lego-application-test.yml

name: Application Tests - lego

on:
  push:
  pull_request:
    branches: [ devel ]
  schedule:
    # * is a special character in YAML so you have to quote this string
    - cron:  '0 2 * * 6'

jobs:

  lego_tests:
    name: "lego_tests"
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        keylength: [rsa2048, rsa4096, ec256]
        websrv: ['apache2', 'nginx']
        dbhandler: ['wsgi', 'django']
    steps:
    - name: "checkout GIT"
      uses: actions/checkout@v4

    - name: "create folders"
      run: |
        mkdir lego

    - name: "Build docker-compose (${{ matrix.websrv }}_${{ matrix.dbhandler }})"
      working-directory: examples/Docker/
      run: |
        sudo mkdir -p data
        sed -i "s/wsgi/$DB_HANDLER/g" .env
        sed -i "s/apache2/$WEB_SRV/g" .env
        cat .env
        docker network create acme
        docker-compose up -d
        docker-compose logs
      env:
        WEB_SRV: ${{ matrix.websrv }}
        DB_HANDLER: ${{ matrix.dbhandler }}

    - name: "Setup openssl ca_handler"
      run: |
        sudo cp .github/acme2certifier.pem examples/Docker/data/acme2certifier.pem
        sudo cp .github/acme2certifier_cert.pem examples/Docker/data/acme2certifier_cert.pem
        sudo cp .github/acme2certifier_key.pem examples/Docker/data/acme2certifier_key.pem
        sudo cp .github/django_settings.py examples/Docker/data/settings.py
        sudo cp examples/ca_handler/openssl_ca_handler.py examples/Docker/data/ca_handler.py
        sudo mkdir -p examples/Docker/data/acme_ca/certs
        sudo cp test/ca/sub-ca-key.pem test/ca/sub-ca-crl.pem test/ca/sub-ca-cert.pem test/ca/root-ca-cert.pem examples/Docker/data/acme_ca/
        sudo cp .github/openssl_ca_handler.py_acme_srv_default_handler.cfg examples/Docker/data/acme_srv.cfg
        cd examples/Docker/
        docker-compose restart
        docker-compose logs

    - name: "Sleep for 10s"
      uses: juliangruber/sleep-action@v2.0.3
      with:
        time: 10s

    - name: "Test http://acme-srv/directory is accessable"
      run: docker run -i --rm --network acme curlimages/curl -f http://acme-srv/directory

    - name: "Test if https://acme-srv/directory is accessable"
      run: docker run -i --rm --network acme curlimages/curl --insecure -f https://acme-srv/directory

    - name: "Enroll HTTP-01 single domain lego"
      run: |
        docker run -i -v $PWD/lego:/.lego/ --rm --name lego --network acme goacme/lego -s http://acme-srv -a --key-type ${{ matrix.keylength }} --email "lego@example.com" -d lego.acme --http run
        sudo openssl verify -CAfile examples/Docker/data/acme_ca/root-ca-cert.pem -untrusted examples/Docker/data/acme_ca/sub-ca-cert.pem lego/certificates/lego.acme.crt

    - name: "Renew HTTP-01 single domain lego"
      run: |
        docker run -i -v $PWD/lego:/.lego/ --rm --name lego --network acme goacme/lego -s http://acme-srv -a --key-type ${{ matrix.keylength }} --email "lego@example.com" -d lego.acme --http renew
        sudo openssl verify -CAfile examples/Docker/data/acme_ca/root-ca-cert.pem -untrusted examples/Docker/data/acme_ca/sub-ca-cert.pem lego/certificates/lego.acme.crt

    - name: "Revoke HTTP-01 single domain lego"
      run: |
        docker run -i -v $PWD/lego:/.lego/ --rm --name lego --network acme goacme/lego -s http://acme-srv -a --key-type ${{ matrix.keylength }} --email "lego@example.com" -d lego.acme revoke

    - name: "Enroll HTTP-01 2x domain lego"
      run: |
        docker run -i -v $PWD/lego:/.lego/ --rm --name lego --network acme goacme/lego -s http://acme-srv -a --key-type ${{ matrix.keylength }} --email "lego@example.com" -d lego.acme -d lego --http run
        sudo openssl verify -CAfile examples/Docker/data/acme_ca/root-ca-cert.pem -untrusted examples/Docker/data/acme_ca/sub-ca-cert.pem lego/certificates/lego.acme.crt

    - name: "Renew HTTP-01 2x domain lego"
      run: |
        docker run -i -v $PWD/lego:/.lego/ --rm --name lego --network acme goacme/lego -s http://acme-srv -a --key-type ${{ matrix.keylength }} --email "lego@example.com" -d lego.acme -d lego --http renew
        sudo openssl verify -CAfile examples/Docker/data/acme_ca/root-ca-cert.pem -untrusted examples/Docker/data/acme_ca/sub-ca-cert.pem lego/certificates/lego.acme.crt

    - name: "Revoke HTTP-01 2x domain lego"
      run: |
        docker run -i -v $PWD/lego:/.lego/ --rm --name lego --network acme goacme/lego -s http://acme-srv -a --key-type ${{ matrix.keylength }} --email "lego@example.com" -d lego.acme revoke

    - name: "[ * ] collecting test logs"
      if: ${{ failure() }}
      run: |
        mkdir -p ${{ github.workspace }}/artifact/upload
        sudo cp -rp examples/Docker/data/ ${{ github.workspace }}/artifact/data/
        sudo cp -rp lego/ ${{ github.workspace }}/artifact/lego/
        cd examples/Docker
        docker-compose logs > ${{ github.workspace }}/artifact/docker-compose.log
        sudo tar -C ${{ github.workspace }}/artifact/ -cvzf ${{ github.workspace }}/artifact/upload/artifact.tar.gz docker-compose.log data lego

    - name: "[ * ] uploading artificates"
      uses: actions/upload-artifact@v4
      if: ${{ failure() }}
      with:
        name: lego_tests-${{ matrix.keylength }}-${{ matrix.websrv }}-${{ matrix.dbhandler }}.tar.gz
        path: ${{ github.workspace }}/artifact/upload/