mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-21 22:52:19 +03:00
154c2945d1
Validado no worktree combinado: typecheck:core, changelog-integrity, complexity, cognitive-complexity, file-size, lint e teste focado (vps-compose) todos verdes. Bundle Docker aditivo, seguro-por-padrão (loopback, secrets obrigatórios, imagem pinada), bem documentado. CI vermelho é o base-red já rastreado em #9985.
63 lines
2.2 KiB
TypeScript
63 lines
2.2 KiB
TypeScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import path from "node:path";
|
|
|
|
import { load } from "js-yaml";
|
|
|
|
const REPO_ROOT = path.resolve(import.meta.dirname, "../..");
|
|
const COMPOSE_PATH = path.join(REPO_ROOT, "contrib/vps/compose.yaml");
|
|
const ENV_EXAMPLE_PATH = path.join(REPO_ROOT, "contrib/vps/.env.example");
|
|
|
|
type ComposeService = {
|
|
image?: string;
|
|
ports?: string[];
|
|
environment?: Record<string, string>;
|
|
volumes?: string[];
|
|
};
|
|
|
|
type ComposeDocument = {
|
|
services?: Record<string, ComposeService>;
|
|
};
|
|
|
|
function readCompose(): { raw: string; parsed: ComposeDocument } {
|
|
const raw = fs.readFileSync(COMPOSE_PATH, "utf8");
|
|
return { raw, parsed: load(raw) as ComposeDocument };
|
|
}
|
|
|
|
test("VPS compose publishes only the OmniRoute dashboard on loopback by default", () => {
|
|
const { parsed } = readCompose();
|
|
const services = parsed.services ?? {};
|
|
|
|
assert.deepEqual(services.redis?.ports, undefined, "Redis must not publish a host port");
|
|
assert.deepEqual(services.omniroute?.ports, [
|
|
"${OMNIROUTE_BIND_HOST:-127.0.0.1}:${OMNIROUTE_PORT:-20128}:20128",
|
|
]);
|
|
});
|
|
|
|
test("VPS compose requires an explicitly pinned image and production secrets", () => {
|
|
const { raw, parsed } = readCompose();
|
|
const omniroute = parsed.services?.omniroute;
|
|
|
|
assert.equal(
|
|
omniroute?.image,
|
|
"${OMNIROUTE_IMAGE:?Set OMNIROUTE_IMAGE to a versioned tag or digest}"
|
|
);
|
|
assert.equal(omniroute?.environment?.REQUIRE_API_KEY, "${REQUIRE_API_KEY:-true}");
|
|
assert.match(raw, /JWT_SECRET: \$\{JWT_SECRET:\?Set JWT_SECRET in \.env\}/);
|
|
assert.match(raw, /API_KEY_SECRET: \$\{API_KEY_SECRET:\?Set API_KEY_SECRET in \.env\}/);
|
|
assert.match(raw, /INITIAL_PASSWORD: \$\{INITIAL_PASSWORD:\?Set INITIAL_PASSWORD in \.env\}/);
|
|
assert.match(
|
|
raw,
|
|
/OMNIROUTE_WS_BRIDGE_SECRET: \$\{OMNIROUTE_WS_BRIDGE_SECRET:\?Set OMNIROUTE_WS_BRIDGE_SECRET in \.env\}/
|
|
);
|
|
});
|
|
|
|
test("VPS environment example uses a versioned image rather than a floating channel", () => {
|
|
const env = fs.readFileSync(ENV_EXAMPLE_PATH, "utf8");
|
|
|
|
assert.match(env, /^OMNIROUTE_IMAGE=[^\s:]+:\d+\.\d+\.\d+(?:-[a-z0-9.-]+)?$/m);
|
|
assert.doesNotMatch(env, /^OMNIROUTE_IMAGE=.*:(?:latest|next)$/m);
|
|
assert.match(env, /^REQUIRE_API_KEY=true$/m);
|
|
});
|