mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbach
f9f3dfd10d
Replace the previous OR-based assertion in scripts/tests/environment (which trivially passed because the Nexus log always grows from health probes) with a richer set of helpers split across two files under utils/ for SRP/SPOT. scripts/tests/environment/utils/cache.sh (new): * expected_system_proxy_for_runtime maps DEV_RUNTIME_IMAGE to the Nexus proxy that handles its system package manager (apt-debian, apt-ubuntu, yum-fedora, yum-rocky; empty for Manjaro/Arch where pacman is not cached). * nexus_repo_requests counts only /repository/<name>/... entries in the Nexus request log, optionally scoped to one proxy. Filters out health probes, admin REST calls, and Web-UI traffic. * registry_cache_flows counts every cache-flow status (HIT, MISS, REVALIDATED, UPDATING, STALE) so cold deploys also count. * assert_caches_used fails with a per-cache breakdown when any of three independent conditions is violated: total Nexus repo traffic = 0, the runtime's expected system proxy has 0 cached requests, or the deploy itself produced 0 registry-cache flows. * probe_caches actively fetches a known upstream resource through each cache (apt-debian/dists/bookworm/Release for the package cache, /ca.crt for the registry cache). * probe_did_inner_build drives a throwaway docker build whose apt-get update runs against deb.debian.org. The build container is placed on the compose network and pinned via --add-host to the frontend IP, exactly like the runtime override that roles/sys-svc-compose/files/compose.py injects for app builds. After the build the test snapshots ``docker logs infinito-package-cache-frontend`` and asserts the frontend recorded new requests, proving DiD apt traffic flows through nginx -> Nexus apt-debian and not directly to upstream. DOCKER_BUILDKIT=0 because BuildKit refuses --network=<compose-net>. scripts/tests/environment/utils/common.sh (renamed from lib.sh): keeps the bootstrap, constants, inventory inspect, and assert_http_status; cache helpers moved out so the file is single-concern. scripts/tests/environment/07_deploy_minimal.sh sources both files; order is snapshot, deploy, probe_caches, probe_did_inner_build, snapshot, assert_caches_used. Active probes contribute traffic that the AND assertion verifies, so the assertion is robust on deploys that do not naturally trigger inner-build apt traffic. .github/workflows/test-environment.yml: propagate DEV_RUNTIME_IMAGE into the inner ``docker run`` so per-distro probe target and proxy expectation resolve correctly inside the orchestrator. .gitignore + .dockerignore: also ignore .claude/settings.local.json, which compose mounts as /dev/null and which the classic docker builder would otherwise try (and fail) to read into the build context. Verified end-to-end with five iterations of ``make act-workflow ACT_WORKFLOW=.github/workflows/test-environment.yml ACT_JOB=test-environment ACT_MATRIX='dev_runtime_image:debian:bookworm'``. The final iteration reports +81 apt-debian, +235 registry-cache flows, +13 frontend log lines from the DiD probe, and "[OK] both cache stacks observed activity" plus "[OK] DiD inner-build flowed through cache frontend".
22 lines
915 B
Bash
Executable File
22 lines
915 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Deploy on performance hardware — deploy the full set of applications.
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=scripts/tests/environment/utils/common.sh
|
|
source "${SCRIPT_DIR}/utils/common.sh"
|
|
|
|
echo "Deploying matomo (full cycle: deploy + update pass) so it becomes reachable via its dedicated inventory entry."
|
|
make deploy-fresh-purged-apps APPS="${MATOMO_APP}" FULL_CYCLE=true
|
|
inspect
|
|
|
|
echo "Re-trusting the CA after the fresh deploy rebuilt the certificates."
|
|
make trust-ca
|
|
|
|
echo "Verifying matomo is now reachable after its dedicated deploy."
|
|
assert_http_status 200 "${MATOMO_URL}"
|
|
|
|
echo "Verifying the dashboard is no longer reachable after the matomo-only fresh deploy."
|
|
# Expect 000 because curl aborts in TLS before HTTP when the removed hostname is missing from the certificate SANs.
|
|
assert_http_status 000 "${DASHBOARD_URL}"
|