6c7eed7580
Fresh history cut from cynarAI/evoo antigravity-handoff/project-timeline (Voice First + project timeline). Brand docs/titles as evOo; keep @rakazo/* packages as tech debt. Excludes node_modules, caches, secrets, voice blobs.
66 lines
2.7 KiB
TypeScript
66 lines
2.7 KiB
TypeScript
import { readFileSync } from "node:fs";
|
|
import path from "node:path";
|
|
import { describe, expect, it } from "vitest";
|
|
import { parse } from "yaml";
|
|
|
|
interface ComposeService {
|
|
environment?: Record<string, unknown>;
|
|
ports?: unknown[];
|
|
}
|
|
|
|
const repoRoot = path.resolve(import.meta.dirname, "../../..");
|
|
|
|
function loadCompose(rel: string) {
|
|
return parse(readFileSync(path.resolve(repoRoot, rel), "utf8")) as {
|
|
services: Record<string, ComposeService>;
|
|
};
|
|
}
|
|
|
|
function expectProxyPassthrough(env: Record<string, unknown> | undefined) {
|
|
expect(env?.HTTP_PROXY).toBe("${HTTP_PROXY:-${http_proxy:-}}");
|
|
expect(env?.HTTPS_PROXY).toBe("${HTTPS_PROXY:-${https_proxy:-}}");
|
|
expect(env?.NO_PROXY).toBe("${NO_PROXY:-${no_proxy:-}}");
|
|
expect(env?.http_proxy).toBe("${http_proxy:-${HTTP_PROXY:-}}");
|
|
expect(env?.https_proxy).toBe("${https_proxy:-${HTTPS_PROXY:-}}");
|
|
expect(env?.no_proxy).toBe("${no_proxy:-${NO_PROXY:-}}");
|
|
}
|
|
|
|
describe("local and topology compose proxy passthrough", () => {
|
|
it("passes optional HTTP(S)_PROXY / NO_PROXY into docker-compose.yml api/worker", () => {
|
|
const compose = loadCompose("infra/compose/docker-compose.yml");
|
|
for (const name of ["api", "worker"] as const) {
|
|
expectProxyPassthrough(compose.services[name]?.environment);
|
|
}
|
|
});
|
|
|
|
it("passes the same knobs through topology app-environment (api + worker)", () => {
|
|
const compose = loadCompose("infra/compose/docker-compose.topology.yml");
|
|
for (const name of ["api", "worker"] as const) {
|
|
expectProxyPassthrough(compose.services[name]?.environment);
|
|
}
|
|
});
|
|
});
|
|
|
|
describe("source-checkout compose postgres hardening", () => {
|
|
it("keeps postgres network-internal and requires POSTGRES_PASSWORD from .env", () => {
|
|
const compose = loadCompose("infra/compose/docker-compose.yml");
|
|
const postgres = compose.services.postgres;
|
|
expect(postgres?.ports).toBeUndefined();
|
|
expect(postgres?.environment?.POSTGRES_PASSWORD).toBe(
|
|
"${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}",
|
|
);
|
|
expect(postgres?.environment?.POSTGRES_USER).toBe("${POSTGRES_USER:-rakazo}");
|
|
expect(postgres?.environment?.POSTGRES_DB).toBe("${POSTGRES_DB:-rakazo}");
|
|
for (const name of ["api", "worker"] as const) {
|
|
expect(compose.services[name]?.environment?.DATABASE_URL).toBe(
|
|
"postgres://${POSTGRES_USER:-rakazo}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}@postgres:5432/${POSTGRES_DB:-rakazo}",
|
|
);
|
|
}
|
|
});
|
|
|
|
it("publishes loopback postgres only via the optional host overlay", () => {
|
|
const overlay = loadCompose("infra/compose/docker-compose.postgres-host.yml");
|
|
expect(overlay.services.postgres?.ports).toEqual(["127.0.0.1:5433:5432"]);
|
|
});
|
|
});
|