|
| 1 | +#!/bin/bash |
| 2 | + |
| 3 | +## Test for the LETSENCRYPT_MIN_VALIDITY environment variable. |
| 4 | + |
| 5 | +if [[ -z $TRAVIS_CI ]]; then |
| 6 | + le_container_name="$(basename ${0%/*})_$(date "+%Y-%m-%d_%H.%M.%S")" |
| 7 | +else |
| 8 | + le_container_name="$(basename ${0%/*})" |
| 9 | +fi |
| 10 | +run_le_container ${1:?} "$le_container_name" |
| 11 | + |
| 12 | +# Create the $domains array from comma separated domains in TEST_DOMAINS. |
| 13 | +IFS=',' read -r -a domains <<< "$TEST_DOMAINS" |
| 14 | + |
| 15 | +# Cleanup function with EXIT trap |
| 16 | +function cleanup { |
| 17 | + # Remove any remaining Nginx container(s) silently. |
| 18 | + for domain in "${domains[@]}"; do |
| 19 | + docker rm --force "$domain" > /dev/null 2>&1 |
| 20 | + done |
| 21 | + # Cleanup the files created by this run of the test to avoid foiling following test(s). |
| 22 | + docker exec "$le_container_name" bash -c 'rm -rf /etc/nginx/certs/le?.wtf*' |
| 23 | + # Stop the LE container |
| 24 | + docker stop "$le_container_name" > /dev/null |
| 25 | +} |
| 26 | +trap cleanup EXIT |
| 27 | + |
| 28 | +# Run a separate nginx container for each domain in the $domains array. |
| 29 | +# Default validity |
| 30 | +docker run --rm -d \ |
| 31 | + --name "${domains[0]}" \ |
| 32 | + -e "VIRTUAL_HOST=${domains[0]}" \ |
| 33 | + -e "LETSENCRYPT_HOST=${domains[0]}" \ |
| 34 | + --network boulder_bluenet \ |
| 35 | + nginx:alpine > /dev/null && echo "Started test web server for ${domains[0]}" |
| 36 | +# Manual validity (same as default) |
| 37 | +docker run --rm -d \ |
| 38 | + --name "${domains[1]}" \ |
| 39 | + -e "VIRTUAL_HOST=${domains[1]}" \ |
| 40 | + -e "LETSENCRYPT_HOST=${domains[1]}" \ |
| 41 | + -e "LETSENCRYPT_MIN_VALIDITY=2592000" \ |
| 42 | + --network boulder_bluenet \ |
| 43 | + nginx:alpine > /dev/null && echo "Started test web server for ${domains[1]}" |
| 44 | +# Manual validity (few seconds shy of MIN_VALIDITY_CAP=7603200) |
| 45 | +docker run --rm -d \ |
| 46 | + --name "${domains[2]}" \ |
| 47 | + -e "VIRTUAL_HOST=${domains[2]}" \ |
| 48 | + -e "LETSENCRYPT_HOST=${domains[2]}" \ |
| 49 | + -e "LETSENCRYPT_MIN_VALIDITY=7603190" \ |
| 50 | + --network boulder_bluenet \ |
| 51 | + nginx:alpine > /dev/null && echo "Started test web server for ${domains[2]}" |
| 52 | + |
| 53 | +# Wait for a symlinks |
| 54 | +wait_for_symlink "${domains[0]}" "$le_container_name" |
| 55 | +wait_for_symlink "${domains[1]}" "$le_container_name" |
| 56 | +wait_for_symlink "${domains[2]}" "$le_container_name" |
| 57 | +# Grab the expiration times of the certificates |
| 58 | +first_cert_expire_1="$(get_cert_expiration_epoch "${domains[0]}" "$le_container_name")" |
| 59 | +first_cert_expire_2="$(get_cert_expiration_epoch "${domains[1]}" "$le_container_name")" |
| 60 | +first_cert_expire_3="$(get_cert_expiration_epoch "${domains[2]}" "$le_container_name")" |
| 61 | + |
| 62 | +# Wait for ${domains[2]} set certificate validity to expire |
| 63 | +sleep 10 |
| 64 | + |
| 65 | +# Manually trigger letsencrypt_service |
| 66 | +docker exec "$le_container_name" /bin/bash -c "source /app/letsencrypt_service --source-only; update_certs" > /dev/null 2>&1 |
| 67 | + |
| 68 | +# Grab the new expiration times of the certificates |
| 69 | +second_cert_expire_1="$(get_cert_expiration_epoch "${domains[0]}" "$le_container_name")" |
| 70 | +second_cert_expire_2="$(get_cert_expiration_epoch "${domains[1]}" "$le_container_name")" |
| 71 | +second_cert_expire_3="$(get_cert_expiration_epoch "${domains[2]}" "$le_container_name")" |
| 72 | + |
| 73 | +if [[ $second_cert_expire_1 -eq $first_cert_expire_1 ]]; then |
| 74 | + echo "Certificate for ${domains[0]} was not renewed." |
| 75 | +else |
| 76 | + echo "Certificate for ${domains[0]} was incorrectly renewed." |
| 77 | + echo "First certificate expiration epoch : $first_cert_expire_1." |
| 78 | + echo "Second certificate expiration epoch : $second_cert_expire_1." |
| 79 | +fi |
| 80 | +if [[ $second_cert_expire_2 -eq $first_cert_expire_2 ]]; then |
| 81 | + echo "Certificate for ${domains[1]} was not renewed." |
| 82 | +else |
| 83 | + echo "Certificate for ${domains[1]} was incorrectly renewed." |
| 84 | + echo "First certificate expiration epoch : $first_cert_expire_2." |
| 85 | + echo "Second certificate expiration epoch : $second_cert_expire_2." |
| 86 | +fi |
| 87 | +if [[ $second_cert_expire_3 -gt $first_cert_expire_3 ]]; then |
| 88 | + echo "Certificate for ${domains[2]} was renewed." |
| 89 | +else |
| 90 | + echo "Certificate for ${domains[2]} was not renewed." |
| 91 | + echo "First certificate expiration epoch : $first_cert_expire_3." |
| 92 | + echo "Second certificate expiration epoch : $second_cert_expire_3." |
| 93 | +fi |
0 commit comments