certbot-application-test.yml

name: Application Tests - Certbot

on:
  push:
  pull_request:
    branches: [ devel ]
  schedule:
    # * is a special character in YAML so you have to quote this string
    - cron:  '0 2 * * 6'

jobs:

  certbot_tests:
    name: "certbot_tests"
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        keylength: [2048, 4096]
        websrv: ['apache2', 'nginx']
        dbhandler: ['wsgi', 'django']
    steps:
    - name: "checkout GIT"
      uses: actions/checkout@v4

    - name: "Build container"
      uses: ./.github/actions/container_prep
      with:
        DB_HANDLER: ${{ matrix.dbhandler }}
        WEB_SRV: ${{ matrix.websrv }}

    - name: "Setup openssl ca_handler"
      run: |
        sudo cp .github/acme2certifier.pem examples/Docker/data/acme2certifier.pem
        sudo cp .github/acme2certifier_cert.pem examples/Docker/data/acme2certifier_cert.pem
        sudo cp .github/acme2certifier_key.pem examples/Docker/data/acme2certifier_key.pem
        sudo cp .github/django_settings.py examples/Docker/data/settings.py
        sudo cp examples/ca_handler/openssl_ca_handler.py examples/Docker/data/ca_handler.py
        sudo mkdir -p examples/Docker/data/acme_ca/certs
        sudo cp test/ca/sub-ca-key.pem test/ca/sub-ca-crl.pem test/ca/sub-ca-cert.pem test/ca/root-ca-cert.pem examples/Docker/data/acme_ca/
        sudo cp .github/openssl_ca_handler.py_acme_srv_default_handler.cfg examples/Docker/data/acme_srv.cfg
        cd examples/Docker/
        docker-compose restart

    - name: "Sleep for 10s"
      uses: juliangruber/sleep-action@v2.0.3
      with:
        time: 10s

    - name: "Test http://acme-srv/directory is accessible"
      run: docker run -i --rm --network acme curlimages/curl -f http://acme-srv/directory

    - name: "Test if https://acme-srv/directory is accessible"
      run: docker run -i --rm --network acme curlimages/curl --insecure -f https://acme-srv/directory

    - name: "Create letsencrypt folder"
      run: |
        mkdir certbot

    - name: "Register certbot"
      run: |
        docker run -i --rm --name certbot --network acme -v $PWD/certbot:/etc/letsencrypt/ certbot/certbot register --agree-tos -m 'certbot@example.com' --server http://acme-srv --no-eff-email

    - name: "Enroll HTTP-01 single domain certbot"
      run: |
        docker run -i --rm --name certbot --network acme -v $PWD/certbot:/etc/letsencrypt/ certbot/certbot certonly --rsa-key-size ${{ matrix.keylength }} --server http://acme-srv --standalone --preferred-challenges http -d certbot.acme --cert-name certbot
        sudo openssl verify -CAfile examples/Docker/data/acme_ca/root-ca-cert.pem -untrusted examples/Docker/data/acme_ca/sub-ca-cert.pem certbot/live/certbot/cert.pem

    - name: "Renew HTTP-01 single domain certbot"
      run: |
        docker run -i --rm --name certbot --network acme -v $PWD/certbot:/etc/letsencrypt/ certbot/certbot certonly --rsa-key-size ${{ matrix.keylength }} --server http://acme-srv --standalone --preferred-challenges http -d certbot.acme --cert-name certbot
        sudo openssl verify -CAfile examples/Docker/data/acme_ca/root-ca-cert.pem -untrusted examples/Docker/data/acme_ca/sub-ca-cert.pem certbot/live/certbot/cert.pem

    - name: "REvoke HTTP-01 single domain certbot"
      run: |
        docker run -i --rm --name certbot --network acme -v $PWD/certbot:/etc/letsencrypt/ certbot/certbot revoke --delete-after-revoke --server http://acme-srv  -d certbot.acme --cert-name certbot

    - name: "Enroll HTTP-01 2x domain certbot"
      run: |
        docker run -i --rm --name certbot --network acme -v $PWD/certbot:/etc/letsencrypt/ certbot/certbot certonly --rsa-key-size ${{ matrix.keylength }} --server http://acme-srv --standalone --preferred-challenges http -d certbot.acme -d certbot. --cert-name certbot
        sudo openssl verify -CAfile examples/Docker/data/acme_ca/root-ca-cert.pem -untrusted examples/Docker/data/acme_ca/sub-ca-cert.pem certbot/live/certbot/cert.pem

    - name: "Renew HTTP-01 single domain certbot"
      run: |
        docker run -i --rm --name certbot --network acme -v $PWD/certbot:/etc/letsencrypt/ certbot/certbot certonly --rsa-key-size ${{ matrix.keylength }} --server http://acme-srv --standalone --preferred-challenges http -d certbot.acme -d certbot. --cert-name certbot
        sudo openssl verify -CAfile examples/Docker/data/acme_ca/root-ca-cert.pem -untrusted examples/Docker/data/acme_ca/sub-ca-cert.pem certbot/live/certbot/cert.pem

    - name: "Revoke HTTP-01 single domain certbot"
      run: |
        docker run -i --rm --name certbot --network acme -v $PWD/certbot:/etc/letsencrypt/ certbot/certbot revoke --delete-after-revoke --server http://acme-srv  -d certbot.acme -d certbot. --cert-name certbot

    - name: "Check container configuration"
      uses: ./.github/actions/container_check
      with:
        DB_HANDLER: ${{ matrix.dbhandler }}
        WEB_SRV: ${{ matrix.websrv }}

    - name: "[ * ] collecting test logs"
      if: ${{ failure() }}
      run: |
        mkdir -p ${{ github.workspace }}/artifact/upload
        sudo cp -rp examples/Docker/data/ ${{ github.workspace }}/artifact/data/
        sudo cp -rp certbot/ ${{ github.workspace }}/artifact/certbot/
        cd examples/Docker
        docker-compose logs > ${{ github.workspace }}/artifact/docker-compose.log
        sudo tar -C ${{ github.workspace }}/artifact/ -cvzf ${{ github.workspace }}/artifact/upload/artifact.tar.gz docker-compose.log data certbot

    - name: "[ * ] uploading artificates"
      uses: actions/upload-artifact@v4
      if: ${{ failure() }}
      with:
        name: certbot_key-${{ matrix.keylength }}-${{ matrix.websrv }}-${{ matrix.dbhandler }}.tar.gz
        path: ${{ github.workspace }}/artifact/upload/