subplz-web/infra/burst/state/tests/state.tftest.hcl

infra/burst/state/tests/state.tftest.hcl (3720 bytes)
1 # terraform test with mock providers: no account, no cost. Only plans run:
2 # an apply would run setup-web-server.sh on this machine.
3 
4 mock_provider "cloudflare" {}
5 
6 mock_provider "random" {}
7 mock_provider "tls" {}
8 
9 # Values that exist only after apply, known during plan for the tests.
10 override_resource {
11   target          = random_password.postgres
12   override_during = plan
13   values          = { result = "pgpw" }
14 }
15 
16 override_resource {
17   target          = random_password.redis
18   override_during = plan
19   values          = { result = "redispw" }
20 }
21 
22 override_resource {
23   target          = cloudflare_api_token.files
24   override_during = plan
25   values          = { id = "token-id", value = "token-value" }
26 }
27 
28 variables {
29   cloudflare_account_id = "0123456789abcdef0123456789abcdef"
30   host_key_file         = "tests/host_key.pub"
31   # The test framework cannot mock the nested result of the permission lookup.
32   r2_permission_group_ids = ["read-group", "write-group"]
33 }
34 
35 run "the_token_can_touch_the_bucket_and_nothing_else" {
36   command = plan
37 
38   assert {
39     condition = jsondecode(cloudflare_api_token.files.policies[0].resources) == {
40       "com.cloudflare.edge.r2.bucket.0123456789abcdef0123456789abcdef_default_subplz-files" = "*"
41     }
42     error_message = "The app token must be scoped to the one bucket."
43   }
44   assert {
45     condition     = [for g in cloudflare_api_token.files.policies[0].permission_groups : g.id] == ["read-group", "write-group"]
46     error_message = "The app token must read and write objects, with no other permission."
47   }
48   assert {
49     condition     = cloudflare_r2_bucket.files.location == "wnam"
50     error_message = "The bucket must be near the web server (western North America)."
51   }
52 }
53 
54 run "workers_accept_only_the_web_server_host_key" {
55   command = plan
56 
57   assert {
58     condition     = startswith(local.known_hosts, "198.44.53.27 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakeHostKey")
59     error_message = "known_hosts must pin the web server's host key."
60   }
61 }
62 
63 run "a_port_other_than_22_is_written_the_ssh_way" {
64   command = plan
65 
66   variables {
67     ssh_port = 2222
68   }
69 
70   assert {
71     condition     = startswith(local.known_hosts, "[198.44.53.27]:2222 ssh-ed25519 ")
72     error_message = "known_hosts needs [host]:port for a port other than 22."
73   }
74 }
75 
76 run "the_databases_are_reached_on_127_0_0_1" {
77   command = plan
78 
79   assert {
80     condition     = startswith(local.database_url, "postgresql+psycopg://subplz:") && endswith(local.database_url, "@127.0.0.1:5432/subplz")
81     error_message = "Postgres must be reached through the tunnel on 127.0.0.1."
82   }
83   assert {
84     condition     = startswith(local.redis_url, "redis://:") && endswith(local.redis_url, "@127.0.0.1:6379/0")
85     error_message = "Redis must be reached through the tunnel on 127.0.0.1."
86   }
87   assert {
88     condition     = local.database_url == "postgresql+psycopg://subplz:pgpw@127.0.0.1:5432/subplz" && local.redis_url == "redis://:redispw@127.0.0.1:6379/0"
89     error_message = "The URLs must carry the generated passwords."
90   }
91   assert {
92     condition     = strcontains(local.storage_env, "AWS_ACCESS_KEY_ID=token-id\n") && strcontains(local.storage_env, "AWS_SECRET_ACCESS_KEY=${sha256("token-value")}\n")
93     error_message = "R2 takes the token id as the key id, and the SHA-256 of the token value as the secret."
94   }
95   assert {
96     condition     = strcontains(local.storage_env, "AWS_ENDPOINT_URL_S3=https://0123456789abcdef0123456789abcdef.r2.cloudflarestorage.com\n")
97     error_message = "The storage endpoint must be the account's R2 endpoint."
98   }
99 }
100 
101 run "a_bad_account_id_is_refused" {
102   command = plan
103 
104   variables {
105     cloudflare_account_id = "not-an-id"
106   }
107 
108   expect_failures = [var.cloudflare_account_id]
109 }