mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbach
f9f3dfd10d
Replace the previous OR-based assertion in scripts/tests/environment (which trivially passed because the Nexus log always grows from health probes) with a richer set of helpers split across two files under utils/ for SRP/SPOT. scripts/tests/environment/utils/cache.sh (new): * expected_system_proxy_for_runtime maps DEV_RUNTIME_IMAGE to the Nexus proxy that handles its system package manager (apt-debian, apt-ubuntu, yum-fedora, yum-rocky; empty for Manjaro/Arch where pacman is not cached). * nexus_repo_requests counts only /repository/<name>/... entries in the Nexus request log, optionally scoped to one proxy. Filters out health probes, admin REST calls, and Web-UI traffic. * registry_cache_flows counts every cache-flow status (HIT, MISS, REVALIDATED, UPDATING, STALE) so cold deploys also count. * assert_caches_used fails with a per-cache breakdown when any of three independent conditions is violated: total Nexus repo traffic = 0, the runtime's expected system proxy has 0 cached requests, or the deploy itself produced 0 registry-cache flows. * probe_caches actively fetches a known upstream resource through each cache (apt-debian/dists/bookworm/Release for the package cache, /ca.crt for the registry cache). * probe_did_inner_build drives a throwaway docker build whose apt-get update runs against deb.debian.org. The build container is placed on the compose network and pinned via --add-host to the frontend IP, exactly like the runtime override that roles/sys-svc-compose/files/compose.py injects for app builds. After the build the test snapshots ``docker logs infinito-package-cache-frontend`` and asserts the frontend recorded new requests, proving DiD apt traffic flows through nginx -> Nexus apt-debian and not directly to upstream. DOCKER_BUILDKIT=0 because BuildKit refuses --network=<compose-net>. scripts/tests/environment/utils/common.sh (renamed from lib.sh): keeps the bootstrap, constants, inventory inspect, and assert_http_status; cache helpers moved out so the file is single-concern. scripts/tests/environment/07_deploy_minimal.sh sources both files; order is snapshot, deploy, probe_caches, probe_did_inner_build, snapshot, assert_caches_used. Active probes contribute traffic that the AND assertion verifies, so the assertion is robust on deploys that do not naturally trigger inner-build apt traffic. .github/workflows/test-environment.yml: propagate DEV_RUNTIME_IMAGE into the inner ``docker run`` so per-distro probe target and proxy expectation resolve correctly inside the orchestrator. .gitignore + .dockerignore: also ignore .claude/settings.local.json, which compose mounts as /dev/null and which the classic docker builder would otherwise try (and fail) to read into the build context. Verified end-to-end with five iterations of ``make act-workflow ACT_WORKFLOW=.github/workflows/test-environment.yml ACT_JOB=test-environment ACT_MATRIX='dev_runtime_image:debian:bookworm'``. The final iteration reports +81 apt-debian, +235 registry-cache flows, +13 frontend log lines from the DiD probe, and "[OK] both cache stacks observed activity" plus "[OK] DiD inner-build flowed through cache frontend".
37 lines
1.5 KiB
Bash
Executable File
37 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Deploy on minimal hardware — disable non-essential services to save resources.
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=scripts/tests/environment/utils/common.sh
|
|
source "${SCRIPT_DIR}/utils/common.sh"
|
|
# shellcheck source=scripts/tests/environment/utils/cache.sh
|
|
source "${SCRIPT_DIR}/utils/cache.sh"
|
|
|
|
echo "Snapshotting cache counters before the deploy."
|
|
CACHE_BEFORE="$(cache_snapshot)"
|
|
|
|
echo "Deploying dashboard with matomo disabled to verify SERVICES_DISABLED suppresses the shared service in the inventory."
|
|
make deploy-fresh-purged-apps APPS="${DASHBOARD_APP}" SERVICES_DISABLED="matomo"
|
|
inspect
|
|
|
|
echo "Actively probing both caches to confirm pull-through works end-to-end."
|
|
probe_caches
|
|
|
|
echo "Probing the DiD inner-build cache path (frontend hijack + apt rewrite)."
|
|
probe_did_inner_build
|
|
|
|
echo "Verifying that BOTH local caches saw real pull-through traffic."
|
|
CACHE_AFTER="$(cache_snapshot)"
|
|
assert_caches_used "${CACHE_BEFORE}" "${CACHE_AFTER}"
|
|
|
|
echo "Trusting the local CA certificate so HTTPS endpoints are reachable from the host."
|
|
make trust-ca
|
|
|
|
echo "Verifying the dashboard is reachable (matomo was disabled, not the dashboard itself)."
|
|
assert_http_status 200 "${DASHBOARD_URL}"
|
|
|
|
echo "Verifying matomo is not reachable because it was excluded from the inventory."
|
|
# Expect 000 because curl aborts in TLS before HTTP when the excluded hostname is missing from the certificate SANs.
|
|
assert_http_status 000 "${MATOMO_URL}"
|