forked from getsentry/self-hosted
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
This reverts commit 480ee55.
- Loading branch information
Showing
48 changed files
with
406 additions
and
1,119 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| set -e | ||
| export COMPOSE_FILE=docker-compose.yml:_integration-test/custom-ca-roots/docker-compose.test.yml | ||
|
|
||
| TEST_NGINX_CONF_PATH=_integration-test/custom-ca-roots/nginx | ||
| CUSTOM_CERTS_PATH=certificates | ||
|
|
||
| # generate tightly constrained CA | ||
| # NB: `-addext` requires LibreSSL 3.1.0+, or OpenSSL (brew install openssl) | ||
| openssl req -x509 -new -nodes -newkey rsa:2048 -keyout $TEST_NGINX_CONF_PATH/ca.key \ | ||
| -sha256 -days 1 -out $TEST_NGINX_CONF_PATH/ca.crt -batch \ | ||
| -subj "/CN=TEST CA *DO NOT TRUST*" \ | ||
| -addext "keyUsage = critical, keyCertSign, cRLSign" \ | ||
| -addext "nameConstraints = critical, permitted;DNS:self.test" | ||
|
|
||
| ## Lines like the following are debug helpers ... | ||
| # openssl x509 -in nginx/ca.crt -text -noout | ||
|
|
||
| mkdir -p $CUSTOM_CERTS_PATH | ||
| cp $TEST_NGINX_CONF_PATH/ca.crt $CUSTOM_CERTS_PATH/test-custom-ca-roots.crt | ||
|
|
||
| # generate server certificate | ||
| openssl req -new -nodes -newkey rsa:2048 -keyout $TEST_NGINX_CONF_PATH/self.test.key \ | ||
| -addext "subjectAltName=DNS:self.test" \ | ||
| -out $TEST_NGINX_CONF_PATH/self.test.req -batch -subj "/CN=Self Signed with CA Test Server" | ||
|
|
||
| # openssl req -in nginx/self.test.req -text -noout | ||
|
|
||
| openssl x509 -req -in $TEST_NGINX_CONF_PATH/self.test.req -CA $TEST_NGINX_CONF_PATH/ca.crt -CAkey $TEST_NGINX_CONF_PATH/ca.key \ | ||
| -extfile <(printf "subjectAltName=DNS:self.test") \ | ||
| -CAcreateserial -out $TEST_NGINX_CONF_PATH/self.test.crt -days 1 -sha256 | ||
|
|
||
| # openssl x509 -in nginx/self.test.crt -text -noout | ||
|
|
||
| # sanity check that signed certificate passes OpenSSL's validation | ||
| openssl verify -CAfile $TEST_NGINX_CONF_PATH/ca.crt $TEST_NGINX_CONF_PATH/self.test.crt | ||
|
|
||
| # self signed certificate, for sanity check of not just accepting all certs | ||
| openssl req -x509 -newkey rsa:2048 -nodes -days 1 -keyout $TEST_NGINX_CONF_PATH/fake.test.key \ | ||
| -out $TEST_NGINX_CONF_PATH/fake.test.crt -addext "subjectAltName=DNS:fake.test" -subj "/CN=Self Signed Test Server" | ||
|
|
||
| # openssl x509 -in nginx/fake.test.crt -text -noout | ||
|
|
||
| cp _integration-test/custom-ca-roots/test.py sentry/test-custom-ca-roots.py | ||
|
|
||
| $dc up -d fixture-custom-ca-roots |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| $dc rm -s -f -v fixture-custom-ca-roots | ||
| rm -f certificates/test-custom-ca-roots.crt sentry/test-custom-ca-roots.py | ||
| unset COMPOSE_FILE |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,15 @@ | ||
| import unittest | ||
|
|
||
| import requests | ||
|
|
||
|
|
||
| class CustomCATests(unittest.TestCase): | ||
| def test_valid_self_signed(self): | ||
| self.assertEqual(requests.get("https://self.test").text, "ok") | ||
| self.assertEqual(requests.get("https://self.test").text, 'ok') | ||
|
|
||
| def test_invalid_self_signed(self): | ||
| with self.assertRaises(requests.exceptions.SSLError): | ||
| requests.get("https://fail.test") | ||
|
|
||
|
|
||
| if __name__ == "__main__": | ||
| if __name__ == '__main__': | ||
| unittest.main() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| #!/usr/bin/env bash | ||
| set -ex | ||
|
|
||
| source install/_lib.sh | ||
| source install/dc-detect-version.sh | ||
|
|
||
| echo "${_group}Test that backup/restore works..." | ||
| echo "Creating backup..." | ||
| # Docker was giving me permissioning issues when trying to create this file and write to it even after giving read + write access | ||
| # to group and owner. Instead, try creating the empty file and then give everyone write access to the backup file | ||
| touch $(pwd)/sentry/backup.json | ||
| chmod 666 $(pwd)/sentry/backup.json | ||
| SENTRY_DOCKER_IO_DIR=$(pwd)/sentry /bin/bash $(pwd)/sentry-admin.sh export global /sentry-admin/backup.json --no-prompt | ||
| if [ ! -s "$(pwd)/sentry/backup.json" ]; then | ||
| echo "Backup file is empty" | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Print backup.json contents | ||
| echo "Backup file contents:\n\n" | ||
| cat "$(pwd)/sentry/backup.json" | ||
|
|
||
| # Bring postgres down and recreate the docker volume | ||
| $dc stop postgres | ||
| sleep 5 | ||
| $dc rm -f -v postgres | ||
| docker volume rm sentry-postgres | ||
| export SKIP_USER_CREATION=1 | ||
| source install/create-docker-volumes.sh | ||
| source install/set-up-and-migrate-database.sh | ||
| $dc up -d | ||
|
|
||
| echo "Importing backup..." | ||
| SENTRY_DOCKER_IO_DIR=$(pwd)/sentry /bin/bash $(pwd)/sentry-admin.sh import global /sentry-admin/backup.json --no-prompt | ||
|
|
||
| rm $(pwd)/sentry/backup.json |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| #!/usr/bin/env bash | ||
| set -ex | ||
|
|
||
| source install/_lib.sh | ||
| source install/dc-detect-version.sh | ||
|
|
||
| # Negated version of ensure-customizations-work.sh, make changes in sync | ||
| echo "${_group}Ensure customizations not present" | ||
| ! $dcr --no-deps web bash -c "if [ ! -e /created-by-enhance-image ]; then exit 1; fi" | ||
| ! $dcr --no-deps --entrypoint=/etc/sentry/entrypoint.sh sentry-cleanup bash -c "if [ ! -e /created-by-enhance-image ]; then exit 1; fi" | ||
| ! $dcr --no-deps web python -c "import ldap" | ||
| ! $dcr --no-deps --entrypoint=/etc/sentry/entrypoint.sh sentry-cleanup python -c "import ldap" | ||
| echo "${_endgroup}" |
Oops, something went wrong.