ca-container-user-service-test.yml

name: CA container user service

on: workflow_call

env:
  DS_IMAGE: ${{ vars.DS_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get -y install jq

      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve PKI images
        uses: actions/cache@v4
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up DS container
        run: |
          tests/bin/ds-create.sh \
              --image=${{ env.DS_IMAGE }} \
              --hostname=ds.example.com \
              --network=example \
              --network-alias=ds.example.com \
              --password=Secret.123 \
              ds

      - name: Set up PKI container
        run: |
          tests/bin/runner-init.sh \
              --hostname=ca.example.com \
              --network=example \
              pki

      - name: Install Podman
        run: |
          docker exec pki dnf install -y podman fuse-overlayfs
          echo "cat /usr/containers/storage.conf"
          docker exec pki cat /usr/containers/storage.conf
          echo "cat /etc/containers/storage.conf"
          docker exec pki cat /etc/containers/storage.conf
          echo "cat /root/.config/containers/storage.conf"
          docker exec pki cat /root/.config/containers/storage.conf
          docker exec pki podman info

      - name: Configure rootless container
        run: |
          # enable SETUID and SETGID capabilities
          # https://github.com/containers/podman/discussions/21739
          docker exec pki setcap cap_setuid+ep /usr/bin/newuidmap
          docker exec pki setcap cap_setgid+ep /usr/bin/newgidmap

          # enable login shell
          docker exec pki usermod -s /bin/bash pkiuser

          # enable access to systemd journal
          docker exec pki usermod -a -G systemd-journal pkiuser

          # add subordinate UID and GID ranges
          # https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md
          docker exec pki usermod --add-subuids 100000-165535 --add-subgids 100000-165535 pkiuser

          # enable systemd linger
          # https://blog.christophersmart.com/2021/02/20/rootless-podman-containers-under-system-accounts-managed-and-enabled-at-boot-with-systemd/
          docker exec pki loginctl enable-linger pkiuser

          # use fuse-overlayfs
          # https://github.com/containers/podman/issues/8705#issuecomment-744357805
          docker exec -u pkiuser pki mkdir -p /home/pkiuser/.config/containers
          docker exec -i -u pkiuser pki tee /home/pkiuser/.config/containers/storage.conf << EOF
          [storage]
          driver = "overlay"

          [storage.options.overlay]
          mount_program = "/usr/bin/fuse-overlayfs"
          EOF

          docker exec -u pkiuser pki podman system info --format=json | tee output

          # rootless should be enabled
          echo "true" > expected
          jq -r '.host.security.rootless' output > actual
          diff expected actual

      - name: Load PKI images into PKI user's space
        run: |
          docker cp pki-images.tar pki:/home/pkiuser
          docker exec pki chown pkiuser /home/pkiuser/pki-images.tar

          docker exec -u pkiuser pki podman load --input /home/pkiuser/pki-images.tar
          docker exec -u pkiuser pki podman images

      - name: Create shared folders in PKI user's home directory
        run: |
          # create folders with default owner and permissions
          docker exec -u pkiuser pki mkdir -p /home/pkiuser/.dogtag/pki-ca/conf
          docker exec -u pkiuser pki mkdir -p /home/pkiuser/.dogtag/pki-ca/logs

          docker exec pki ls -laR /home/pkiuser

      - name: Create CA user service
        run: |
          # create container unit file
          # https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html
          docker exec -u pkiuser pki mkdir -p /home/pkiuser/.config/containers/systemd
          docker exec -i -u pkiuser pki tee /home/pkiuser/.config/containers/systemd/pki-ca.container << EOF
          [Unit]
          Description=PKI CA

          [Container]
          Image=pki-ca
          Network=host

          # run container as PKI user
          User=pkiuser
          Group=pkiuser
          UserNS=keep-id

          # use shared folders in home directory
          Volume=/home/pkiuser/.dogtag/pki-ca/conf:/conf
          Volume=/home/pkiuser/.dogtag/pki-ca/logs:/logs

          # configure DS connection
          Environment=PKI_DS_URL=ldap://ds.example.com:3389
          Environment=PKI_DS_PASSWORD=Secret.123

          [Install]
          WantedBy=multi-user.target
          EOF

          # check service unit file generated by Quadlet
          docker exec -u pkiuser pki /usr/libexec/podman/quadlet -dryrun -user

          # reload service unit files using login shell
          docker exec pki sudo -i -u pkiuser systemctl --user daemon-reload

      - name: Run CA user service
        run: |
          # start service using login shell
          docker exec pki sudo -i -u pkiuser systemctl --user start pki-ca.service
          docker exec -u pkiuser pki podman ps

          # wait for CA to start
          docker exec -u pkiuser pki curl \
              --retry 180 \
              --retry-delay 0 \
              --retry-connrefused \
              -s \
              -k \
              -o /dev/null \
              https://ca.example.com:8443

      - name: Check conf dir
        if: always()
        run: |
          docker exec -u pkiuser pki ls -l /home/pkiuser/.dogtag/pki-ca/conf \
              | sed \
                  -e '/^total/d' \
                  -e 's/^\(\S*\) *\S* *\S* *\(\S*\) *\S* *\S* *\S* *\S* *\(.*\)$/\1 \2 \3/' \
              | tee output

          # everything should be owned by pkiuser group
          # TODO: review owners/permissions
          cat > expected << EOF
          drwxrwxrwx pkiuser Catalina
          drwxrwxrwx pkiuser alias
          drwxrwxrwx pkiuser ca
          -rw-rw-rw- pkiuser catalina.policy
          lrwxrwxrwx pkiuser catalina.properties -> /usr/share/pki/server/conf/catalina.properties
          drwxrwxrwx pkiuser certs
          lrwxrwxrwx pkiuser context.xml -> /etc/tomcat/context.xml
          -rw-rw-rw- pkiuser jss.conf
          lrwxrwxrwx pkiuser logging.properties -> /usr/share/pki/server/conf/logging.properties
          -rw-rw-rw- pkiuser password.conf
          -rw-rw-rw- pkiuser server.xml
          -rw-rw-rw- pkiuser serverCertNick.conf
          -rw-rw-rw- pkiuser tomcat.conf
          lrwxrwxrwx pkiuser web.xml -> /etc/tomcat/web.xml
          EOF

          diff expected output

      - name: Check conf/alias dir
        if: always()
        run: |
          docker exec -u pkiuser pki ls -l /home/pkiuser/.dogtag/pki-ca/conf/alias \
              | sed \
                  -e '/^total/d' \
                  -e 's/^\(\S*\) *\S* *\S* *\(\S*\) *\S* *\S* *\S* *\S* *\(.*\)$/\1 \2 \3/' \
              | tee output

          # everything should be owned by pkiuser group
          # TODO: review owners/permissions
          cat > expected << EOF
          -rw-rw-rw- pkiuser ca.crt
          -rw-rw-rw- pkiuser cert9.db
          -rw-rw-rw- pkiuser key4.db
          -rw-rw-rw- pkiuser pkcs11.txt
          EOF

          diff expected output

      - name: Check conf/ca dir
        if: always()
        run: |
          docker exec -u pkiuser pki ls -l /home/pkiuser/.dogtag/pki-ca/conf/ca \
              | sed \
                  -e '/^total/d' \
                  -e 's/^\(\S*\) *\S* *\S* *\(\S*\) *\S* *\S* *\S* *\S* *\(.*\)$/\1 \2 \3/' \
                  -e '/^\S* *\S* *\S* *CS.cfg.bak /d' \
              | tee output

          # everything should be owned by pkiuser group
          # TODO: review owners/permissions
          cat > expected << EOF
          -rw-rw-rw- pkiuser CS.cfg
          -rw-rw-rw- pkiuser adminCert.profile
          drwxrwxrwx pkiuser archives
          -rw-rw-rw- pkiuser caAuditSigningCert.profile
          -rw-rw-rw- pkiuser caCert.profile
          -rw-rw-rw- pkiuser caOCSPCert.profile
          drwxrwxrwx pkiuser emails
          -rw-rw-rw- pkiuser flatfile.txt
          drwxrwxrwx pkiuser profiles
          -rw-rw-rw- pkiuser proxy.conf
          -rw-rw-rw- pkiuser registry.cfg
          -rw-rw-rw- pkiuser serverCert.profile
          -rw-rw-rw- pkiuser subsystemCert.profile
          EOF

          diff expected output

      - name: Check logs dir
        if: always()
        run: |
          docker exec -u pkiuser pki ls -l /home/pkiuser/.dogtag/pki-ca/logs \
              | sed \
                  -e '/^total/d' \
                  -e 's/^\(\S*\) *\S* *\S* *\(\S*\) *\S* *\S* *\S* *\S* *\(.*\)$/\1 \2 \3/' \
              | tee output

          DATE=$(date +'%Y-%m-%d')

          # everything should be owned by pkiuser group
          # TODO: review owners/permissions
          cat > expected << EOF
          drwxrwx--- pkiuser backup
          drwxrwxrwx pkiuser ca
          -rw-rw-rw- pkiuser catalina.$DATE.log
          -rw-rw-rw- pkiuser host-manager.$DATE.log
          -rw-rw-rw- pkiuser localhost.$DATE.log
          -rw-rw-rw- pkiuser localhost_access_log.$DATE.txt
          -rw-rw-rw- pkiuser manager.$DATE.log
          drwxrwxrwx pkiuser pki
          EOF

          diff expected output

      - name: Check CA info
        run: |
          docker exec -u pkiuser pki podman exec systemd-pki-ca \
              pki-server cert-export \
              --cert-file /conf/certs/ca_signing.crt \
              ca_signing

          docker exec -u pkiuser pki pki nss-cert-import \
              --cert /home/pkiuser/.dogtag/pki-ca/conf/certs/ca_signing.crt \
              --trust CT,C,C \
              ca_signing

          docker exec -u pkiuser pki pki info

      # https://github.com/dogtagpki/pki/wiki/Setting-up-CA-Database
      - name: Initialize CA database
        run: |
          docker exec -u pkiuser pki podman exec systemd-pki-ca \
              pki-server ca-db-init -v
          docker exec -u pkiuser pki podman exec systemd-pki-ca \
              pki-server ca-db-index-add -v
          docker exec -u pkiuser pki podman exec systemd-pki-ca \
              pki-server ca-db-index-rebuild -v
          docker exec -u pkiuser pki podman exec systemd-pki-ca \
              pki-server ca-db-vlv-add -v
          docker exec -u pkiuser pki podman exec systemd-pki-ca \
              pki-server ca-db-vlv-reindex -v

      - name: Create admin cert
        run: |
          # create cert request
          docker exec -u pkiuser pki pki nss-cert-request \
              --subject "CN=Administrator" \
              --ext /usr/share/pki/server/certs/admin.conf \
              --csr /home/pkiuser/admin.csr

          docker exec -u pkiuser pki podman cp /home/pkiuser/admin.csr systemd-pki-ca:/home/pkiuser

          # issue cert
          docker exec -u pkiuser pki podman exec systemd-pki-ca pki-server ca-cert-create \
              --csr /home/pkiuser/admin.csr \
              --profile /usr/share/pki/ca/conf/rsaAdminCert.profile \
              --cert /home/pkiuser/admin.crt \
              --import-cert

          docker exec -u pkiuser pki podman cp systemd-pki-ca:/home/pkiuser/admin.crt /home/pkiuser

          # import cert
          docker exec -u pkiuser pki pki nss-cert-import \
              --cert /home/pkiuser/admin.crt \
              admin

      # https://github.com/dogtagpki/pki/wiki/Setting-up-CA-Admin-User
      - name: Add CA admin user
        run: |
          # create CA admin user
          docker exec -u pkiuser pki podman exec systemd-pki-ca \
              pki-server ca-user-add \
              --full-name Administrator \
              --type adminType \
              --cert /home/pkiuser/admin.crt \
              admin

          # add CA admin user into CA groups
          docker exec -u pkiuser pki podman exec systemd-pki-ca \
              pki-server ca-user-role-add admin "Administrators"
          docker exec -u pkiuser pki podman exec systemd-pki-ca \
              pki-server ca-user-role-add admin "Certificate Manager Agents"

      - name: Check CA admin user
        run: |
          docker exec -u pkiuser pki pki \
              -n admin \
              ca-user-show \
              admin

      - name: Check cert enrollment
        run: |
          docker exec -u pkiuser pki pki \
              client-cert-request \
              uid=testuser | tee output

          REQUEST_ID=$(sed -n -e 's/^ *Request ID: *\(.*\)$/\1/p' output)
          echo "REQUEST_ID: $REQUEST_ID"

          docker exec -u pkiuser pki pki \
              -n admin \
              ca-cert-request-approve \
              $REQUEST_ID \
              --force

      - name: Check DS server systemd journal
        if: always()
        run: |
          docker exec ds journalctl -x --no-pager -u dirsrv@localhost.service

      - name: Check DS container logs
        if: always()
        run: |
          docker logs ds

      - name: Check CA container systemd journal
        if: always()
        run: |
          docker exec -u pkiuser pki journalctl --user -x --no-pager -u pki-ca.service

      - name: Check CA container logs
        if: always()
        run: |
          docker exec -u pkiuser pki podman logs systemd-pki-ca 2>&1

      - name: Check CA debug logs
        if: always()
        run: |
          docker exec -u pkiuser pki find /home/pkiuser/.dogtag/pki-ca/logs/ca -name "debug.*" -exec cat {} \;

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh ds
          tests/bin/pki-artifacts-save.sh pki

          docker cp pki:/home/pkiuser/.dogtag/pki-ca /tmp/artifacts/ca
          docker exec -u pkiuser pki podman logs systemd-pki-ca > /tmp/artifacts/ca/container.out 2> /tmp/artifacts/ca/container.err

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ca-container-user-service
          path: /tmp/artifacts