ocsp-separate-test.yml

name: OCSP on separate instance

on: workflow_call

env:
  DB_IMAGE: ${{ vars.DB_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v3

      - name: Retrieve PKI images
        uses: actions/cache@v3
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up CA DS container
        run: |
          tests/bin/ds-container-create.sh cads
        env:
          IMAGE: ${{ env.DB_IMAGE }}
          HOSTNAME: cads.example.com
          PASSWORD: Secret.123

      - name: Connect CA DS container to network
        run: docker network connect example cads --alias cads.example.com

      - name: Set up CA container
        run: |
          tests/bin/runner-init.sh ca
        env:
          HOSTNAME: ca.example.com

      - name: Connect CA container to network
        run: docker network connect example ca --alias ca.example.com

      - name: Install CA in CA container
        run: |
          docker exec ca pkispawn \
              -f /usr/share/pki/server/examples/installation/ca.cfg \
              -s CA \
              -D pki_ds_url=ldap://cads.example.com:3389 \
              -v

          docker exec ca pki-server cert-find

      - name: Check security domain config in CA
        run: |
          # CA should run security domain service
          cat > expected << EOF
          securitydomain.checkIP=false
          securitydomain.checkinterval=300000
          securitydomain.flushinterval=86400000
          securitydomain.host=ca.example.com
          securitydomain.httpport=8080
          securitydomain.httpsadminport=8443
          securitydomain.name=EXAMPLE
          securitydomain.select=new
          securitydomain.source=ldap
          EOF

          docker exec ca pki-server ca-config-find | grep ^securitydomain. | sort | tee actual
          diff expected actual

      - name: Install banner in CA container
        run: docker exec ca cp /usr/share/pki/server/examples/banner/banner.txt /etc/pki/pki-tomcat

      - name: Set up OCSP DS container
        run: |
          tests/bin/ds-container-create.sh ocspds
        env:
          IMAGE: ${{ env.DB_IMAGE }}
          HOSTNAME: ocspds.example.com
          PASSWORD: Secret.123

      - name: Connect OCSP DS container to network
        run: docker network connect example ocspds --alias ocspds.example.com

      - name: Set up OCSP container
        run: |
          tests/bin/runner-init.sh ocsp
        env:
          HOSTNAME: ocsp.example.com

      - name: Connect OCSP container to network
        run: docker network connect example ocsp --alias ocsp.example.com

      - name: Install OCSP in OCSP container
        run: |
          docker exec ca pki-server cert-export ca_signing --cert-file ${SHARED}/ca_signing.crt
          docker exec ca cp /root/.dogtag/pki-tomcat/ca_admin.cert ${SHARED}/ca_admin.cert
          docker exec ocsp pkispawn \
              -f /usr/share/pki/server/examples/installation/ocsp.cfg \
              -s OCSP \
              -D pki_security_domain_hostname=ca.example.com \
              -D pki_cert_chain_nickname=ca_signing \
              -D pki_cert_chain_path=${SHARED}/ca_signing.crt \
              -D pki_admin_cert_file=${SHARED}/ca_admin.cert \
              -D pki_ds_url=ldap://ocspds.example.com:3389 \
              -v

          docker exec ocsp pki-server cert-find

      - name: Check security domain config in OCSP
        run: |
          # OCSP should join security domain in CA
          cat > expected << EOF
          securitydomain.host=ca.example.com
          securitydomain.httpport=8080
          securitydomain.httpsadminport=8443
          securitydomain.name=EXAMPLE
          securitydomain.select=existing
          EOF

          docker exec ocsp pki-server ocsp-config-find | grep ^securitydomain. | sort | tee actual
          diff expected actual

      - name: Install banner in OCSP container
        run: docker exec ocsp cp /usr/share/pki/server/examples/banner/banner.txt /etc/pki/pki-tomcat

      - name: Run PKI healthcheck
        run: docker exec ocsp pki-healthcheck --failures-only

      - name: Verify OCSP admin
        run: |
          docker exec ca cp /root/.dogtag/pki-tomcat/ca_admin_cert.p12 ${SHARED}/ca_admin_cert.p12
          docker exec ocsp pki client-cert-import ca_signing --ca-cert ${SHARED}/ca_signing.crt
          docker exec ocsp pki pkcs12-import \
              --pkcs12 ${SHARED}/ca_admin_cert.p12 \
              --pkcs12-password Secret.123
          docker exec ocsp pki -n caadmin --ignore-banner ocsp-user-show ocspadmin

      - name: Gather artifacts from CA containers
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh --output=/tmp/artifacts/ca cads
          tests/bin/pki-artifacts-save.sh ca
        continue-on-error: true

      - name: Gather artifacts from OCSP containers
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh --output=/tmp/artifacts/ocsp ocspds
          tests/bin/pki-artifacts-save.sh ocsp
        continue-on-error: true

      - name: Remove OCSP from OCSP container
        run: docker exec ocsp pkidestroy -i pki-tomcat -s OCSP -v

      - name: Remove CA from CA container
        run: docker exec ca pkidestroy -i pki-tomcat -s CA -v

      - name: Upload artifacts from CA containers
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: ocsp-separate-ca
          path: |
            /tmp/artifacts/ca

      - name: Upload artifacts from OCSP containers
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: ocsp-separate-ocsp
          path: |
            /tmp/artifacts/ocsp