acme-container-test.yml

name: ACME container

on:
  workflow_call:
    inputs:
      os:
        required: true
        type: string
      db-image:
        required: false
        type: string

jobs:
  # docs/installation/podman/Deploying_PKI_ACME_Responder_on_Podman.md
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v3

      - name: Retrieve runner image
        uses: actions/cache@v3
        with:
          key: pki-acme-runner-${{ inputs.os }}-${{ github.run_id }}
          path: pki-runner.tar

      - name: Load runner image
        run: docker load --input pki-runner.tar

      - name: Retrieve server image
        uses: actions/cache@v3
        with:
          key: pki-acme-server-${{ inputs.os }}-${{ github.run_id }}
          path: pki-acme.tar

      - name: Load ACME image
        run: docker load --input pki-acme.tar

      - name: Create network
        run: docker network create example

      - name: Set up ACME container
        run: |
          docker run \
              --name server \
              --detach \
              pki-acme

      - name: Connect ACME container to network
        run: docker network connect example server --alias pki.example.com

      - name: Set up client container
        run: |
          tests/bin/runner-init.sh client
        env:
          HOSTNAME: client.example.com

      - name: Connect client container to network
        run: docker network connect example client --alias client.example.com

      - name: Install dependencies in client container
        run: docker exec client dnf install -y certbot

      - name: Wait for ACME container to start
        run: |
          docker exec client curl \
              --retry 60 \
              --retry-delay 0 \
              --retry-connrefused \
              -s \
              -k \
              -o /dev/null \
              http://pki.example.com:8080/acme/directory

      - name: Verify certbot in client container
        run: |
          docker exec client certbot register \
              --server http://pki.example.com:8080/acme/directory \
              --email user1@example.com \
              --agree-tos \
              --non-interactive
          docker exec client certbot certonly \
              --server http://pki.example.com:8080/acme/directory \
              -d client.example.com \
              --standalone \
              --non-interactive
          docker exec client openssl x509 -text -noout -in /etc/letsencrypt/live/client.example.com/fullchain.pem
          docker exec client certbot renew \
              --server http://pki.example.com:8080/acme/directory \
              --cert-name client.example.com \
              --force-renewal \
              --no-random-sleep-on-renew \
              --non-interactive
          #
          # By default the pki-acme container uses NSS issuer (instead of
          # PKI issuer) which does not support cert revocation, so the
          # revocation test is disabled.
          #
          # docker exec client certbot revoke \
          #     --server http://pki.example.com:8080/acme/directory \
          #     --cert-name client.example.com \
          #     --non-interactive
          #
          docker exec client certbot update_account \
              --server http://pki.example.com:8080/acme/directory \
              --email user2@example.com \
              --non-interactive
          docker exec client certbot unregister \
              --server http://pki.example.com:8080/acme/directory \
              --non-interactive

      - name: Gather artifacts from server container
        if: always()
        run: |
          mkdir -p /tmp/artifacts/server
          docker logs server > /tmp/artifacts/server/container.out 2> /tmp/artifacts/server/container.err
          mkdir -p /tmp/artifacts/server/var/lib
          docker cp server:/var/lib/tomcats /tmp/artifacts/server/var/lib
        continue-on-error: true

      - name: Gather artifacts from client container
        if: always()
        run: |
          mkdir -p /tmp/artifacts/client
          docker logs client > /tmp/artifacts/client/container.out 2> /tmp/artifacts/client/container.err
          mkdir -p /tmp/artifacts/client/etc/letsencrypt
          docker cp client:/etc/letsencrypt/live /tmp/artifacts/client/etc/letsencrypt
          mkdir -p /tmp/artifacts/client/var/log/letsencrypt
          docker cp client:/var/log/letsencrypt/letsencrypt.log /tmp/artifacts/client/var/log/letsencrypt
        continue-on-error: true

      - name: Upload artifacts from server container
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: acme-container-server-${{ inputs.os }}
          path: /tmp/artifacts/server

      - name: Upload artifacts from client container
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: acme-container-client-${{ inputs.os }}
          path: /tmp/artifacts/client