rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Point e2e and CI at step-ca trust center

Browse Source 
Update generated test config, loopback HTTPS client, and workflow
root CA wiring for the step-ca ACME directory and port-443 trust
center listener introduced by the new compose stack.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-07-15 12:14:51 +02:00
parent 14604a3176
commit 9f57310ceb
5 changed files with 15 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
contrib/claude/e2e.md
View File

@@ -4,22 +4,23 @@ E2E tests live in `e2e/console/` (package `console_test`) and run against a live
## Prerequisites
E2e uses the local [Pebble](https://github.com/letsencrypt/pebble) ACME server over HTTPS. Pebble’s TLS certificate is minted with [mkcert](https://github.com/FiloSottile/mkcert); register mkcert’s root CA in your system trust store once per machine:
E2e uses the local [step-ca](https://github.com/smallstep/certificates) ACME server over HTTPS. The CA is persistent across restarts; install its root once per machine so probod and browsers trust issued custom-domain certificates:
```bash
mkcert -install
make stack-up
step certificate install compose/step-ca/certs/root_ca.crt
```
Without this step, probod cannot verify Pebble’s HTTPS endpoint when it registers an ACME account at startup.
Without this step, probod cannot verify the ACME directory endpoint or fetch compliance-portal CIMD metadata over HTTPS.
You also need the Docker stack running and `bin/probod` built. `make stack-up` generates Pebble TLS material under `compose/pebble/certs/` (via mkcert):
You also need the Docker stack running and `bin/probod` built:
```bash
make stack-up
make build
```
E2e config is built at test startup in `e2e/internal/testutil/testutil.go` (`generateConfig` → `probod-bootstrap`). It points ACME at Pebble but does not set `PROBOD_ACME_ROOT_CA`; local runs rely on the system trust store populated by `mkcert -install`. CI passes `PROBOD_ACME_ROOT_CA` in the workflow instead.
E2e config is built at test startup in `e2e/internal/testutil/testutil.go` (`generateConfig` → `probod-bootstrap`). It points ACME at step-ca but does not set `PROBOD_ACME_ROOT_CA`; local runs rely on the system trust store populated by `step certificate install`. CI passes `PROBOD_ACME_ROOT_CA` in the workflow instead.
## Running tests

2
contrib/claude/make.md
View File

@@ -23,7 +23,7 @@ The project uses a `GNUmakefile` at the root. Builds run with `--jobs=$(nproc)`
| Target | Purpose |
| ----------------- | ------------------------------------------------------------- |
| `make stack-up` | Start Docker Compose infra (Postgres, Pebble, Keycloak, etc.) |
| `make stack-up` | Start Docker Compose infra (Postgres, step-ca, Keycloak, etc.) |
| `make stack-down` | Stop Docker Compose infra |
| `make stack-ps` | List running containers |
| `make psql` | Open a `psql` shell to the dev Postgres database |