From 9f57310ceb3e8839e365269df3350c137f173609 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Wed, 15 Jul 2026 12:14:51 +0200 Subject: [PATCH] Point e2e and CI at step-ca trust center Update generated test config, loopback HTTPS client, and workflow root CA wiring for the step-ca ACME directory and port-443 trust center listener introduced by the new compose stack. Signed-off-by: Bryan Frimin --- .github/workflows/make.yaml | 2 +- contrib/claude/e2e.md | 11 ++++++----- contrib/claude/make.md | 2 +- e2e/internal/testutil/graphql.go | 8 ++++---- e2e/internal/testutil/testutil.go | 6 +++--- 5 files changed, 15 insertions(+), 14 deletions(-) diff --git a/.github/workflows/make.yaml b/.github/workflows/make.yaml index b028fa106..16bde0294 100644 --- a/.github/workflows/make.yaml +++ b/.github/workflows/make.yaml @@ -467,7 +467,7 @@ jobs: GOTESTSUM_FORMAT: "testname" GOTESTSUM_JUNITFILE: "junit-e2e.xml" run: | - PROBOD_ACME_ROOT_CA="$(cat compose/pebble/certs/rootCA.pem)" \ + PROBOD_ACME_ROOT_CA="$(cat compose/step-ca/certs/root_ca.crt)" \ CGO_ENABLED=1 go tool gotestsum -- -race -cover -coverprofile=coverage.out -count=1 ./e2e/console/... - name: "Upload test results" uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7 diff --git a/contrib/claude/e2e.md b/contrib/claude/e2e.md index bef224ce6..352d34f04 100644 --- a/contrib/claude/e2e.md +++ b/contrib/claude/e2e.md @@ -4,22 +4,23 @@ E2E tests live in `e2e/console/` (package `console_test`) and run against a live ## Prerequisites -E2e uses the local [Pebble](https://github.com/letsencrypt/pebble) ACME server over HTTPS. Pebble’s TLS certificate is minted with [mkcert](https://github.com/FiloSottile/mkcert); register mkcert’s root CA in your system trust store once per machine: +E2e uses the local [step-ca](https://github.com/smallstep/certificates) ACME server over HTTPS. The CA is persistent across restarts; install its root once per machine so probod and browsers trust issued custom-domain certificates: ```bash -mkcert -install +make stack-up +step certificate install compose/step-ca/certs/root_ca.crt ``` -Without this step, probod cannot verify Pebble’s HTTPS endpoint when it registers an ACME account at startup. +Without this step, probod cannot verify the ACME directory endpoint or fetch compliance-portal CIMD metadata over HTTPS. -You also need the Docker stack running and `bin/probod` built. `make stack-up` generates Pebble TLS material under `compose/pebble/certs/` (via mkcert): +You also need the Docker stack running and `bin/probod` built: ```bash make stack-up make build ``` -E2e config is built at test startup in `e2e/internal/testutil/testutil.go` (`generateConfig` → `probod-bootstrap`). It points ACME at Pebble but does not set `PROBOD_ACME_ROOT_CA`; local runs rely on the system trust store populated by `mkcert -install`. CI passes `PROBOD_ACME_ROOT_CA` in the workflow instead. +E2e config is built at test startup in `e2e/internal/testutil/testutil.go` (`generateConfig` → `probod-bootstrap`). It points ACME at step-ca but does not set `PROBOD_ACME_ROOT_CA`; local runs rely on the system trust store populated by `step certificate install`. CI passes `PROBOD_ACME_ROOT_CA` in the workflow instead. ## Running tests diff --git a/contrib/claude/make.md b/contrib/claude/make.md index 6863f07c8..c6152245b 100644 --- a/contrib/claude/make.md +++ b/contrib/claude/make.md @@ -23,7 +23,7 @@ The project uses a `GNUmakefile` at the root. Builds run with `--jobs=$(nproc)` | Target | Purpose | | ----------------- | ------------------------------------------------------------- | -| `make stack-up` | Start Docker Compose infra (Postgres, Pebble, Keycloak, etc.) | +| `make stack-up` | Start Docker Compose infra (Postgres, step-ca, Keycloak, etc.) | | `make stack-down` | Stop Docker Compose infra | | `make stack-ps` | List running containers | | `make psql` | Open a `psql` shell to the dev Postgres database | diff --git a/e2e/internal/testutil/graphql.go b/e2e/internal/testutil/graphql.go index ca2524ec2..61f196969 100644 --- a/e2e/internal/testutil/graphql.go +++ b/e2e/internal/testutil/graphql.go @@ -40,7 +40,7 @@ import ( // trustCenterHTTPSAddr is the loopback address of the dedicated trust-center // HTTPS listener started by the e2e probod (see generateConfig). Compliance // pages are served here exclusively, routed by TLS SNI / Host header. -const trustCenterHTTPSAddr = "127.0.0.1:10443" +const trustCenterHTTPSAddr = "127.0.0.1:443" type GraphQLRequest struct { Query string `json:"query"` @@ -216,8 +216,8 @@ func ConsoleGraphQLWithAccessToken( // trustHTTPClient builds an HTTP client that always dials the dedicated // trust-center HTTPS listener on loopback while presenting the compliance -// page's host as TLS SNI. Certificates are Pebble-issued for e2e, so -// verification is skipped. +// page's host as TLS SNI. Certificates are step-ca-issued for e2e, so +// verification is skipped when the root is not installed in the test runner. func trustHTTPClient(serverName string) *http.Client { return trustHTTPClientWithJar(serverName, nil) } @@ -234,7 +234,7 @@ func trustHTTPClientWithJar(serverName string, jar http.CookieJar) *http.Client }, TLSClientConfig: &tls.Config{ ServerName: serverName, - InsecureSkipVerify: true, //nolint:gosec // e2e talks to Pebble-issued certs on loopback. + InsecureSkipVerify: true, //nolint:gosec // e2e talks to step-ca-issued certs on loopback. }, }, } diff --git a/e2e/internal/testutil/testutil.go b/e2e/internal/testutil/testutil.go index 99f4beb52..f241626b5 100644 --- a/e2e/internal/testutil/testutil.go +++ b/e2e/internal/testutil/testutil.go @@ -298,11 +298,11 @@ func generateConfig() (string, error) { // yields {slug}.probopage.localhost subdomains for pages without a // customer custom domain. "PROBOD_TRUST_CENTER_HTTP_ADDR": ":10080", - "PROBOD_TRUST_CENTER_HTTPS_ADDR": ":10443", + "PROBOD_TRUST_CENTER_HTTPS_ADDR": ":443", "PROBOD_TRUST_CENTER_BASE_DOMAIN": "probopage.localhost", // Keep certificate provisioning snappy so trust-center e2e flows do not - // wait on the default 30s poll (Pebble runs with PEBBLE_VA_ALWAYS_VALID). + // wait on the default 30s poll (step-ca validates HTTP-01 via port 80). "PROBOD_CUSTOM_DOMAINS_PROVISION_INTERVAL": "1", // AWS / S3 (SeaweedFS). @@ -321,7 +321,7 @@ func generateConfig() (string, error) { // Custom domains. "PROBOD_CUSTOM_DOMAINS_CNAME_TARGET": "custom.test.getprobo.com", - "PROBOD_ACME_DIRECTORY": "https://localhost:14000/dir", + "PROBOD_ACME_DIRECTORY": "https://localhost:9000/acme/acme/directory", "PROBOD_ACME_EMAIL": "admin@test.getprobo.com", }