-x": [f"x.{ONION}"]}
self.assertEqual(
served_siblings("x.infinito.test", domains, PRIMARY, ONION), [f"x.{ONION}"]
served_siblings(f"x.{PRIMARY}", domains, PRIMARY, ONION), [f"x.{ONION}"]
)
def test_clearnet_only_app_renders_one_vhost(self) -> None:
domains = {"web-app-x": ["x.infinito.test"]}
domains = {"web-app-x": [f"x.{PRIMARY}"]}
self.assertEqual(
served_siblings("x.infinito.test", domains, PRIMARY, ONION),
["x.infinito.test"],
served_siblings(f"x.{PRIMARY}", domains, PRIMARY, ONION),
[f"x.{PRIMARY}"],
)
def test_named_canonicals_fan_out_per_key(self) -> None:
domains = {
"web-app-x": {
"api": "api.infinito.test",
"web": "web.infinito.test",
"api": f"api.{PRIMARY}",
"web": f"web.{PRIMARY}",
"api_onion": f"api.{ONION}",
"web_onion": f"web.{ONION}",
}
}
self.assertEqual(
served_siblings("web.infinito.test", domains, PRIMARY, ONION),
["web.infinito.test", f"web.{ONION}"],
served_siblings(f"web.{PRIMARY}", domains, PRIMARY, ONION),
[f"web.{PRIMARY}", f"web.{ONION}"],
)
def test_unknown_domain_renders_as_given(self) -> None:
@@ -57,10 +58,10 @@ class TestServedSiblings(unittest.TestCase):
)
def test_node_without_tor_renders_as_given(self) -> None:
domains = {"web-app-x": ["x.infinito.test"]}
domains = {"web-app-x": [f"x.{PRIMARY}"]}
self.assertEqual(
served_siblings("x.infinito.test", domains, PRIMARY, ""),
["x.infinito.test"],
served_siblings(f"x.{PRIMARY}", domains, PRIMARY, ""),
[f"x.{PRIMARY}"],
)
tests/unit/python/plugins/lookup/test_smtp_host.py
+4 -1
View File
@@ -12,9 +12,12 @@ import unittest
from ansible.errors import AnsibleError
from utils.domains.default_primary import default_domain_primary
from . import PROJECT_ROOT
RELAY = "mail.infinito.test"
DOMAIN = default_domain_primary()
RELAY = f"mail.{DOMAIN}"
MANAGER = "swarm-manager-01"
tests/unit/python/plugins/lookup/test_users.py
+5 -2
View File
@@ -11,9 +11,12 @@ from ansible.errors import AnsibleError
from plugins.lookup.users import LookupModule, _reset_cache_for_tests
from utils.cache import base as runtime_data_base
from utils.cache.yaml import dump_yaml_str
from utils.domains.default_primary import default_domain_primary
from utils.paths import FILE_TOKENS
from utils.roles.mapping import ROLE_FILE_META_USERS
DOMAIN = default_domain_primary()
def _write_users(base_dir: Path, role_name: str, users: dict) -> None:
"""Write meta/users.yml — file root IS the users map."""
@@ -190,11 +193,11 @@ class TestUsersLookup(unittest.TestCase):
result = self.lookup.run(
["sld"],
variables={"domain": "auth.infinito.test"},
variables={"domain": f"auth.{DOMAIN}"},
roles_dir=str(self._tmp / "roles"),
)[0]
self.assertEqual(result["username"], "infinito")
self.assertEqual(result["username"], DOMAIN.split(".", maxsplit=1)[0])
def test_materializes_sld_from_env_backed_domain_primary(self) -> None:
_write_users(
tests/unit/python/roles/sys-ctl-hlth-csp/files/test_script.py
+16 -13
View File
@@ -5,6 +5,8 @@ import unittest
from pathlib import Path
from unittest.mock import MagicMock, patch
from utils.domains.default_primary import default_domain_primary
from . import PROJECT_ROOT
ROLE_FILES = PROJECT_ROOT / "roles/sys-ctl-hlth-csp/files/python"
@@ -55,6 +57,7 @@ class TestExtractDomainsFromFilenames(unittest.TestCase):
SUFFIX = ".onion"
DOMAIN = default_domain_primary()
def _vhosts(*domains: str) -> dict[str, Path]:
@@ -80,8 +83,8 @@ class TestCollectVhosts(unittest.TestCase):
with tempfile.TemporaryDirectory() as tmp:
for protocol, domain in (
("http", "app.infinito.test"),
("https", "app.infinito.test"),
("http", f"app.{DOMAIN}"),
("https", f"app.{DOMAIN}"),
("http", "app.abc123.onion"),
):
(Path(tmp) / protocol).mkdir(exist_ok=True)
@@ -89,7 +92,7 @@ class TestCollectVhosts(unittest.TestCase):
vhosts = script.collect_vhosts(tmp)
self.assertEqual(vhosts["app.infinito.test"].parent.name, "https")
self.assertEqual(vhosts[f"app.{DOMAIN}"].parent.name, "https")
self.assertEqual(vhosts["app.abc123.onion"].parent.name, "http")
def test_missing_directories_return_none(self) -> None:
@@ -101,11 +104,11 @@ class TestSplitProxiedDomains(unittest.TestCase):
def test_splits_families(self) -> None:
domains = [
"auth.abc123.onion",
"app.infinito.test",
f"app.{DOMAIN}",
"matomo.abc123.onion",
]
clearnet, onion = script.split_proxied_domains(domains, SUFFIX)
self.assertEqual(clearnet, ["app.infinito.test"])
self.assertEqual(clearnet, [f"app.{DOMAIN}"])
self.assertEqual(onion, ["auth.abc123.onion", "matomo.abc123.onion"])
def test_clearnet_only(self) -> None:
@@ -122,12 +125,12 @@ class TestSplitProxiedDomains(unittest.TestCase):
class TestIsSkippedDomain(unittest.TestCase):
def _skipped(self, domain: str) -> bool:
skip_set = {"mirror.infinito.test"}
skip_set = {f"mirror.{DOMAIN}"}
labels = {d.split(".", 1)[0] for d in skip_set}
return script.is_skipped_domain(domain, skip_set, labels, SUFFIX)
def test_explicit_clearnet_domain_is_skipped(self) -> None:
self.assertTrue(self._skipped("mirror.infinito.test"))
self.assertTrue(self._skipped(f"mirror.{DOMAIN}"))
def test_onion_sibling_of_skipped_clearnet_is_skipped(self) -> None:
self.assertTrue(self._skipped("mirror.abc123.onion"))
@@ -136,7 +139,7 @@ class TestIsSkippedDomain(unittest.TestCase):
self.assertFalse(self._skipped("auth.abc123.onion"))
def test_unrelated_clearnet_is_not_skipped(self) -> None:
self.assertFalse(self._skipped("auth.infinito.test"))
self.assertFalse(self._skipped(f"auth.{DOMAIN}"))
class TestMainSkipsOnionSiblings(unittest.TestCase):
@@ -150,7 +153,7 @@ class TestMainSkipsOnionSiblings(unittest.TestCase):
mock_run_checker: MagicMock,
) -> None:
mock_collect.return_value = _vhosts(
"mirror.infinito.test",
f"mirror.{DOMAIN}",
"mirror.abc123.onion",
"auth.abc123.onion",
)
@@ -165,7 +168,7 @@ class TestMainSkipsOnionSiblings(unittest.TestCase):
"argv",
_argv(
"--skip-domain",
"mirror.infinito.test",
f"mirror.{DOMAIN}",
"--tor-proxy",
"socks5://127.0.0.1:9050",
),
@@ -175,7 +178,7 @@ class TestMainSkipsOnionSiblings(unittest.TestCase):
script.main()
probed = [d for call in mock_build_urls.call_args_list for d in call.args[1]]
self.assertNotIn("mirror.infinito.test", probed)
self.assertNotIn(f"mirror.{DOMAIN}", probed)
self.assertNotIn("mirror.abc123.onion", probed)
self.assertIn("auth.abc123.onion", probed)
@@ -248,7 +251,7 @@ class TestMainTimesOutOnionsOnly(unittest.TestCase):
mock_build_urls: MagicMock,
mock_run_checker: MagicMock,
) -> None:
mock_collect.return_value = _vhosts("auth.infinito.test", "auth.abc123.onion")
mock_collect.return_value = _vhosts(f"auth.{DOMAIN}", "auth.abc123.onion")
mock_build_urls.side_effect = lambda _vhosts, domains: [
f"http://{d}/" for d in domains
]
@@ -274,7 +277,7 @@ class TestMainTimesOutOnionsOnly(unittest.TestCase):
for call in mock_run_checker.call_args_list
}
self.assertEqual(budgets["http://auth.abc123.onion/"], 100000)
self.assertEqual(budgets["http://auth.infinito.test/"], 0)
self.assertEqual(budgets[f"http://auth.{DOMAIN}/"], 0)
class TestDetectSchemeFromConf(unittest.TestCase):
tests/unit/python/roles/sys-ctl-hlth-csp/test_accept_status_reaches_onions.py
+9 -8
View File
@@ -1,11 +1,14 @@
import importlib.util
import unittest
from utils.domains.default_primary import default_domain_primary
from . import PROJECT_ROOT
SCRIPT = PROJECT_ROOT / "roles" / "sys-ctl-hlth-csp" / "files" / "python" / "script.py"
ONION = "mirror.b5abfs7uwr23x6vbjxqjatyscpmkm6qkmkla7eyapdi4zpwtrz6o4nqd.onion"
DOMAINS = ["mirror.infinito.test", ONION, "html.infinito.test"]
DOMAIN = default_domain_primary()
DOMAINS = [f"mirror.{DOMAIN}", ONION, f"html.{DOMAIN}"]
def _expand(accept_status, domains=None):
@@ -19,7 +22,7 @@ def _expand(accept_status, domains=None):
class TestAcceptStatusReachesOnions(unittest.TestCase):
def test_the_onion_sibling_inherits_the_declaration(self):
expanded = _expand(["mirror.infinito.test=404"])
expanded = _expand([f"mirror.{DOMAIN}=404"])
self.assertIn(
f"{ONION}=404",
@@ -29,12 +32,10 @@ class TestAcceptStatusReachesOnions(unittest.TestCase):
)
def test_a_vhost_without_an_onion_twin_gains_nothing(self):
self.assertEqual(
_expand(["html.infinito.test=403"]), ["html.infinito.test=403"]
)
self.assertEqual(_expand([f"html.{DOMAIN}=403"]), [f"html.{DOMAIN}=403"])
def test_several_codes_carry_over_unchanged(self):
expanded = _expand(["mirror.infinito.test=301,302,404"])
expanded = _expand([f"mirror.{DOMAIN}=301,302,404"])
self.assertIn(f"{ONION}=301,302,404", expanded)
@@ -42,10 +43,10 @@ class TestAcceptStatusReachesOnions(unittest.TestCase):
self.assertEqual(_expand([f"{ONION}=404"]), [f"{ONION}=404"])
def test_an_entry_without_codes_is_left_alone(self):
self.assertEqual(_expand(["mirror.infinito.test"]), ["mirror.infinito.test"])
self.assertEqual(_expand([f"mirror.{DOMAIN}"]), [f"mirror.{DOMAIN}"])
def test_only_the_matching_label_is_extended(self):
expanded = _expand(["html.infinito.test=403", "mirror.infinito.test=404"])
expanded = _expand([f"html.{DOMAIN}=403", f"mirror.{DOMAIN}=404"])
self.assertEqual(
[e for e in expanded if e.endswith(".onion=404")], [f"{ONION}=404"]
tests/unit/python/roles/sys-ctl-hlth-webserver/filter_plugins/test_web_health_expectations.py
+29 -29
View File
@@ -3,6 +3,10 @@ import unittest
from pathlib import Path
from unittest.mock import patch
from utils.domains.default_primary import default_domain_primary
DOMAIN = default_domain_primary()
def load_module_from_path(mod_name: str, path: str):
"""Dynamically load a module from a filesystem path."""
@@ -562,7 +566,7 @@ class TestWebHealthExpectationsFilter(unittest.TestCase):
def _app_a(self, canonical=None, status_codes=None, aliases=None):
returns = {
("app-a", "domains.canonical"): (
["a.infinito.test"] if canonical is None else canonical
[f"a.{DOMAIN}"] if canonical is None else canonical
),
}
if status_codes is not None:
@@ -576,7 +580,7 @@ class TestWebHealthExpectationsFilter(unittest.TestCase):
return self.mod.web_health_expectations(
apps,
group_names=list(apps),
primary_domain="infinito.test",
primary_domain=DOMAIN,
node_onion=self.ONION,
served_domains=served,
)
@@ -586,13 +590,11 @@ class TestWebHealthExpectationsFilter(unittest.TestCase):
self.assertEqual(out, {f"a.{self.ONION}": [200, 302, 301]})
def test_served_multi_lists_both_networks(self):
out = self._served(
self._app_a(), {"app-a": ["a.infinito.test", f"a.{self.ONION}"]}
)
out = self._served(self._app_a(), {"app-a": [f"a.{DOMAIN}", f"a.{self.ONION}"]})
self.assertEqual(
out,
{
"a.infinito.test": [200, 302, 301],
f"a.{DOMAIN}": [200, 302, 301],
f"a.{self.ONION}": [200, 302, 301],
},
)
@@ -600,32 +602,32 @@ class TestWebHealthExpectationsFilter(unittest.TestCase):
def test_served_onion_inherits_clearnet_status_codes(self):
out = self._served(
self._app_a(
canonical={"default": ["a.infinito.test"]},
canonical={"default": [f"a.{DOMAIN}"]},
status_codes={"default": [301, 200]},
),
{
"app-a": {
"default": "a.infinito.test",
"default": f"a.{DOMAIN}",
"default_onion": f"a.{self.ONION}",
}
},
)
self.assertEqual(
out, {"a.infinito.test": [301, 200], f"a.{self.ONION}": [301, 200]}
out, {f"a.{DOMAIN}": [301, 200], f"a.{self.ONION}": [301, 200]}
)
def test_aliases_survive_the_served_view(self):
out = self._served(
self._app_a(aliases=["old.infinito.test"]), {"app-a": [f"a.{self.ONION}"]}
self._app_a(aliases=[f"old.{DOMAIN}"]), {"app-a": [f"a.{self.ONION}"]}
)
self.assertEqual(
out,
{f"a.{self.ONION}": [200, 302, 301], "old.infinito.test": [301]},
{f"a.{self.ONION}": [200, 302, 301], f"old.{DOMAIN}": [301]},
)
def test_app_missing_from_served_keeps_declared_domains(self):
out = self._served(self._app_a(), {})
self.assertEqual(out, {"a.infinito.test": [200, 302, 301]})
self.assertEqual(out, {f"a.{DOMAIN}": [200, 302, 301]})
def test_www_is_added_for_clearnet_only(self):
apps = self._app_a()
@@ -633,23 +635,23 @@ class TestWebHealthExpectationsFilter(unittest.TestCase):
apps,
www_enabled=True,
group_names=["app-a"],
primary_domain="infinito.test",
primary_domain=DOMAIN,
node_onion=self.ONION,
served_domains={"app-a": ["a.infinito.test", f"a.{self.ONION}"]},
served_domains={"app-a": [f"a.{DOMAIN}", f"a.{self.ONION}"]},
)
self.assertIn("www.a.infinito.test", out)
self.assertIn(f"www.a.{DOMAIN}", out)
self.assertNotIn(f"www.a.{self.ONION}", out)
def test_targets_use_the_per_domain_scheme_and_network_timeout(self):
served = {"app-a": ["a.infinito.test", f"a.{self.ONION}"]}
served = {"app-a": [f"a.{DOMAIN}", f"a.{self.ONION}"]}
targets = self.mod.web_health_targets(
{"a.infinito.test": [200], f"a.{self.ONION}": [200]},
{f"a.{DOMAIN}": [200], f"a.{self.ONION}": [200]},
{"app-a": {}},
served,
True,
)
self.assertEqual(
targets["a.infinito.test"],
targets[f"a.{DOMAIN}"],
{"codes": [200], "scheme": "https", "timeout": 10},
)
self.assertEqual(
@@ -659,12 +661,12 @@ class TestWebHealthExpectationsFilter(unittest.TestCase):
def test_targets_follow_an_app_tls_override(self):
targets = self.mod.web_health_targets(
{"a.infinito.test": [200]},
{f"a.{DOMAIN}": [200]},
{"app-a": {"server": {"tls": {"enabled": False}}}},
{"app-a": ["a.infinito.test"]},
{"app-a": [f"a.{DOMAIN}"]},
True,
)
self.assertEqual(targets["a.infinito.test"]["scheme"], "http")
self.assertEqual(targets[f"a.{DOMAIN}"]["scheme"], "http")
def test_targets_of_an_unknown_domain_use_the_global_default(self):
targets = self.mod.web_health_targets(
@@ -675,16 +677,14 @@ class TestWebHealthExpectationsFilter(unittest.TestCase):
# --------- Reverse-proxy bare apex gating ---------
def _proxy_apex_app(self):
self._configure_returns(
{("svc-prx-openresty", "domains.canonical"): ["infinito.test"]}
)
self._configure_returns({("svc-prx-openresty", "domains.canonical"): [DOMAIN]})
return {"svc-prx-openresty": {}}
def test_apex_dropped_when_rdr_domains_not_deployed(self):
out = self.mod.web_health_expectations(
self._proxy_apex_app(),
group_names=["svc-prx-openresty"],
primary_domain="infinito.test",
primary_domain=DOMAIN,
)
self.assertEqual(out, {})
@@ -692,17 +692,17 @@ class TestWebHealthExpectationsFilter(unittest.TestCase):
out = self.mod.web_health_expectations(
self._proxy_apex_app(),
group_names=["svc-prx-openresty", "web-opt-rdr-domains"],
primary_domain="infinito.test",
primary_domain=DOMAIN,
)
self.assertEqual(out, {"infinito.test": [200, 302, 301]})
self.assertEqual(out, {DOMAIN: [200, 302, 301]})
def test_onion_apex_dropped_when_rdr_domains_not_deployed(self):
out = self.mod.web_health_expectations(
self._proxy_apex_app(),
group_names=["svc-prx-openresty"],
primary_domain="infinito.test",
primary_domain=DOMAIN,
node_onion=self.ONION,
served_domains={"svc-prx-openresty": ["infinito.test", self.ONION]},
served_domains={"svc-prx-openresty": [DOMAIN, self.ONION]},
)
self.assertEqual(out, {})
tests/unit/python/roles/sys-svc-container/test_sandbox_runtime.py
+3 -1
View File
@@ -6,8 +6,10 @@ from types import SimpleNamespace
from jinja2 import Environment, FileSystemLoader, StrictUndefined, select_autoescape
from utils import PROJECT_ROOT
from utils.domains.default_primary import default_domain_primary
TEMPLATES = Path(PROJECT_ROOT) / "roles" / "sys-svc-container" / "templates"
DOMAIN = default_domain_primary()
def _ansible_bool(value):
@@ -37,7 +39,7 @@ BASE = {
"DEPLOYMENT_MODE": "swarm",
"IS_STACK_HOST": False,
"DOCKER_IN_CONTAINER": True,
"DOMAIN_PRIMARY": "infinito.test",
"DOMAIN_PRIMARY": DOMAIN,
"KATA_SHIM_BINARY": "/usr/bin/containerd-shim-kata-v2",
"RUNSC_SHIM_BINARY": "/usr/local/bin/runsc",
"SANDBOX_RUNTIME": "runsc",
tests/unit/python/roles/sys-svc-mail-msmtp/test_msmtprc_ca_trust.py
+4 -2
View File
@@ -19,6 +19,7 @@ import unittest
from jinja2 import Environment, StrictUndefined
from utils.cache.files import read_text
from utils.domains.default_primary import default_domain_primary
from . import PROJECT_ROOT
@@ -27,14 +28,15 @@ TEMPLATE = (
)
CA_CONTAINER = "/tmp/infinito/ca/root-ca.crt" # nocheck: S108 - CA_TRUST.inject_cert_container, a container path
CA_BUNDLE_CONTAINER = "/tmp/infinito/ca/ca-bundle.crt" # nocheck: S108 - CA_TRUST.inject_bundle_container, a container path
DOMAIN = default_domain_primary()
EMAIL = {
"timeout": 30,
"auth_mechanism": "PLAIN",
"start_tls": True,
"tls": True,
"host": "mail.infinito.test",
"host": f"mail.{DOMAIN}",
"port": 587,
"from": "no-reply@infinito.test",
"from": f"no-reply@{DOMAIN}",
"auth": False,
}
tests/unit/python/roles/web-app-baserow/files/sso/test_infinito_sso.py
+6 -3
View File
@@ -7,14 +7,17 @@ import unittest
from types import ModuleType, SimpleNamespace
from unittest.mock import MagicMock, patch
from utils.domains.default_primary import default_domain_primary
from . import PROJECT_ROOT
MODULE_PATH = PROJECT_ROOT / "roles/web-app-baserow/files/sso/infinito_sso.py"
HOSTNAME = "baserow.infinito.test"
DOMAIN = default_domain_primary()
HOSTNAME = f"baserow.{DOMAIN}"
SSO_ON = {"PROXY_HEADER_SSO": "true"}
IDENTITY = {
"username": "alice",
"email": "alice@baserow.infinito.test",
"email": f"alice@baserow.{DOMAIN}",
"name": "Alice Smith",
"is_admin": False,
}
@@ -239,7 +242,7 @@ class TestFallbackDomain(unittest.TestCase):
self.assertEqual(mod._fallback_domain(), HOSTNAME)
def test_strips_scheme_and_path_from_a_url_shaped_hostname(self):
mod = _load_module(hostname="https://baserow.infinito.test/app")
mod = _load_module(hostname=f"https://baserow.{DOMAIN}/app")
with patch.dict(os.environ, {}, clear=True):
self.assertEqual(mod._fallback_domain(), HOSTNAME)
tests/unit/python/roles/web-app-bigbluebutton/filter_plugins/test_compose_mods.py
+7 -4
View File
@@ -17,6 +17,9 @@ sys.path.insert(
from compose_mods import compose_mods
from utils.cache.yaml import load_yaml_str
from utils.domains.default_primary import default_domain_primary
DOMAIN = default_domain_primary()
def sort_dict(obj):
@@ -146,21 +149,21 @@ services:
original,
self.compose_repository_path,
self.env_file,
extra_hosts=["auth.infinito.test:host-gateway"],
extra_hosts=[f"auth.{DOMAIN}:host-gateway"],
)
)
services = data["services"]
self.assertIn(
"auth.infinito.test:host-gateway", services["greenlight"]["extra_hosts"]
f"auth.{DOMAIN}:host-gateway", services["greenlight"]["extra_hosts"]
)
self.assertNotIn("extra_hosts", services["freeswitch"])
self.assertEqual(
services["nginx"]["extra_hosts"],
["existing.example:1.2.3.4", "auth.infinito.test:host-gateway"],
["existing.example:1.2.3.4", f"auth.{DOMAIN}:host-gateway"],
)
self.assertEqual(
services["etherpad"]["extra_hosts"],
["mapped.example:5.6.7.8", "auth.infinito.test:host-gateway"],
["mapped.example:5.6.7.8", f"auth.{DOMAIN}:host-gateway"],
)
def test_extra_hosts_absent_without_kwarg(self):
tests/unit/python/roles/web-app-bookwyrm/files/sso/test_header_auth.py
+4 -1
View File
@@ -6,10 +6,13 @@ import unittest
from types import ModuleType, SimpleNamespace
from unittest.mock import MagicMock
from utils.domains.default_primary import default_domain_primary
from . import PROJECT_ROOT
MODULE_PATH = PROJECT_ROOT / "roles/web-app-bookwyrm/files/sso/header_auth.py"
DOMAIN = "book.infinito.test"
DOMAIN_PRIMARY = default_domain_primary()
DOMAIN = f"book.{DOMAIN_PRIMARY}"
class _FakeMiddlewareBase:
tests/unit/python/scripts/tests/deploy/ci/test_dns53_sampler.py
+4 -2
View File
@@ -14,8 +14,10 @@ import unittest
from pathlib import Path
from utils.cache.files import PROJECT_ROOT
from utils.domains.default_primary import default_domain_primary
SAMPLER = PROJECT_ROOT / "scripts" / "tests" / "deploy" / "ci" / "dns53-sampler.sh"
DOMAIN = default_domain_primary()
HEADER = (
" sl local_address rem_address st tx_queue rx_queue tr tm->when "
@@ -107,8 +109,8 @@ class ZoneProbeNameTests(unittest.TestCase):
def test_the_owned_zone_becomes_a_probe_name(self):
self.assertEqual(
self._zone("no-resolv\naddress=/infinito.test/192.168.244.10\n"),
"rescue-probe.infinito.test",
self._zone(f"no-resolv\naddress=/{DOMAIN}/192.168.244.10\n"),
f"rescue-probe.{DOMAIN}",
)
def test_a_config_without_a_zone_yields_nothing(self):
tests/unit/python/utils/cache/test_base.py
Vendored
+7 -4
View File
@@ -16,8 +16,11 @@ import unittest
from pathlib import Path
from utils.cache import _reset_cache_for_tests, base
from utils.domains.default_primary import default_domain_primary
from utils.paths import FILE_TOKENS
DOMAIN = default_domain_primary()
def _write(path: Path, content: str) -> None:
path.parent.mkdir(parents=True, exist_ok=True)
@@ -144,12 +147,12 @@ class TestStableVariablesSignature(unittest.TestCase):
sig = base._stable_variables_signature(
{
"applications": {"web-app-x": {}},
"DOMAIN_PRIMARY": "infinito.test",
"SYSTEM_EMAIL_DOMAIN": "mail.infinito.test",
"DOMAIN_PRIMARY": DOMAIN,
"SYSTEM_EMAIL_DOMAIN": f"mail.{DOMAIN}",
}
)
self.assertEqual(sig[2], "infinito.test")
self.assertEqual(sig[3], "mail.infinito.test")
self.assertEqual(sig[2], DOMAIN)
self.assertEqual(sig[3], f"mail.{DOMAIN}")
class TestTokensFileSignature(unittest.TestCase):
tests/unit/python/utils/cache/test_domains.py
Vendored
+26 -23
View File
@@ -19,10 +19,13 @@ from unittest.mock import patch
from utils.cache import _reset_cache_for_tests
from utils.cache import domains as cache_domains
from utils.cache.base import _RENDER_GUARD
from utils.domains.default_primary import default_domain_primary
from utils.roles.mapping import ROLE_FILE_META_SERVICES, ROLE_FILE_META_USERS
from . import PROJECT_ROOT
DOMAIN = default_domain_primary()
def _write(path: Path, content: str) -> None:
path.parent.mkdir(parents=True, exist_ok=True)
@@ -65,7 +68,7 @@ class TestMissingPrimaryDomain(unittest.TestCase):
return_value={},
):
result = cache_domains.get_merged_domains(
variables={"SYSTEM_EMAIL_DOMAIN": "infinito.test"},
variables={"SYSTEM_EMAIL_DOMAIN": DOMAIN},
roles_dir=roles,
templar=None,
)
@@ -84,12 +87,12 @@ class TestCachingPerVariablesSignature(unittest.TestCase):
return_value={},
) as mocked:
first = cache_domains.get_merged_domains(
variables={"DOMAIN_PRIMARY": "infinito.test"},
variables={"DOMAIN_PRIMARY": DOMAIN},
roles_dir=roles,
templar=None,
)
second = cache_domains.get_merged_domains(
variables={"DOMAIN_PRIMARY": "infinito.test"},
variables={"DOMAIN_PRIMARY": DOMAIN},
roles_dir=roles,
templar=None,
)
@@ -120,7 +123,7 @@ class TestCachingPerVariablesSignature(unittest.TestCase):
map must not answer a later read; it may still serve the render."""
with tempfile.TemporaryDirectory() as tmp:
roles = _seed_minimal_role(Path(tmp))
variables = {"DOMAIN_PRIMARY": "infinito.test"}
variables = {"DOMAIN_PRIMARY": DOMAIN}
with patch(
"utils.cache.applications.get_merged_applications",
return_value={},
@@ -157,7 +160,7 @@ class TestResetClearsDomainsCache(unittest.TestCase):
return_value={},
):
cache_domains.get_merged_domains(
variables={"DOMAIN_PRIMARY": "infinito.test"},
variables={"DOMAIN_PRIMARY": DOMAIN},
roles_dir=roles,
templar=None,
)
@@ -220,9 +223,9 @@ class TestNetworkSiblingInjection(unittest.TestCase):
def _inject(self, apps, node_mode, *, domains=None, deployed=("web-app-x",)):
return cache_domains._inject_network_siblings(
{"web-app-x": domains if domains is not None else ["x.infinito.test"]},
{"web-app-x": domains if domains is not None else [f"x.{DOMAIN}"]},
apps,
"infinito.test",
DOMAIN,
self.ONION,
node_mode,
deployed=list(deployed),
@@ -231,7 +234,7 @@ class TestNetworkSiblingInjection(unittest.TestCase):
def test_multi_appends_onion_after_clearnet(self):
self.assertEqual(
self._inject(self._apps(), "multi"),
["x.infinito.test", f"x.{self.ONION}"],
[f"x.{DOMAIN}", f"x.{self.ONION}"],
)
def test_tor_mode_replaces_clearnet(self):
@@ -239,12 +242,12 @@ class TestNetworkSiblingInjection(unittest.TestCase):
def test_clearnet_mode_is_untouched(self):
self.assertEqual(
self._inject(self._apps(enabled=False), "clearnet"), ["x.infinito.test"]
self._inject(self._apps(enabled=False), "clearnet"), [f"x.{DOMAIN}"]
)
def test_clearnet_mode_never_renders_the_tor_flag(self):
apps = self._apps(enabled="{{ 'svc-net-tor' in group_names }}")
self.assertEqual(self._inject(apps, "clearnet"), ["x.infinito.test"])
self.assertEqual(self._inject(apps, "clearnet"), [f"x.{DOMAIN}"])
def test_tor_only_role_on_clearnet_node_fails_loudly(self):
with self.assertRaisesRegex(ValueError, "web-app-x"):
@@ -257,17 +260,17 @@ class TestNetworkSiblingInjection(unittest.TestCase):
def test_clearnet_only_role_on_multi_stays_clearnet(self):
self.assertEqual(
self._inject(self._apps(modes=["clearnet"]), "multi"), ["x.infinito.test"]
self._inject(self._apps(modes=["clearnet"]), "multi"), [f"x.{DOMAIN}"]
)
def test_disabled_tor_bond_on_multi_stays_clearnet(self):
self.assertEqual(
self._inject(self._apps(enabled=False), "multi"), ["x.infinito.test"]
self._inject(self._apps(enabled=False), "multi"), [f"x.{DOMAIN}"]
)
def test_role_without_tor_bond_is_exempt_on_tor_node(self):
apps = {"web-app-x": {"services": {}}}
self.assertEqual(self._inject(apps, "tor"), ["x.infinito.test"])
self.assertEqual(self._inject(apps, "tor"), [f"x.{DOMAIN}"])
def test_deployed_mismatch_fails_loudly(self):
with self.assertRaisesRegex(ValueError, "web-app-x"):
@@ -276,24 +279,24 @@ class TestNetworkSiblingInjection(unittest.TestCase):
def test_undeployed_mismatch_keeps_domains(self):
self.assertEqual(
self._inject(self._apps(modes=["clearnet"]), "tor", deployed=()),
["x.infinito.test"],
[f"x.{DOMAIN}"],
)
def test_bare_primary_domain_maps_to_node_onion(self):
self.assertEqual(
self._inject(self._apps(), "multi", domains=["infinito.test"]),
["infinito.test", self.ONION],
self._inject(self._apps(), "multi", domains=[DOMAIN]),
[DOMAIN, self.ONION],
)
def test_named_canonicals_gain_onion_keys_after_clearnet(self):
self.assertEqual(
self._inject(self._apps(), "multi", domains={"api": "api.infinito.test"}),
{"api": "api.infinito.test", "api_onion": f"api.{self.ONION}"},
self._inject(self._apps(), "multi", domains={"api": f"api.{DOMAIN}"}),
{"api": f"api.{DOMAIN}", "api_onion": f"api.{self.ONION}"},
)
def test_named_canonicals_in_tor_mode_swap_values(self):
self.assertEqual(
self._inject(self._apps(), "tor", domains={"api": "api.infinito.test"}),
self._inject(self._apps(), "tor", domains={"api": f"api.{DOMAIN}"}),
{"api": f"api.{self.ONION}"},
)
@@ -336,9 +339,9 @@ class TestTorFlagsAreRendered(unittest.TestCase):
def _inject(self, templar, **variables):
return cache_domains._inject_network_siblings(
{"web-app-x": ["x.infinito.test"]},
{"web-app-x": [f"x.{DOMAIN}"]},
{"web-app-x": {"services": {"tor": {"enabled": self.JINJA_ON}}}},
"infinito.test",
DOMAIN,
self.ONION,
"multi",
templar=templar,
@@ -349,14 +352,14 @@ class TestTorFlagsAreRendered(unittest.TestCase):
variables = {"group_names": ["svc-net-tor", "web-app-x"]}
self.assertEqual(
self._inject(self._templar(**variables), **variables),
["x.infinito.test", f"x.{self.ONION}"],
[f"x.{DOMAIN}", f"x.{self.ONION}"],
)
def test_a_templated_flag_resolving_false_leaves_the_clearnet_domain(self):
variables = {"group_names": ["web-app-x"]}
self.assertEqual(
self._inject(self._templar(**variables), **variables),
["x.infinito.test"],
[f"x.{DOMAIN}"],
)
def test_a_flag_that_cannot_be_rendered_is_an_error(self):
tests/unit/python/utils/cache/users/test_module.py
Vendored
+5 -2
View File
@@ -21,8 +21,11 @@ from utils.cache import _reset_cache_for_tests
from utils.cache import base as cache_base
from utils.cache import users as cache_users
from utils.cache.yaml import dump_yaml_str
from utils.domains.default_primary import default_domain_primary
from utils.roles.mapping import ROLE_FILE_META_SERVICES, ROLE_FILE_META_USERS
DOMAIN = default_domain_primary()
def _write(path: Path, content: str) -> None:
path.parent.mkdir(parents=True, exist_ok=True)
@@ -310,10 +313,10 @@ class TestMaterializeBuiltinUserAliases(unittest.TestCase):
}
out = cache_users._materialize_builtin_user_aliases(
users,
variables={"DOMAIN_PRIMARY": "infinito.test"},
variables={"DOMAIN_PRIMARY": DOMAIN},
templar=None,
)
self.assertEqual(out["sld"]["username"], "infinito")
self.assertEqual(out["sld"]["username"], DOMAIN.split(".", maxsplit=1)[0])
class TestGetUserDefaults(unittest.TestCase):
tests/unit/python/utils/cache/users/test_placeholders.py
Vendored
+20 -17
View File
@@ -26,6 +26,9 @@ from utils.cache.users.placeholders import (
substitute_primary_domain_placeholder,
substitute_scalar_placeholders,
)
from utils.domains.default_primary import default_domain_primary
DOMAIN = default_domain_primary()
class _StubTemplar:
@@ -54,28 +57,28 @@ class TestSubstitutePrimaryDomainPlaceholder(unittest.TestCase):
users = _user_dict(email="admin@{{ DOMAIN_PRIMARY }}")
out = substitute_primary_domain_placeholder(
users,
{"DOMAIN_PRIMARY": "infinito.test"},
templar=_StubTemplar({"DOMAIN_PRIMARY": "infinito.test"}),
{"DOMAIN_PRIMARY": DOMAIN},
templar=_StubTemplar({"DOMAIN_PRIMARY": DOMAIN}),
)
self.assertEqual(out["administrator"]["email"], "admin@infinito.test")
self.assertEqual(out["administrator"]["email"], f"admin@{DOMAIN}")
def test_extracts_host_from_url(self) -> None:
users = _user_dict(email="admin@{{ DOMAIN_PRIMARY }}")
out = substitute_primary_domain_placeholder(
users,
{"DOMAIN_PRIMARY": "https://infinito.test/path"},
templar=_StubTemplar({"DOMAIN_PRIMARY": "https://infinito.test/path"}),
{"DOMAIN_PRIMARY": f"https://{DOMAIN}/path"},
templar=_StubTemplar({"DOMAIN_PRIMARY": f"https://{DOMAIN}/path"}),
)
self.assertEqual(out["administrator"]["email"], "admin@infinito.test")
self.assertEqual(out["administrator"]["email"], f"admin@{DOMAIN}")
def test_strips_port(self) -> None:
users = _user_dict(email="admin@{{ DOMAIN_PRIMARY }}")
out = substitute_primary_domain_placeholder(
users,
{"DOMAIN_PRIMARY": "infinito.test:8443"},
templar=_StubTemplar({"DOMAIN_PRIMARY": "infinito.test:8443"}),
{"DOMAIN_PRIMARY": f"{DOMAIN}:8443"},
templar=_StubTemplar({"DOMAIN_PRIMARY": f"{DOMAIN}:8443"}),
)
self.assertEqual(out["administrator"]["email"], "admin@infinito.test")
self.assertEqual(out["administrator"]["email"], f"admin@{DOMAIN}")
def test_returns_unchanged_when_var_missing(self) -> None:
users = _user_dict(email="admin@{{ DOMAIN_PRIMARY }}")
@@ -95,16 +98,16 @@ class TestSubstitutePrimaryDomainPlaceholder(unittest.TestCase):
users,
{
"DOMAIN_PRIMARY": "{{ SOFTWARE_DOMAIN }}",
"SOFTWARE_DOMAIN": "infinito.test",
"SOFTWARE_DOMAIN": DOMAIN,
},
templar=_StubTemplar(
{
"DOMAIN_PRIMARY": "{{ SOFTWARE_DOMAIN }}",
"SOFTWARE_DOMAIN": "infinito.test",
"SOFTWARE_DOMAIN": DOMAIN,
}
),
)
self.assertEqual(out["administrator"]["email"], "admin@infinito.test")
self.assertEqual(out["administrator"]["email"], f"admin@{DOMAIN}")
def test_walks_nested_structures(self) -> None:
users = {
@@ -119,13 +122,13 @@ class TestSubstitutePrimaryDomainPlaceholder(unittest.TestCase):
}
out = substitute_primary_domain_placeholder(
users,
{"DOMAIN_PRIMARY": "infinito.test"},
templar=_StubTemplar({"DOMAIN_PRIMARY": "infinito.test"}),
{"DOMAIN_PRIMARY": DOMAIN},
templar=_StubTemplar({"DOMAIN_PRIMARY": DOMAIN}),
)
nested = out["administrator"]
self.assertEqual(nested["addresses"][0], "admin@infinito.test")
self.assertEqual(nested["addresses"][1]["alt"], "root@infinito.test")
self.assertEqual(nested["primary"], ("primary@infinito.test",))
self.assertEqual(nested["addresses"][0], f"admin@{DOMAIN}")
self.assertEqual(nested["addresses"][1]["alt"], f"root@{DOMAIN}")
self.assertEqual(nested["primary"], (f"primary@{DOMAIN}",))
class TestSubstituteScalarPlaceholders(unittest.TestCase):
tests/unit/python/utils/cleanup/test_nginx_vhosts.py
+46 -43
View File
@@ -18,9 +18,12 @@ from utils.cleanup.nginx_vhosts import (
main,
purge_vhost_files_for_entities,
)
from utils.domains.default_primary import default_domain_primary
from utils.roles.categories import categories_file
from utils.roles.mapping import ROLE_FILE_META_DOMAINS, ROLE_FILE_VARS_MAIN
DOMAIN_PRIMARY = default_domain_primary()
class NginxVhostsTestBase(unittest.TestCase):
def setUp(self) -> None:
@@ -82,15 +85,15 @@ class TestIterVhostFiles(NginxVhostsTestBase, unittest.TestCase):
self._mk_role(
"web-app-matomo",
application_id="web-app-matomo",
canonical=["matomo.infinito.test"],
canonical=[f"matomo.{DOMAIN_PRIMARY}"],
)
existing = self._touch_vhost("matomo.infinito.test", "https")
existing = self._touch_vhost(f"matomo.{DOMAIN_PRIMARY}", "https")
got = list(
iter_vhost_files_for_entity(
"matomo",
nginx_dir=self.nginx_dir,
domain_primary="infinito.test",
domain_primary=DOMAIN_PRIMARY,
roles_dir=self.roles_dir,
)
)
@@ -100,17 +103,17 @@ class TestIterVhostFiles(NginxVhostsTestBase, unittest.TestCase):
self._mk_role(
"web-app-matomo",
application_id="web-app-matomo",
canonical=["matomo.infinito.test"],
aliases=["stats.infinito.test"],
canonical=[f"matomo.{DOMAIN_PRIMARY}"],
aliases=[f"stats.{DOMAIN_PRIMARY}"],
)
f1 = self._touch_vhost("matomo.infinito.test", "https")
f2 = self._touch_vhost("stats.infinito.test", "https")
f1 = self._touch_vhost(f"matomo.{DOMAIN_PRIMARY}", "https")
f2 = self._touch_vhost(f"stats.{DOMAIN_PRIMARY}", "https")
got = sorted(
iter_vhost_files_for_entity(
"matomo",
nginx_dir=self.nginx_dir,
domain_primary="infinito.test",
domain_primary=DOMAIN_PRIMARY,
roles_dir=self.roles_dir,
)
)
@@ -120,15 +123,15 @@ class TestIterVhostFiles(NginxVhostsTestBase, unittest.TestCase):
self._mk_role(
"web-app-matomo",
application_id="web-app-matomo",
canonical=["matomo.infinito.test"],
canonical=[f"matomo.{DOMAIN_PRIMARY}"],
)
self._touch_vhost("matomo.infinito.test", "https")
self._touch_vhost(f"matomo.{DOMAIN_PRIMARY}", "https")
got = list(
iter_vhost_files_for_entity(
"no-such-entity",
nginx_dir=self.nginx_dir,
domain_primary="infinito.test",
domain_primary=DOMAIN_PRIMARY,
roles_dir=self.roles_dir,
)
)
@@ -138,16 +141,16 @@ class TestIterVhostFiles(NginxVhostsTestBase, unittest.TestCase):
self._mk_role(
"web-svc-cdn",
application_id="web-svc-cdn",
canonical=["cdn.infinito.test"],
canonical=[f"cdn.{DOMAIN_PRIMARY}"],
)
bare = self._touch_vhost("cdn.infinito.test", "https")
redirect = self._touch_vhost("www.cdn.infinito.test", "https")
bare = self._touch_vhost(f"cdn.{DOMAIN_PRIMARY}", "https")
redirect = self._touch_vhost(f"www.cdn.{DOMAIN_PRIMARY}", "https")
got = sorted(
iter_vhost_files_for_entity(
"cdn",
nginx_dir=self.nginx_dir,
domain_primary="infinito.test",
domain_primary=DOMAIN_PRIMARY,
roles_dir=self.roles_dir,
)
)
@@ -157,16 +160,16 @@ class TestIterVhostFiles(NginxVhostsTestBase, unittest.TestCase):
self._mk_role(
"web-opt-rdr-www",
application_id="web-opt-rdr-www",
canonical=["www.w3redirect.infinito.test"],
canonical=[f"www.w3redirect.{DOMAIN_PRIMARY}"],
)
existing = self._touch_vhost("www.w3redirect.infinito.test", "https")
self._touch_vhost("www.www.w3redirect.infinito.test", "https")
existing = self._touch_vhost(f"www.w3redirect.{DOMAIN_PRIMARY}", "https")
self._touch_vhost(f"www.www.w3redirect.{DOMAIN_PRIMARY}", "https")
got = list(
iter_vhost_files_for_entity(
"opt-rdr-www",
nginx_dir=self.nginx_dir,
domain_primary="infinito.test",
domain_primary=DOMAIN_PRIMARY,
roles_dir=self.roles_dir,
)
)
@@ -178,22 +181,22 @@ class TestPurgeVhostFiles(NginxVhostsTestBase, unittest.TestCase):
self._mk_role(
"web-app-matomo",
application_id="web-app-matomo",
canonical=["matomo.infinito.test"],
canonical=[f"matomo.{DOMAIN_PRIMARY}"],
)
self._mk_role(
"web-app-dashboard",
application_id="web-app-dashboard",
canonical=["dashboard.infinito.test"],
canonical=[f"dashboard.{DOMAIN_PRIMARY}"],
)
matomo_https = self._touch_vhost("matomo.infinito.test", "https")
dashboard_https = self._touch_vhost("dashboard.infinito.test", "https")
unrelated = self._touch_vhost("unrelated.infinito.test", "https")
matomo_https = self._touch_vhost(f"matomo.{DOMAIN_PRIMARY}", "https")
dashboard_https = self._touch_vhost(f"dashboard.{DOMAIN_PRIMARY}", "https")
unrelated = self._touch_vhost(f"unrelated.{DOMAIN_PRIMARY}", "https")
removed = purge_vhost_files_for_entities(
["dashboard"],
nginx_dir=self.nginx_dir,
domain_primary="infinito.test",
domain_primary=DOMAIN_PRIMARY,
roles_dir=self.roles_dir,
)
@@ -206,13 +209,13 @@ class TestPurgeVhostFiles(NginxVhostsTestBase, unittest.TestCase):
self._mk_role(
"web-app-matomo",
application_id="web-app-matomo",
canonical=["matomo.infinito.test"],
canonical=[f"matomo.{DOMAIN_PRIMARY}"],
)
removed = purge_vhost_files_for_entities(
["matomo"],
nginx_dir=self.nginx_dir,
domain_primary="infinito.test",
domain_primary=DOMAIN_PRIMARY,
roles_dir=self.roles_dir,
)
self.assertEqual(removed, [])
@@ -221,17 +224,17 @@ class TestPurgeVhostFiles(NginxVhostsTestBase, unittest.TestCase):
self._mk_role(
"web-svc-cdn",
application_id="web-svc-cdn",
canonical=["cdn.infinito.test"],
canonical=[f"cdn.{DOMAIN_PRIMARY}"],
)
bare = self._touch_vhost("cdn.infinito.test", "https")
redirect = self._touch_vhost("www.cdn.infinito.test", "https")
unrelated = self._touch_vhost("www.unrelated.infinito.test", "https")
bare = self._touch_vhost(f"cdn.{DOMAIN_PRIMARY}", "https")
redirect = self._touch_vhost(f"www.cdn.{DOMAIN_PRIMARY}", "https")
unrelated = self._touch_vhost(f"www.unrelated.{DOMAIN_PRIMARY}", "https")
removed = sorted(
purge_vhost_files_for_entities(
["cdn"],
nginx_dir=self.nginx_dir,
domain_primary="infinito.test",
domain_primary=DOMAIN_PRIMARY,
roles_dir=self.roles_dir,
)
)
@@ -245,22 +248,22 @@ class TestPurgeVhostFiles(NginxVhostsTestBase, unittest.TestCase):
self._mk_role(
"web-app-matomo",
application_id="web-app-matomo",
canonical=["matomo.infinito.test"],
canonical=[f"matomo.{DOMAIN_PRIMARY}"],
)
self._mk_role(
"web-app-dashboard",
application_id="web-app-dashboard",
canonical=["dashboard.infinito.test"],
canonical=[f"dashboard.{DOMAIN_PRIMARY}"],
)
matomo_https = self._touch_vhost("matomo.infinito.test", "https")
dashboard_https = self._touch_vhost("dashboard.infinito.test", "https")
matomo_https = self._touch_vhost(f"matomo.{DOMAIN_PRIMARY}", "https")
dashboard_https = self._touch_vhost(f"dashboard.{DOMAIN_PRIMARY}", "https")
removed = sorted(
purge_vhost_files_for_entities(
["matomo", "dashboard"],
nginx_dir=self.nginx_dir,
domain_primary="infinito.test",
domain_primary=DOMAIN_PRIMARY,
roles_dir=self.roles_dir,
)
)
@@ -300,16 +303,16 @@ class TestOnionVhostVariant(NginxVhostsTestBase, unittest.TestCase):
self._mk_role(
"web-app-matomo",
application_id="matomo",
canonical=["matomo.infinito.test"],
canonical=[f"matomo.{DOMAIN_PRIMARY}"],
)
clearnet = self._touch_vhost("matomo.infinito.test", "https")
clearnet = self._touch_vhost(f"matomo.{DOMAIN_PRIMARY}", "https")
onion = self._touch_vhost(f"matomo.{self.ONION}", "http")
self._write_node_onion(self.ONION)
found = set(
iter_vhost_files_for_entity(
"matomo",
nginx_dir=self.nginx_dir,
domain_primary="infinito.test",
domain_primary=DOMAIN_PRIMARY,
roles_dir=self.roles_dir,
)
)
@@ -320,14 +323,14 @@ class TestOnionVhostVariant(NginxVhostsTestBase, unittest.TestCase):
self._mk_role(
"web-app-matomo",
application_id="matomo",
canonical=["matomo.infinito.test"],
canonical=[f"matomo.{DOMAIN_PRIMARY}"],
)
onion = self._touch_vhost(f"matomo.{self.ONION}", "http")
found = set(
iter_vhost_files_for_entity(
"matomo",
nginx_dir=self.nginx_dir,
domain_primary="infinito.test",
domain_primary=DOMAIN_PRIMARY,
roles_dir=self.roles_dir,
)
)
@@ -365,7 +368,7 @@ class TestResolveDomainPrimary(unittest.TestCase):
if k not in ("DOMAIN", "INFINITO_DOMAIN")
}
with patch.dict(os.environ, env, clear=True):
self.assertEqual(mod._resolve_domain_primary(None), "infinito.test")
self.assertEqual(mod._resolve_domain_primary(None), DOMAIN_PRIMARY)
if __name__ == "__main__": # pragma: no cover
tests/unit/python/utils/diagnostics/test_container.py
+4 -2
View File
@@ -14,11 +14,13 @@ import unittest
import unittest.mock as mock
from pathlib import Path
from utils.domains.default_primary import default_domain_primary
from utils.paths import read_group_path
from . import PROJECT_ROOT
RESCUE = PROJECT_ROOT / "utils" / "diagnostics" / "container.py"
DOMAIN = default_domain_primary()
_ENV = mock.patch.dict(
os.environ,
{"INFINITO_DNS53_SAMPLER_LOG": read_group_path("FILE_DNS53_SAMPLER_LOG")},
@@ -70,8 +72,8 @@ class InZoneProbeTests(unittest.TestCase):
def test_a_zone_in_the_main_file_still_wins(self):
with tempfile.TemporaryDirectory() as tmp:
main = Path(tmp) / "dnsmasq.conf"
main.write_text("address=/infinito.test/192.0.2.1\n", encoding="utf-8")
self.assertEqual(self._zone(main), "infinito.test")
main.write_text(f"address=/{DOMAIN}/192.0.2.1\n", encoding="utf-8")
self.assertEqual(self._zone(main), DOMAIN)
def test_a_config_without_a_zone_yields_nothing(self):
with tempfile.TemporaryDirectory() as tmp:
tests/unit/python/utils/domains/test_list.py
+15 -13
View File
@@ -7,6 +7,7 @@ from unittest.mock import patch
from ansible.errors import AnsibleError
from utils.cache.yaml import dump_yaml_str
from utils.domains.default_primary import default_domain_primary
from utils.roles.mapping import (
ROLE_FILE_META_DOMAINS,
ROLE_FILE_META_SERVER,
@@ -14,6 +15,7 @@ from utils.roles.mapping import (
)
domain_list = importlib.import_module("utils.domains.list")
DOMAIN = default_domain_primary()
class TestDomainList(unittest.TestCase):
@@ -74,16 +76,16 @@ class TestDomainList(unittest.TestCase):
)
with patch.object(domain_list, "ROLES_DIR", roles_dir):
domains = domain_list.list_application_domains("infinito.test")
domains = domain_list.list_application_domains(DOMAIN)
self.assertEqual(
domains,
sorted(
[
"api.s3.infinito.test",
"console.s3.infinito.test",
"dashboard.infinito.test",
"test.infinito.test",
f"api.s3.{DOMAIN}",
f"console.s3.{DOMAIN}",
f"dashboard.{DOMAIN}",
f"test.{DOMAIN}",
]
),
)
@@ -109,7 +111,7 @@ class TestDomainList(unittest.TestCase):
with patch.object(domain_list, "ROLES_DIR", roles_dir):
domains = domain_list.list_application_domains(
"infinito.test",
DOMAIN,
include_aliases=True,
include_www=True,
)
@@ -117,10 +119,10 @@ class TestDomainList(unittest.TestCase):
self.assertEqual(
domains,
[
"dashboard.infinito.test",
"test.infinito.test",
"www.dashboard.infinito.test",
"www.test.infinito.test",
f"dashboard.{DOMAIN}",
f"test.{DOMAIN}",
f"www.dashboard.{DOMAIN}",
f"www.test.{DOMAIN}",
],
)
@@ -130,9 +132,9 @@ class TestDomainList(unittest.TestCase):
roles_dir.mkdir()
with patch.object(domain_list, "ROLES_DIR", roles_dir):
domains = domain_list.list_application_domains("infinito.test")
domains = domain_list.list_application_domains(DOMAIN)
self.assertEqual(domains, ["test.infinito.test"])
self.assertEqual(domains, [f"test.{DOMAIN}"])
def test_list_application_domains_raises_on_collisions(self):
with tempfile.TemporaryDirectory() as tmp:
@@ -154,7 +156,7 @@ class TestDomainList(unittest.TestCase):
patch.object(domain_list, "ROLES_DIR", roles_dir),
self.assertRaises(AnsibleError),
):
domain_list.list_application_domains("infinito.test")
domain_list.list_application_domains(DOMAIN)
if __name__ == "__main__":
tests/unit/python/utils/networks/test_reachability.py
+12 -14
View File
@@ -4,6 +4,7 @@ from __future__ import annotations
import unittest
from utils.domains.default_primary import default_domain_primary
from utils.networks.reachability import (
CLEARNET,
MULTI,
@@ -19,6 +20,7 @@ from utils.networks.reachability import (
)
ONION = "abcdefghijklmnopqrstuvwxyz234567abcdefghijklmnopqrstuvw.onion"
DOMAIN = default_domain_primary()
def _cfg(**reachability) -> dict:
@@ -33,11 +35,11 @@ class TestNetworkOf(unittest.TestCase):
self.assertEqual(network_of(f"Wazuh.{ONION.upper()}."), TOR)
def test_everything_else_is_clearnet(self) -> None:
self.assertEqual(network_of("wazuh.infinito.test"), CLEARNET)
self.assertEqual(network_of(f"wazuh.{DOMAIN}"), CLEARNET)
def test_is_network(self) -> None:
self.assertTrue(is_network(ONION, TOR))
self.assertFalse(is_network("infinito.test", TOR))
self.assertFalse(is_network(DOMAIN, TOR))
def test_reserved_network_is_refused(self) -> None:
with self.assertRaises(ValueError):
@@ -51,34 +53,30 @@ class TestNetworkOf(unittest.TestCase):
class TestSiblingDomain(unittest.TestCase):
def test_clearnet_subdomain_to_tor(self) -> None:
self.assertEqual(
sibling_domain("wazuh.infinito.test", TOR, "infinito.test", ONION),
sibling_domain(f"wazuh.{DOMAIN}", TOR, DOMAIN, ONION),
f"wazuh.{ONION}",
)
def test_apex_to_tor_is_the_node_onion(self) -> None:
self.assertEqual(
sibling_domain("infinito.test", TOR, "infinito.test", ONION), ONION
)
self.assertEqual(sibling_domain(DOMAIN, TOR, DOMAIN, ONION), ONION)
def test_tor_subdomain_to_clearnet(self) -> None:
self.assertEqual(
sibling_domain(f"wazuh.{ONION}", CLEARNET, "infinito.test", ONION),
"wazuh.infinito.test",
sibling_domain(f"wazuh.{ONION}", CLEARNET, DOMAIN, ONION),
f"wazuh.{DOMAIN}",
)
def test_same_network_returns_itself(self) -> None:
self.assertEqual(
sibling_domain("wazuh.infinito.test", CLEARNET, "infinito.test", ONION),
"wazuh.infinito.test",
sibling_domain(f"wazuh.{DOMAIN}", CLEARNET, DOMAIN, ONION),
f"wazuh.{DOMAIN}",
)
def test_foreign_domain_has_no_sibling(self) -> None:
self.assertIsNone(sibling_domain("example.org", TOR, "infinito.test", ONION))
self.assertIsNone(sibling_domain("example.org", TOR, DOMAIN, ONION))
def test_no_node_address_has_no_sibling(self) -> None:
self.assertIsNone(
sibling_domain("wazuh.infinito.test", TOR, "infinito.test", "")
)
self.assertIsNone(sibling_domain(f"wazuh.{DOMAIN}", TOR, DOMAIN, ""))
class TestResolveNodeMode(unittest.TestCase):
tests/unit/python/utils/roles/test_rbac_scoped.py
+5 -2
View File
@@ -13,12 +13,15 @@ from __future__ import annotations
import unittest
from typing import ClassVar
from utils.domains.default_primary import default_domain_primary
from utils.roles.rbac.scoped import (
APPLICATION_SCOPED_ROLES,
granted_roles,
members_with_role,
)
DOMAIN = default_domain_primary()
class TestGrantedRoles(unittest.TestCase):
def test_a_scoped_grant_reaches_only_the_named_application(self) -> None:
@@ -98,12 +101,12 @@ class TestMembersWithRole(unittest.TestCase):
def test_the_declared_username_wins_over_the_key(self) -> None:
users = {
"biber": {
"username": "biber@infinito.test",
"username": f"biber@{DOMAIN}",
"application_roles": {"web-app-baserow": ["mcp"]},
}
}
self.assertEqual(
["biber@infinito.test"],
[f"biber@{DOMAIN}"],
members_with_role(users, "web-app-baserow", "mcp-reader"),
)