Merge branch 'RM-3739_dockered_capsule_servers' into 'master'

taistotr · taistotr · commit 593ad5b1390f · 2024-09-13T17:51:37.000+03:00
RM-3739 dockered capsule servers

See merge request cdoc2/cdoc2-java-ref-impl!49
diff --git a/test/README.md b/test/README.md
@@ -43,3 +43,12 @@ Result has to as follows:
 
 All test vectors within testing will be created in the same temporary folder `/target`. Test 
 results will be deleted after each test case execution automatically.
+
+
+### Running server scenario tests (experimental)
+
+Create DB Docker image, follow https://github.com/open-eid/cdoc2-capsule-server/server-db/README.md
+
+Login to docker (ghcr.io) - [Authenticating with personal access token](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-with-a-personal-access-token-classic)
+
+Run: `run-server-bats-tests.sh`
diff --git a/test/bats/aliases_server.sh b/test/bats/aliases_server.sh
@@ -21,6 +21,7 @@ then
   cd $TESTING_DIR
 fi
 
+# alias cdoc-cli='java  -Djavax.net.debug=ssl:handshake:verbose:keymanager:trustmanager -Djava.security.debug=access:stack -jar $CDOC2_DIR/cdoc2-cli/target/cdoc2-cli-$CDOC2_CLI_VER.jar'
 alias cdoc-cli='java -jar $CDOC2_DIR/cdoc2-cli/target/cdoc2-cli-$CDOC2_CLI_VER.jar'
 export CDOC2_CMD="java -jar $CDOC2_DIR/cdoc2-cli/target/cdoc2-cli-$CDOC2_CLI_VER.jar"
 
diff --git a/test/bats/cdoc2_server_tests.bats b/test/bats/cdoc2_server_tests.bats
@@ -25,7 +25,7 @@ mkdir -p $TEST_RESULTS_DIR
 #https://github.com/bats-core/bats-core/issues/259
 run_alias() {
 	shopt -s expand_aliases
-	source "aliases.sh"
+	source "aliases_server.sh"
 	eval "$*"
 }
 
@@ -83,6 +83,10 @@ run_alias() {
   assert_output --partial '/config'
 }
 
+@test "preparing: Waiting server to start" {
+  timeout 15s bash -c 'until curl -k --silent --show-error --connect-timeout 1 https://localhost:18443/actuator/health|grep UP; do echo "# Checking ...">&3; sleep 1;done'
+}
+
 @test "server-test1: successfully encrypt CDOC2 container with server capsule and send capsule to server, then use GET server to decrypt" {
   local cdoc_file="ec_simple_to_server.cdoc"
   echo "# Crypt and send capsule to PUT server for file ${cdoc_file}">&3
diff --git a/test/bats/run-server-bats-tests.sh b/test/bats/run-server-bats-tests.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+source variables_server.sh
+
+# set up servers (could use --wait --wait-timeout 60s with latest docker compose healthchecks defined)
+docker compose -f "$TESTING_DIR/../config/server/docker-compose.yml" up -d
+
+# not needed as already in bats dir?
+#cd "$TESTING_DIR"
+
+/usr/bin/env bash test_set_server.sh
+
+docker compose -f "$TESTING_DIR/../config/server/docker-compose.yml" down
diff --git a/test/bats/test_set_server.sh b/test/bats/test_set_server.sh
@@ -5,14 +5,14 @@ mkdir config
 cd config/
 mkdir localhost
 cd localhost/
-cp ../../../../cdoc2-cli/config/localhost/localhost_pkcs12.properties .
-cp ../../../../cdoc2-cli/config/localhost/clienttruststore.jks .
+cp ../../../config/server/clientconf/localhost_pkcs12.properties .
+cp ../../../config/server/clientconf/clienttruststore.jks .
 cd ../../
 mkdir keys
 cd keys/
-cp ../../../cdoc2-cli/keys/cdoc2client.p12 .
-cp ../../../cdoc2-cli/keys/cdoc2client_pub.key .
-cp ../../../cdoc2-cli/keys/cdoc2client_priv.key .
+cp ../../config/server/clientconf/cdoc2client.p12 .
+cp ../../config/server/clientconf/cdoc2client_pub.key .
+cp ../../config/server/clientconf/cdoc2client_priv.key .
 cd ..
 
 source variables_server.sh
diff --git a/test/config/server/clientconf/cdoc2client.p12 b/test/config/server/clientconf/cdoc2client.p12
diff --git a/test/config/server/clientconf/cdoc2client_priv.key b/test/config/server/clientconf/cdoc2client_priv.key
@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDDaHrkmfvP3MVnpwjmYd2HZVIJNs8XZX8uqaDsx2LGYNudRGvImLZ41
+V7QMCd44fhGgBwYFK4EEACKhZANiAAQnVBZQwa2JbFi7Ib3pwZfDH3bALi4Gm9Ju
+hso2tb2d3M5TXPtbyoOBmFRQenMQXjgWE7/vOiQgrG+RZz2MRWqX8vq/feWSeJ9H
+2/87uPEoNKwrJb67Z8pr/GkJZzN+lQw=
+-----END EC PRIVATE KEY-----
diff --git a/test/config/server/clientconf/cdoc2client_pub.key b/test/config/server/clientconf/cdoc2client_pub.key
@@ -0,0 +1,5 @@
+-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEJ1QWUMGtiWxYuyG96cGXwx92wC4uBpvS
+bobKNrW9ndzOU1z7W8qDgZhUUHpzEF44FhO/7zokIKxvkWc9jEVql/L6v33lknif
+R9v/O7jxKDSsKyW+u2fKa/xpCWczfpUM
+-----END PUBLIC KEY-----
diff --git a/test/config/server/clientconf/clienttruststore.jks b/test/config/server/clientconf/clienttruststore.jks
diff --git a/test/config/server/clientconf/localhost_pkcs12.properties b/test/config/server/clientconf/localhost_pkcs12.properties
@@ -0,0 +1,25 @@
+# key server listening on localhost, mutual TLS with private key/certificate  (P12) read from file
+# See cdoc2-capsule-server/README.md how to start the server
+
+# server.id is written to cdoc header. Must have configuration on recipient side
+cdoc2.client.server.id=localhost
+# capsules can be created over TLS (no client auth required)
+cdoc2.client.server.base-url.post=https://localhost:8443
+# Quering capsules requires mTLS
+cdoc2.client.server.base-url.get=https://localhost:8444
+
+cdoc2.client.server.debug=true
+cdoc2.client.server.connect-timeout=1000
+cdoc2.client.server.read-timeout=1000
+
+# trusted certificates by client
+cdoc2.client.ssl.trust-store.type=JKS
+cdoc2.client.ssl.trust-store=config/localhost/clienttruststore.jks
+cdoc2.client.ssl.trust-store-password=passwd
+
+
+# client private key and certificate for mutual TLS (if required by server)
+# This key should be trusted by server and added to server trusted key store
+cdoc2.client.ssl.client-store.type=PKCS12
+cdoc2.client.ssl.client-store=keys/cdoc2client.p12
+cdoc2.client.ssl.client-store-password=passwd
diff --git a/test/config/server/docker-compose.yml b/test/config/server/docker-compose.yml
@@ -0,0 +1,78 @@
+version: '3.4'
+
+services:
+  cdoc2-postgres:
+    container_name: cdoc2-postgres-bats
+    # Instruction to build local cdoc2-db: https://github.com/open-eid/cdoc2-capsule-server/server-db/README.md
+    image: cdoc2-db:version3
+    restart: always
+    ports:
+      - "7432:5432"
+    environment:
+      POSTGRES_DB: postgres
+      POSTGRES_PASSWORD: postgres
+      PGDATA: postgres
+
+  cdoc2-put-server:
+    container_name: cdoc2-put-server-bats
+    image: ghcr.io/open-eid/cdoc2-put-server:v1.4.0-docker.0-7b16600584da49d0a504f7cdaa1066ba41f2b20e
+    ports:
+      - "8443:8443"
+      # monitoring
+      - "18443:18443"
+#    volumes:
+#      - ./serverconf:/opt/cdoc2
+    configs:
+      - source: put-server-conf
+        target: /config/application-put-server.properties
+      - source: truststore
+        target: /config/servertruststore.jks
+      - source: keystore
+        target: /config/cdoc2server.p12
+    environment:
+      - SPRING_CONFIG_ADDITIONAL_LOCATION=optional:file:/config/application-put-server.properties
+#      - JAVA_OPTS=-Djavax.net.debug=ssl:handshake:verbose:keymanager:trustmanager -Djava.security.debug=access:stack
+    depends_on:
+      cdoc2-postgres:
+        condition: service_started
+# curl is not installed on image, and following healthcheck will fail
+#    healthcheck:
+#      test: curl -k --silent --fail --connect-timeout 1 https://localhost:18443/actuator/health|grep UP
+#      interval: 5s
+#      timeout: 30s
+#      retries: 3
+#      start_period: 5s
+    mem_limit: 1g
+
+  cdoc2-get-server:
+    container_name: cdoc2-get-server-bats
+    image: ghcr.io/open-eid/cdoc2-get-server:v1.4.0-docker.0-7b16600584da49d0a504f7cdaa1066ba41f2b20e
+    ports:
+      - "8444:8444"
+      # monitoring
+      - "18444:18444"
+    configs:
+      - source: get-server-conf
+        target: /config/application-get-server.properties
+      - source: truststore
+        target: /config/servertruststore.jks
+      - source: keystore
+        target: /config/cdoc2server.p12
+    environment:
+      - SPRING_CONFIG_ADDITIONAL_LOCATION=optional:file:/config/application-get-server.properties
+#      - JAVA_OPTS=-Djavax.net.debug=ssl:handshake:verbose:keymanager:trustmanager -Djava.security.debug=access:stack
+    depends_on:
+      cdoc2-postgres:
+        condition: service_started
+    mem_limit: 1g
+
+
+configs:
+  put-server-conf:
+    file: serverconf/application-put-server.properties
+  get-server-conf:
+    file: serverconf/application-get-server.properties
+  truststore:
+    file: ./serverconf/servertruststore.jks
+  keystore:
+    file: ./serverconf/cdoc2server.p12
diff --git a/test/config/server/serverconf/application-get-server.properties b/test/config/server/serverconf/application-get-server.properties
@@ -0,0 +1,97 @@
+# Configuration file for running from cdoc2-capsule-server directory, see README.md
+debug=true
+# The format used for the keystore. It could be set to JKS in case it is a JKS file
+server.ssl.key-store-type=PKCS12
+# The path to the keystore containing the certificate
+# See copy-keys-and-certificates in pom.xml
+server.ssl.key-store=/config/cdoc2server.p12
+# The password used to generate the certificate
+server.ssl.key-store-password=passwd
+# The alias mapped to the certificate
+server.ssl.key-alias=cdoc2-server
+
+# Mutual TLS/SSL
+server.ssl.client-auth=need
+
+# Enable client authentication certificate revocation checking for mutual TLS over OCSP
+# For Est-ID (sk issued) certificates requires connection to http://aia.sk.ee
+cdoc2.ssl.client-auth.revocation-checks.enabled=false
+
+# trust store, must include CA cert that was used to sign client certificate
+# See copy-keys-and-certificates in pom.xml
+server.ssl.trust-store=/config/servertruststore.jks
+server.ssl.trust-store-password=passwd
+
+server.ssl.enabled=true
+# enable TLSv1.3 only
+server.ssl.enabled-protocols=TLSv1.3
+server.port=8444
+
+# change to 'debug' if you want to see logs. Run server with target/test-classes/logback.xml
+logging.level.root=info
+logging.level.ee.cyber.cdoc2=trace
+
+spring.datasource.url=jdbc:postgresql://cdoc2-postgres:5432/postgres
+spring.datasource.username=postgres
+spring.datasource.password=postgres
+spring.datasource.driver-class-name=org.postgresql.Driver
+spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect
+
+# https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.monitoring
+# run management on separate https port
+management.server.port=18444
+management.server.ssl.enabled=true
+management.server.ssl.key-store-type=PKCS12
+# The path to the keystore containing the certificate
+# See copy-keys-and-certificates in pom.xml
+management.server.ssl.key-store=/config/cdoc2server.p12
+# The password used to generate the certificate
+management.server.ssl.key-store-password=passwd
+# The alias mapped to the certificate
+management.server.ssl.key-alias=cdoc2-server
+
+# configure monitoring endpoints
+management.endpoints.enabled-by-default=false
+management.endpoints.web.discovery.enabled=false
+# key values can be hidden when change value to "never" or "when_authorized"
+management.endpoint.env.show-values=always
+management.endpoint.configprops.show-values=always
+
+# explicitly enable endpoints
+management.endpoint.info.enabled=true
+management.endpoint.health.enabled=true
+management.endpoint.startup.enabled=true
+management.endpoint.prometheus.enabled=true
+management.endpoint.health.show-details=always
+
+# expose endpoints
+management.endpoints.web.exposure.include=info,health,startup,prometheus
+
+# Supported metrics
+# https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.metrics.supported
+
+#enable tomcat.* metrics
+server.tomcat.mbeanregistry.enabled=true
+
+# Spring Data Repository Metrics
+# https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.metrics.supported.spring-data-repository
+# spring.data.repository.* metrics
+management.metrics.data.repository.autotime.enabled=true
+
+# https://docs.spring.io/spring-boot/docs/2.1.5.RELEASE/reference/htmlsingle/#production-ready-metrics-spring-mvc
+# http.server.requests metrics
+management.metrics.web.server.auto-time-requests=true
+
+# access security must be implemented at network access rules (firewall)
+management.security.enabled=false
+endpoints.health.sensitive=false
+
+# credentials for /actuator/prometheus api basic authentication
+management.endpoints.metrics.username=username
+management.endpoints.metrics.password=password
+
+# Key capsule expiration duration configuration in format P(n)DT(n)H(n)M(n)S
+key-capsule.default-expiration-duration=P1095D
+key-capsule.max-expiration-duration=P1825D
+# Expired capsules removing job executes every 5 minutes every day
+key-capsule.expired.clean-up.cron=0 0/5 * * * ?
diff --git a/test/config/server/serverconf/application-put-server.properties b/test/config/server/serverconf/application-put-server.properties
@@ -0,0 +1,93 @@
+# Configuration file for running from put-server directory, see README.md
+# The format used for the keystore. It could be set to JKS in case it is a JKS file
+server.ssl.key-store-type=PKCS12
+# The path to the keystore containing the certificate
+# See copy-keys-and-certificates in pom.xml
+server.ssl.key-store=/config/cdoc2server.p12
+# The password used to generate the certificate
+server.ssl.key-store-password=passwd
+# The alias mapped to the certificate
+server.ssl.key-alias=cdoc2-server
+
+server.ssl.enabled=true
+# enable TLSv1.3 only
+server.ssl.enabled-protocols=TLSv1.3
+server.port=8443
+
+# change to 'debug' if you want to see logs. Run server with target/test-classes/logback.xml
+logging.level.root=info
+logging.level.ee.cyber.cdoc2=trace
+
+# database configuration: psql running in docker
+spring.datasource.url=jdbc:postgresql://cdoc2-postgres:5432/postgres
+spring.datasource.username=postgres
+spring.datasource.password=postgres
+spring.datasource.driver-class-name=org.postgresql.Driver
+# generates WARN ( PostgreSQLDialect does not need to be specified explicitly using 'hibernate.dialect'),
+# but server fails to start without it when DB connection is not available
+spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect
+
+# https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.monitoring
+# run management on separate https port
+management.server.port=18443
+management.server.ssl.enabled=true
+management.server.ssl.key-store-type=PKCS12
+# The path to the keystore containing the certificate
+# See copy-keys-and-certificates in pom.xml
+management.server.ssl.key-store=/config/cdoc2server.p12
+# The password used to generate the certificate
+management.server.ssl.key-store-password=passwd
+# The alias mapped to the certificate
+management.server.ssl.key-alias=cdoc2-server
+
+# configure monitoring endpoints
+management.endpoints.enabled-by-default=false
+management.endpoints.web.discovery.enabled=false
+# key values can be hidden when change value to "never" or "when_authorized"
+management.endpoint.env.show-values=always
+management.endpoint.configprops.show-values=always
+
+# explicitly enable endpoints
+management.endpoint.info.enabled=true
+management.endpoint.health.enabled=true
+management.endpoint.startup.enabled=true
+management.endpoint.prometheus.enabled=true
+management.endpoint.health.show-details=always
+management.endpoint.env.enabled=true
+
+# enable Spring security logging to debug 401
+#logging.level.org.springframework.security=DEBUG
+
+
+
+# expose endpoints
+management.endpoints.web.exposure.include=info,health,startup,prometheus,env
+
+# Supported metrics
+# https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.metrics.supported
+
+#enable tomcat.* metrics
+server.tomcat.mbeanregistry.enabled=true
+
+# Spring Data Repository Metrics
+# https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.metrics.supported.spring-data-repository
+# spring.data.repository.* metrics
+management.metrics.data.repository.autotime.enabled=true
+
+# https://docs.spring.io/spring-boot/docs/2.1.5.RELEASE/reference/htmlsingle/#production-ready-metrics-spring-mvc
+# http.server.requests metrics
+management.metrics.web.server.auto-time-requests=true
+
+# access security must be implemented at network access rules (firewall)
+management.security.enabled=false
+endpoints.health.sensitive=false
+
+# credentials for /actuator/prometheus api basic authentication
+management.endpoints.metrics.username=username
+management.endpoints.metrics.password=password
+
+# Key capsule expiration duration configuration in format P(n)DT(n)H(n)M(n)S
+key-capsule.default-expiration-duration=P1095D
+key-capsule.max-expiration-duration=P1825D
+# Expired capsules removing job executes every 5 minutes every day
+key-capsule.expired.clean-up.cron=0 0/5 * * * ?
diff --git a/test/config/server/serverconf/cdoc2server.p12 b/test/config/server/serverconf/cdoc2server.p12
diff --git a/test/config/server/serverconf/servertruststore.jks b/test/config/server/serverconf/servertruststore.jks
