91 lines
3.5 KiB
Python
91 lines
3.5 KiB
Python
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[3]
|
|
BACKUP_GITEA = ROOT / "scripts" / "backup" / "backup-gitea.sh"
|
|
BACKUP_CONFIGS = ROOT / "scripts" / "backup" / "backup-configs.sh"
|
|
|
|
|
|
def test_backup_gitea_writes_full_server_component_receipts() -> None:
|
|
text = BACKUP_GITEA.read_text(encoding="utf-8")
|
|
|
|
assert "write_gitea_full_backup_receipt" in text
|
|
assert "awoooi_gitea_full_backup_component_receipt" in text
|
|
assert "awoooi_gitea_full_backup_restore_drill_performed" in text
|
|
assert "awoooi_gitea_full_backup_secret_value_collected" in text
|
|
assert "awoooi_gitea_full_backup_production_restore_performed" in text
|
|
assert "offline_gitea_dump" in text
|
|
assert "--volumes-from" in text
|
|
assert "--pull=never" in text
|
|
assert "docker stop --time" in text
|
|
assert "start_and_verify_primary" in text
|
|
assert "gitea-full-backup-restore-drill.sh" in text
|
|
assert "GITEA_FULL_BACKUP_COMPONENTS" in text
|
|
|
|
for component in [
|
|
"database",
|
|
"repositories",
|
|
"app_settings",
|
|
"lfs_objects",
|
|
"package_registry",
|
|
"attachments",
|
|
"actions_logs",
|
|
"actions_artifacts",
|
|
"avatars",
|
|
"hooks_custom_assets",
|
|
]:
|
|
assert component in text
|
|
|
|
|
|
def test_backup_gitea_receipt_contract_stays_no_secret_no_restore() -> None:
|
|
text = BACKUP_GITEA.read_text(encoding="utf-8")
|
|
|
|
assert "awoooi_gitea_full_backup_secret_value_collected" in text
|
|
assert "awoooi_gitea_full_backup_production_restore_performed" in text
|
|
assert "awoooi_gitea_full_backup_restore_drill_performed" in text
|
|
assert (
|
|
'restore_drill_performed{host=\\"${host}\\",service=\\"${service_label}\\"} ${structural_drill_performed}'
|
|
in text
|
|
)
|
|
assert (
|
|
'secret_value_collected{host=\\"${host}\\",service=\\"${service_label}\\"} 0'
|
|
in text
|
|
)
|
|
assert (
|
|
'production_restore_performed{host=\\"${host}\\",service=\\"${service_label}\\"} 0'
|
|
in text
|
|
)
|
|
|
|
|
|
def test_backup_gitea_is_bounded_and_fail_safe_around_the_offline_window() -> None:
|
|
text = BACKUP_GITEA.read_text(encoding="utf-8")
|
|
|
|
assert 'GITEA_BACKUP_LOCK="${GITEA_BACKUP_LOCK:-/tmp/gitea-backup.lock}"' in text
|
|
assert "flock -n 9" in text
|
|
assert "trap cleanup EXIT" in text
|
|
assert 'if [ "${PRIMARY_STOPPED}" -eq 1 ]' in text
|
|
assert "wait_for_primary_health" in text
|
|
assert "http://127.0.0.1:3001/api/healthz" in text
|
|
assert '--kill-after="${GITEA_DUMP_KILL_AFTER_SECONDS}s"' in text
|
|
assert "bounded_docker_control rm -f" in text
|
|
assert 'GITEA_MAX_OUTAGE_SECONDS="${GITEA_MAX_OUTAGE_SECONDS:-600}"' in text
|
|
assert "configured_outage_bound" in text
|
|
assert "--security-opt no-new-privileges:true" in text
|
|
assert '--cpus "${BACKUP_DOCKER_CPUS}"' in text
|
|
assert '--memory "${BACKUP_DOCKER_MEMORY}"' in text
|
|
assert '--memory-swap "${BACKUP_DOCKER_MEMORY_SWAP}"' in text
|
|
assert "awoooi_gitea_full_backup_consistent_offline_window" in text
|
|
assert "awoooi_gitea_full_backup_service_restart_verified" in text
|
|
assert "awoooi_gitea_full_backup_service_outage_seconds" in text
|
|
|
|
|
|
def test_gitea_runner_configuration_is_in_the_encrypted_config_backup() -> None:
|
|
text = BACKUP_CONFIGS.read_text(encoding="utf-8")
|
|
|
|
assert "/home/wooo/vibework-act-runner/config.yaml" in text
|
|
assert 'record_config_status "110-gitea-runner-config" true true "110"' in text
|
|
assert 'record_config_status "110-gitea-runner-config" true false "110"' in text
|
|
assert "/home/wooo/vibework-act-runner/data" not in text
|