Frank
8898740ca4
The proxy provider matches external_host exactly, so Host=www matched zero providers and Authentik answered its error page while the naked domain served the homepage. Flip the topology: www.franksdank.cloud is the one guarded vhost carrying the homepage through Anubis -> Authentik -> :8017; franksdank.cloud (plus legacy names and the bare-IP catch-all) 308-redirects onto www before any challenge. Tests flipped to assert the new contract.
164 lines
6.4 KiB
Bash
164 lines
6.4 KiB
Bash
#!/usr/bin/env bats
|
|
# Seam: Authentik (SSO / OIDC provider) — the homelab's auth layer.
|
|
#
|
|
# Authentik is a 3-service stack (PostgreSQL + server + worker) on dankclaw.
|
|
# It provides OIDC, SAML, and Caddy forward_auth for the vhosts that do not
|
|
# have their own application-level authentication (SearXNG, Hermes,
|
|
# Prometheus, RomM, Copyparty, the homepage).
|
|
#
|
|
# The Caddyfile carries an `auth.franksdank.cloud` vhost that proxies to the
|
|
# Authentik server. Vhosts without their own auth are wrapped in a `route`
|
|
# block that (1) proxies the outpost path to Authentik, (2) runs forward_auth,
|
|
# (3) serves the app.
|
|
#
|
|
# See ../docs/Infrastructure/Authentik.md.
|
|
|
|
load helpers
|
|
|
|
COMPOSE="$REPO_ROOT/dankclaw/compose.yaml"
|
|
CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
|
|
ENV_EXAMPLE="$REPO_ROOT/dankclaw/.env.example"
|
|
|
|
# --- Quadlet units: the 3-service stack ------------------------------------
|
|
# The trio left compose: they are boot-persistent Quadlet units installed to
|
|
# ~/.config/containers/systemd/ by deploy-remote.sh (deploy_authentik).
|
|
|
|
UNIT_DIR="$REPO_ROOT/dankclaw/authentik/quadlet"
|
|
|
|
@test "the three authentik quadlet units exist" {
|
|
for unit in authentik-postgres authentik-server authentik-worker; do
|
|
[ -f "$UNIT_DIR/$unit.container" ]
|
|
done
|
|
}
|
|
|
|
@test "authentik-postgres uses the official postgres image" {
|
|
grep -q 'Image=docker.io/library/postgres:16-alpine' "$UNIT_DIR/authentik-postgres.container"
|
|
}
|
|
|
|
@test "server and worker use the official goauthentik image" {
|
|
grep -q 'Image=ghcr.io/goauthentik/server:' "$UNIT_DIR/authentik-server.container"
|
|
grep -q 'Image=ghcr.io/goauthentik/server:' "$UNIT_DIR/authentik-worker.container"
|
|
}
|
|
|
|
@test "the same image runs both roles; the Exec command selects the role" {
|
|
grep -qE '^Exec=server$' "$UNIT_DIR/authentik-server.container"
|
|
grep -qE '^Exec=worker$' "$UNIT_DIR/authentik-worker.container"
|
|
}
|
|
|
|
@test "startup order is postgres -> server -> worker via unit ordering" {
|
|
grep -q 'After=network.target authentik-postgres.service' "$UNIT_DIR/authentik-server.container"
|
|
grep -q 'Wants=authentik-postgres.service' "$UNIT_DIR/authentik-server.container"
|
|
grep -q 'Wants=authentik-server.service' "$UNIT_DIR/authentik-worker.container"
|
|
}
|
|
|
|
@test "the server publishes 9000 on loopback only; LAN reaches it through Caddy" {
|
|
grep -q 'PublishPort=127.0.0.1:9000:9000' "$UNIT_DIR/authentik-server.container"
|
|
}
|
|
|
|
@test "authentik-postgres healthcheck uses pg_isready" {
|
|
grep -q 'HealthCmd=.*pg_isready' "$UNIT_DIR/authentik-postgres.container"
|
|
}
|
|
|
|
# --- Units: environment (secrets stay in the host .env, expanded at start) --
|
|
|
|
@test "the units consume AUTHENTIK_PG_PASS via systemd expansion, not literals" {
|
|
grep -q 'POSTGRES_PASSWORD=${AUTHENTIK_PG_PASS}' "$UNIT_DIR/authentik-postgres.container"
|
|
grep -q 'PASSWORD=${AUTHENTIK_PG_PASS}' "$UNIT_DIR/authentik-server.container"
|
|
grep -q 'PASSWORD=${AUTHENTIK_PG_PASS}' "$UNIT_DIR/authentik-worker.container"
|
|
}
|
|
|
|
@test "the units consume AUTHENTIK_SECRET_KEY via systemd expansion, not literals" {
|
|
for unit in authentik-server authentik-worker; do
|
|
grep -q 'AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}' "$UNIT_DIR/$unit.container"
|
|
done
|
|
}
|
|
|
|
@test "no secret material is committed in the quadlet units" {
|
|
! grep -rqE 'SECRET_KEY=[^$]' "$UNIT_DIR"
|
|
}
|
|
|
|
@test "deploy-remote.sh routes the authentik trio to the quadlet handler, not compose up" {
|
|
grep -q 'authentik-postgres|authentik-server|authentik-worker)' "$REPO_ROOT/scripts/deploy-remote.sh"
|
|
grep -q 'deploy_authentik()' "$REPO_ROOT/scripts/deploy-remote.sh"
|
|
! grep -qE '^[[:space:]]+comfyui\|.*authentik' "$REPO_ROOT/scripts/deploy-remote.sh"
|
|
}
|
|
|
|
# --- Caddyfile: the auth vhost ---
|
|
|
|
@test "the Caddyfile has an auth.franksdank.cloud vhost" {
|
|
grep -qE '^auth\.franksdank\.cloud[[:space:]]*\{' "$CADDYFILE"
|
|
}
|
|
|
|
@test "the auth vhost proxies to authentik-server:9000" {
|
|
local block
|
|
block=$(awk '/^auth\.franksdank\.cloud/,/^}/' "$CADDYFILE")
|
|
echo "$block" | grep -q 'reverse_proxy authentik-server:9000'
|
|
}
|
|
|
|
# --- Caddyfile: guarded vhosts proxy the whole request through Authentik ----
|
|
|
|
@test "guarded vhosts proxy the whole request through authentik on the internal listener" {
|
|
awk '/^http:\/\/:8016/,/^\}/' "$CADDYFILE" | grep -q 'reverse_proxy authentik-server:9000'
|
|
}
|
|
|
|
@test "the auth decision carries the outpost meta headers" {
|
|
grep -q 'X-authentik-meta-outpost' "$CADDYFILE"
|
|
grep -q 'X-authentik-meta-provider' "$CADDYFILE"
|
|
grep -q 'X-authentik-meta-app' "$CADDYFILE"
|
|
}
|
|
|
|
@test "authenticated traffic returns to Caddy on the post-auth listener" {
|
|
grep -qE '^http://:8017 \{' "$CADDYFILE"
|
|
}
|
|
|
|
# --- Homepage: www holds the homepage; naked redirects onto it ---
|
|
|
|
@test "the homepage vhost is www, guarded by Anubis" {
|
|
local block
|
|
block=$(awk '/^www\.franksdank\.cloud[[:space:]]*\{/,/^}/' "$CADDYFILE")
|
|
echo "$block" | grep -q 'reverse_proxy anubis:8923'
|
|
}
|
|
|
|
@test "the naked domain redirects to www at the TLS edge" {
|
|
local block
|
|
block=$(awk '/^franksdank\.cloud[[:space:]]*\{/,/^}/' "$CADDYFILE")
|
|
echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
|
|
}
|
|
|
|
@test "dankclaw.franksdank.cloud redirects straight onto www" {
|
|
local block
|
|
block=$(awk '/^dankclaw\.franksdank\.cloud/,/^}/' "$CADDYFILE")
|
|
echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
|
|
}
|
|
|
|
@test "dankserver.franksdank.cloud redirects straight onto www" {
|
|
local block
|
|
block=$(awk '/^dankserver\.franksdank\.cloud/,/^}/' "$CADDYFILE")
|
|
echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
|
|
}
|
|
|
|
@test "the bare-IP catch-all redirects onto www" {
|
|
local block
|
|
block=$(awk '/^:80 \{/,/^}/' "$CADDYFILE")
|
|
echo "$block" | grep -q 'redir https://www.franksdank.cloud/ 308'
|
|
}
|
|
|
|
# --- .env.example: authentik placeholders ---
|
|
|
|
@test ".env.example carries AUTHENTIK_PG_PASS" {
|
|
grep -q 'AUTHENTIK_PG_PASS=' "$ENV_EXAMPLE"
|
|
}
|
|
|
|
@test ".env.example carries AUTHENTIK_SECRET_KEY" {
|
|
grep -q 'AUTHENTIK_SECRET_KEY=' "$ENV_EXAMPLE"
|
|
}
|
|
|
|
@test ".env.example authentik placeholders are not real secrets" {
|
|
# Placeholders must be obvious (REPLACE_WITH or empty), not 64-char strings.
|
|
local pg sk
|
|
pg=$(grep '^AUTHENTIK_PG_PASS=' "$ENV_EXAMPLE" | cut -d= -f2-)
|
|
sk=$(grep '^AUTHENTIK_SECRET_KEY=' "$ENV_EXAMPLE" | cut -d= -f2-)
|
|
[ ${#pg} -lt 32 ] || { echo "AUTHENTIK_PG_PASS looks like a real secret (len=${#pg})"; return 1; }
|
|
[ ${#sk} -lt 32 ] || { echo "AUTHENTIK_SECRET_KEY looks like a real secret (len=${#sk})"; return 1; }
|
|
}
|