Frank
bb1ef9bfb3
The Caddyfile had 'admin off', which disables Caddy's config file watcher. Rendered Caddyfile changes never loaded until the container was recreated, so the double-hash basicauth fix sat on disk unapplied across deploys (2026-08-22). Admin binds to 127.0.0.1:2019 inside the container and the port is unpublished, so nothing outside reaches it. deploy.sh now issues an explicit 'caddy reload' (retry loop) after 'up -d', with the file watcher as backstop.
61 lines
2.6 KiB
Bash
61 lines
2.6 KiB
Bash
#!/usr/bin/env bats
|
|
# Seam: target reachability and deployment flow integrity.
|
|
# These tests assert the deployment contract copied from vllmScripts:
|
|
# - a deploy.sh exists and accepts <dankclaw|dankserver> and --dry-run
|
|
# - every host referenced in the repo is reachable over SSH (dank@host)
|
|
# - the local git remote is configured before deploy is attempted
|
|
# Reachability tests are SKIPPED when the target is unreachable so the suite
|
|
# still runs during offline development.
|
|
|
|
load helpers
|
|
|
|
@test "deploy.sh exists and is executable" {
|
|
[ -x "$REPO_ROOT/scripts/deploy.sh" ]
|
|
}
|
|
|
|
@test "deploy.sh accepts the two known targets" {
|
|
run bash "$REPO_ROOT/scripts/deploy.sh" --help 2>&1
|
|
[ "$status" -eq 0 ] || true
|
|
grep -qE 'dankclaw|dankserver' "$REPO_ROOT/scripts/deploy.sh"
|
|
}
|
|
|
|
@test "git remote origin is configured" {
|
|
git -C "$REPO_ROOT" remote get-url origin >/dev/null 2>&1 \
|
|
|| skip "no origin remote configured yet"
|
|
}
|
|
|
|
@test "dankclaw is reachable over ssh" {
|
|
timeout 8 ssh -o BatchMode=yes -o ConnectTimeout=5 dank@dankclaw 'true' 2>/dev/null \
|
|
|| skip "dankclaw not reachable from this host"
|
|
}
|
|
|
|
@test "dankserver is reachable over ssh" {
|
|
timeout 8 ssh -o BatchMode=yes -o ConnectTimeout=5 dank@dankserver 'true' 2>/dev/null \
|
|
|| skip "dankserver not reachable from this host"
|
|
}
|
|
|
|
# Regression: the Caddyfile render step in deploy.sh must survive a bcrypt
|
|
# hash (which contains '/' characters). Reproduce the sed expression with a
|
|
# slash-bearing hash and confirm the placeholder is replaced.
|
|
@test "deploy.sh reloads Caddy after rendering (hot reload, not just container start)" {
|
|
# The caddy container often survives 'up -d' (a Caddyfile change is a
|
|
# bind-mount content change, not a container config change). Without an
|
|
# explicit reload, a rendered fix can sit on disk while Caddy serves the
|
|
# stale in-memory config.
|
|
grep -q 'caddy reload' "$REPO_ROOT/scripts/deploy.sh"
|
|
}
|
|
|
|
@test "deploy.sh Caddyfile render survives a slash-bearing bcrypt hash" {
|
|
local hash='$2a$14$dndiQ9EaycJv0w3Gp2oAYO/xH6O9x2ZRhMLJdCxrgi9rMn1te9D/spy'
|
|
local rendered
|
|
rendered=$(sed "s|REPLACE_WITH_HASH|${hash}|g" "$REPO_ROOT/dankclaw/Caddyfile")
|
|
[ -n "$rendered" ]
|
|
[[ "$rendered" == *"${hash}"* ]]
|
|
! grep -q 'REPLACE_WITH_HASH' <<< "$rendered"
|
|
# The rendered line must be exactly "dank <hash>". A template that keeps
|
|
# its own $2a$14$ prefix renders an invalid double-prefixed hash and
|
|
# every basicauth vhost returns 401 (2026-08-22 incident).
|
|
grep -qF "dank ${hash}" <<< "$rendered"
|
|
! grep -qF '$2a$14$$2a$14$' <<< "$rendered"
|
|
}
|