rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Point e2e and CI at step-ca trust center

Browse Source 
Update generated test config, loopback HTTPS client, and workflow
root CA wiring for the step-ca ACME directory and port-443 trust
center listener introduced by the new compose stack.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-07-15 12:14:51 +02:00
parent 14604a3176
commit 9f57310ceb
5 changed files with 15 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/make.yaml vendored
View File

@@ -467,7 +467,7 @@ jobs:
GOTESTSUM_FORMAT: "testname"
GOTESTSUM_JUNITFILE: "junit-e2e.xml"
run: |
PROBOD_ACME_ROOT_CA="$(cat compose/pebble/certs/rootCA.pem)" \
PROBOD_ACME_ROOT_CA="$(cat compose/step-ca/certs/root_ca.crt)" \
CGO_ENABLED=1 go tool gotestsum -- -race -cover -coverprofile=coverage.out -count=1 ./e2e/console/...
- name: "Upload test results"
uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7

11
contrib/claude/e2e.md
View File

@@ -4,22 +4,23 @@ E2E tests live in `e2e/console/` (package `console_test`) and run against a live
## Prerequisites
E2e uses the local [Pebble](https://github.com/letsencrypt/pebble) ACME server over HTTPS. Pebble’s TLS certificate is minted with [mkcert](https://github.com/FiloSottile/mkcert); register mkcert’s root CA in your system trust store once per machine:
E2e uses the local [step-ca](https://github.com/smallstep/certificates) ACME server over HTTPS. The CA is persistent across restarts; install its root once per machine so probod and browsers trust issued custom-domain certificates:
```bash
mkcert -install
make stack-up
step certificate install compose/step-ca/certs/root_ca.crt
```
Without this step, probod cannot verify Pebble’s HTTPS endpoint when it registers an ACME account at startup.
Without this step, probod cannot verify the ACME directory endpoint or fetch compliance-portal CIMD metadata over HTTPS.
You also need the Docker stack running and `bin/probod` built. `make stack-up` generates Pebble TLS material under `compose/pebble/certs/` (via mkcert):
You also need the Docker stack running and `bin/probod` built:
```bash
make stack-up
make build
```
E2e config is built at test startup in `e2e/internal/testutil/testutil.go` (`generateConfig` → `probod-bootstrap`). It points ACME at Pebble but does not set `PROBOD_ACME_ROOT_CA`; local runs rely on the system trust store populated by `mkcert -install`. CI passes `PROBOD_ACME_ROOT_CA` in the workflow instead.
E2e config is built at test startup in `e2e/internal/testutil/testutil.go` (`generateConfig` → `probod-bootstrap`). It points ACME at step-ca but does not set `PROBOD_ACME_ROOT_CA`; local runs rely on the system trust store populated by `step certificate install`. CI passes `PROBOD_ACME_ROOT_CA` in the workflow instead.
## Running tests

2
contrib/claude/make.md
View File

@@ -23,7 +23,7 @@ The project uses a `GNUmakefile` at the root. Builds run with `--jobs=$(nproc)`
| Target | Purpose |
| ----------------- | ------------------------------------------------------------- |
| `make stack-up` | Start Docker Compose infra (Postgres, Pebble, Keycloak, etc.) |
| `make stack-up` | Start Docker Compose infra (Postgres, step-ca, Keycloak, etc.) |
| `make stack-down` | Stop Docker Compose infra |
| `make stack-ps` | List running containers |
| `make psql` | Open a `psql` shell to the dev Postgres database |

8
e2e/internal/testutil/graphql.go
View File

@@ -40,7 +40,7 @@ import (
// trustCenterHTTPSAddr is the loopback address of the dedicated trust-center
// HTTPS listener started by the e2e probod (see generateConfig). Compliance
// pages are served here exclusively, routed by TLS SNI / Host header.
const trustCenterHTTPSAddr = "127.0.0.1:10443"
const trustCenterHTTPSAddr = "127.0.0.1:443"
type GraphQLRequest struct {
Query string `json:"query"`
@@ -216,8 +216,8 @@ func ConsoleGraphQLWithAccessToken(
// trustHTTPClient builds an HTTP client that always dials the dedicated
// trust-center HTTPS listener on loopback while presenting the compliance
// page's host as TLS SNI. Certificates are Pebble-issued for e2e, so
// verification is skipped.
// page's host as TLS SNI. Certificates are step-ca-issued for e2e, so
// verification is skipped when the root is not installed in the test runner.
func trustHTTPClient(serverName string) *http.Client {
return trustHTTPClientWithJar(serverName, nil)
}
@@ -234,7 +234,7 @@ func trustHTTPClientWithJar(serverName string, jar http.CookieJar) *http.Client
},
TLSClientConfig: &tls.Config{
ServerName: serverName,
InsecureSkipVerify: true, //nolint:gosec // e2e talks to Pebble-issued certs on loopback.
InsecureSkipVerify: true, //nolint:gosec // e2e talks to step-ca-issued certs on loopback.
},
},
}

6
e2e/internal/testutil/testutil.go
View File

@@ -298,11 +298,11 @@ func generateConfig() (string, error) {
// yields {slug}.probopage.localhost subdomains for pages without a
// customer custom domain.
"PROBOD_TRUST_CENTER_HTTP_ADDR": ":10080",
"PROBOD_TRUST_CENTER_HTTPS_ADDR": ":10443",
"PROBOD_TRUST_CENTER_HTTPS_ADDR": ":443",
"PROBOD_TRUST_CENTER_BASE_DOMAIN": "probopage.localhost",
// Keep certificate provisioning snappy so trust-center e2e flows do not
// wait on the default 30s poll (Pebble runs with PEBBLE_VA_ALWAYS_VALID).
// wait on the default 30s poll (step-ca validates HTTP-01 via port 80).
"PROBOD_CUSTOM_DOMAINS_PROVISION_INTERVAL": "1",
// AWS / S3 (SeaweedFS).
@@ -321,7 +321,7 @@ func generateConfig() (string, error) {
// Custom domains.
"PROBOD_CUSTOM_DOMAINS_CNAME_TARGET": "custom.test.getprobo.com",
"PROBOD_ACME_DIRECTORY": "https://localhost:14000/dir",
"PROBOD_ACME_DIRECTORY": "https://localhost:9000/acme/acme/directory",
"PROBOD_ACME_EMAIL": "admin@test.getprobo.com",
}