subplz-web/infra/burst/workers/hetzner/tests/hetzner.tftest.hcl

infra/burst/workers/hetzner/tests/hetzner.tftest.hcl (2167 bytes)
1 # terraform test with a mock provider: no account and no cost.
2 
3 mock_provider "hcloud" {}
4 
5 override_data {
6   target = data.terraform_remote_state.state
7   values = {
8     outputs = {
9       worker = {
10         web_server_ip      = "198.44.53.27"
11         ssh_port           = 22
12         known_hosts        = "198.44.53.27 ssh-ed25519 AAAAhostkey"
13         tunnel_private_key = "-----BEGIN OPENSSH PRIVATE KEY-----\nTUNNELKEY\n-----END OPENSSH PRIVATE KEY-----\n"
14         database_url       = "postgresql+psycopg://subplz:pgpw@127.0.0.1:5432/subplz"
15         redis_url          = "redis://:redispw@127.0.0.1:6379/0"
16         bucket             = "subplz-files"
17         s3_prefix          = "jobs/"
18         storage_env        = "AWS_ACCESS_KEY_ID=kid\nAWS_SECRET_ACCESS_KEY=secret\nAWS_ENDPOINT_URL_S3=https://acct.r2.cloudflarestorage.com\nAWS_DEFAULT_REGION=auto\n"
19       }
20     }
21   }
22 }
23 
24 variables {
25   workers = {
26     "subplz-burst-1790000000-0" = { ref = "0123456789abcdef0123456789abcdef01234567", machine = "cx33", zone = "fsn1" }
27   }
28 }
29 
30 run "one_server_for_each_worker_behind_a_closed_firewall" {
31   command = plan
32 
33   assert {
34     condition = alltrue([for n, s in hcloud_server.worker :
35       s.server_type == "cx33" && s.location == "fsn1" && s.image == "debian-12"
36     ])
37     error_message = "Each worker must be a Debian 12 server of its type, in its location."
38   }
39   assert {
40     condition     = length(hcloud_firewall.worker.rule) == 0
41     error_message = "The firewall must have no inbound rule, so that it drops all inbound traffic."
42   }
43 }
44 
45 run "the_cloud_config_names_the_host_and_opens_the_tunnel" {
46   command = plan
47 
48   assert {
49     condition = alltrue([for n, s in hcloud_server.worker :
50       yamldecode(s.user_data).hostname == n
51       && strcontains(s.user_data, "subplz-tunnel@198.44.53.27")
52       && strcontains(s.user_data, "SUBPLZ_WEB_WORKER_QUEUES=paid\n")
53     ])
54     error_message = "The server must name itself, open the tunnel, and take paid jobs."
55   }
56 }
57 
58 run "a_short_ref_is_refused" {
59   command = plan
60 
61   variables {
62     workers = { "subplz-burst-1-0" = { ref = "0123abc", machine = "cx33", zone = "fsn1" } }
63   }
64 
65   expect_failures = [var.workers]
66 }