Paul Payne
fc83ce40c1
- A static service is inherently exposed, so `public: true` no longer trips the "requires proxy" validator — frontends can be public via the tunnel for free (the original friction that started this refactor, now resolved). - docs/registry.md: the manager model (systemd/caddy/path/none), the runner→manager table incl. static/path, and behavior as a derived display label.
83 lines
3.0 KiB
Python
83 lines
3.0 KiB
Python
"""Tests for cloudflared tunnel ingress generation."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import yaml
|
|
|
|
from castle_core.generators.tunnel import (
|
|
generate_tunnel_config,
|
|
public_hostnames,
|
|
)
|
|
from castle_core.registry import Deployment, NodeConfig, NodeRegistry
|
|
|
|
|
|
def _registry(
|
|
*,
|
|
tunnel_id: str | None = "tid-123",
|
|
public_domain: str | None = "pub.payne.io",
|
|
gateway_domain: str | None = "civil.payne.io",
|
|
deployed: dict[str, Deployment] | None = None,
|
|
) -> NodeRegistry:
|
|
return NodeRegistry(
|
|
node=NodeConfig(
|
|
hostname="civil",
|
|
gateway_tls="acme",
|
|
gateway_domain=gateway_domain,
|
|
public_domain=public_domain,
|
|
tunnel_id=tunnel_id,
|
|
),
|
|
deployed=deployed
|
|
or {
|
|
"app": Deployment(runner="python", run_cmd=["x"], port=9001,
|
|
subdomain="app", public=True),
|
|
"private": Deployment(runner="python", run_cmd=["y"], port=9002,
|
|
subdomain="private", public=False),
|
|
},
|
|
)
|
|
|
|
|
|
def test_public_service_maps_public_zone_to_internal_host() -> None:
|
|
cfg = yaml.safe_load(generate_tunnel_config(_registry()))
|
|
assert cfg["tunnel"] == "tid-123"
|
|
rules = {r.get("hostname"): r for r in cfg["ingress"] if "hostname" in r}
|
|
# only the public service is mapped
|
|
assert set(rules) == {"app.pub.payne.io"}
|
|
r = rules["app.pub.payne.io"]
|
|
assert r["service"] == "https://localhost:443"
|
|
# public zone → internal host (Host + SNI rewritten so Caddy routes + cert validates)
|
|
assert r["originRequest"]["httpHostHeader"] == "app.civil.payne.io"
|
|
assert r["originRequest"]["originServerName"] == "app.civil.payne.io"
|
|
|
|
|
|
def test_terminal_catch_all_present() -> None:
|
|
cfg = yaml.safe_load(generate_tunnel_config(_registry()))
|
|
assert cfg["ingress"][-1] == {"service": "http_status:404"}
|
|
|
|
|
|
def test_private_service_not_in_public_dns() -> None:
|
|
assert public_hostnames(_registry()) == ["app.pub.payne.io"]
|
|
|
|
|
|
def test_none_when_no_public_services() -> None:
|
|
only_private = {
|
|
"x": Deployment(runner="python", run_cmd=["x"], subdomain="x", public=False)
|
|
}
|
|
assert generate_tunnel_config(_registry(deployed=only_private)) is None
|
|
|
|
|
|
def test_none_when_tunnel_unconfigured() -> None:
|
|
assert generate_tunnel_config(_registry(tunnel_id=None)) is None
|
|
assert generate_tunnel_config(_registry(public_domain=None)) is None
|
|
|
|
|
|
def test_public_static_frontend_gets_ingress() -> None:
|
|
# A `static` (frontend) service can be public too — the toggle composes for
|
|
# any exposed deployment, process-backed or not.
|
|
reg = _registry(deployed={
|
|
"guestbook": Deployment(runner="static", run_cmd=[], subdomain="guestbook",
|
|
static_root="/data/repos/guestbook/public", public=True),
|
|
})
|
|
hosts = {r["hostname"] for r in yaml.safe_load(generate_tunnel_config(reg))["ingress"]
|
|
if "hostname" in r}
|
|
assert hosts == {"guestbook.pub.payne.io"}
|