server-https-nss-test.yml

name: HTTPS connector with NSS database

on: workflow_call

env:
  DB_IMAGE: ${{ vars.DB_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  # docs/admin/server/Configuring-HTTPS-Connector-with-NSS-Database.adoc
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v3

      - name: Retrieve PKI images
        uses: actions/cache@v3
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up server container
        run: |
          tests/bin/runner-init.sh pki
        env:
          HOSTNAME: pki.example.com

      - name: Connect server container to network
        run: docker network connect example pki --alias pki.example.com

      - name: Create PKI server
        run: |
          docker exec pki pki-server create -v

      - name: Create NSS database in PKI server
        run: |
          docker exec pki pki-server nss-create --no-password

      - name: Create SSL server cert
        run: |
          docker exec pki pki -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-request \
              --subject "CN=$HOSTNAME" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr sslserver.csr
          docker exec pki pki -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-issue \
              --csr sslserver.csr \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --cert sslserver.crt
          docker exec pki pki -d /var/lib/pki/pki-tomcat/alias \
              nss-cert-import \
              --cert sslserver.crt \
              sslserver

      - name: Create HTTPS connector with NSS database
        run: |
          docker exec pki pki-server jss-enable
          docker exec pki pki-server http-connector-add \
              --port 8443 \
              --scheme https \
              --secure true \
              --sslEnabled true \
              --sslProtocol SSL \
              --sslImpl org.dogtagpki.jss.tomcat.JSSImplementation \
              Secure
          docker exec pki pki-server http-connector-cert-add \
              --keyAlias sslserver \
              --keystoreType pkcs11 \
              --keystoreProvider Mozilla-JSS

      - name: Start PKI server
        run: |
          docker exec pki pki-server start

      - name: Set up client container
        run: |
          tests/bin/runner-init.sh client
        env:
          HOSTNAME: client.example.com

      - name: Connect client container to network
        run: docker network connect example client --alias client.example.com

      - name: Wait for PKI server to start
        run: |
          docker exec client curl \
              --retry 60 \
              --retry-delay 0 \
              --retry-connrefused \
              -s \
              -k \
              -o /dev/null \
              https://pki.example.com:8443

      - name: Stop PKI server
        run: |
          docker exec pki pki-server stop --wait -v

      - name: Remove PKI server
        run: |
          docker exec pki pki-server remove -v

      - name: Gather artifacts from server container
        if: always()
        run: |
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Upload artifacts from server container
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: server-https-nss-test
          path: |
            /tmp/artifacts/pki