Skip to content
This repository was archived by the owner on Oct 10, 2025. It is now read-only.

Commit 614eaae

Browse files
josecelanojosecelano
committed
feat: [#21] Implement Pebble SSL testing environment and decide on pre-generated cert approach
- Created comprehensive Pebble testing environment with Docker Compose - All SSL scripts implemented and deployed: ssl-setup.sh, ssl-validate-dns.sh, ssl-generate.sh, ssl-configure-nginx.sh, ssl-activate-renewal.sh, ssl-setup-local-dns.sh - Two-phase nginx template system: nginx-http.conf.tpl (base) + nginx-https-extension.conf.tpl (HTTPS extension) - Pebble ACME server running and accessible at https://192.168.122.92:14000/dir - Nginx serving ACME challenges from /var/lib/torrust/certbot/webroot - Fixed working tree deployment via rsync --filter=':- .gitignore' for local testing - Created comprehensive SSL testing guide with manual validation steps Architecture Decision: Switch to pre-generated test certificates approach - Complexity of Pebble environment makes iteration slow - Pre-generated certificates will enable faster testing of nginx HTTPS configuration - Focus on SSL script workflow validation rather than certificate authority integration - Keep Pebble environment for optional comprehensive integration testing Next: Implement ssl-generate-test-certs.sh for simplified SSL testing workflow
1 parent 022a931 commit 614eaae

15 files changed

+3482
-133
lines changed

‎application/compose.test.yaml‎

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
# Docker Compose configuration for SSL testing with Pebble
3+
# This file provides a complete testing environment for SSL certificate generation
4+
# using Pebble (Let's Encrypt testing server) instead of the real Let's Encrypt API
5+
6+
name: torrust-test
7+
services:
8+
# Pebble - Let's Encrypt testing server
9+
pebble:
10+
image: ghcr.io/letsencrypt/pebble:latest
11+
container_name: pebble
12+
command: ["-dnsserver", "pebble-challtestsrv:8055"]
13+
ports:
14+
- "14000:14000" # ACME API
15+
- "15000:15000" # Management API
16+
networks:
17+
- test_network
18+
environment:
19+
PEBBLE_VA_NOSLEEP: 1
20+
PEBBLE_WFE_NONCEREJECT: 0
21+
PEBBLE_CHALLTESTSRV: pebble-challtestsrv:8055
22+
depends_on:
23+
- pebble-challtestsrv
24+
25+
# Challenge test server for Pebble
26+
pebble-challtestsrv:
27+
image: ghcr.io/letsencrypt/pebble-challtestsrv:latest
28+
container_name: pebble-challtestsrv
29+
command: [
30+
"-defaultIPv6", "",
31+
"-defaultIPv4", "proxy",
32+
"-http01", "proxy:80",
33+
"-https01", "",
34+
"-tlsalpn01", ""
35+
]
36+
ports:
37+
- "8055:8055" # Management port
38+
networks:
39+
- test_network
40+
41+
# Certbot configured for Pebble testing
42+
certbot-test:
43+
image: certbot/certbot
44+
container_name: certbot-test
45+
volumes:
46+
- /var/lib/torrust/proxy/webroot:/var/www/html
47+
- /var/lib/torrust/certbot/etc:/etc/letsencrypt
48+
- /var/lib/torrust/certbot/lib:/var/lib/letsencrypt
49+
networks:
50+
- test_network
51+
depends_on:
52+
- pebble
53+
logging:
54+
options:
55+
max-size: "10m"
56+
max-file: "3"
57+
58+
# Nginx proxy configured for testing
59+
proxy:
60+
image: nginx:mainline-alpine
61+
container_name: proxy-test
62+
restart: unless-stopped
63+
networks:
64+
- test_network
65+
ports:
66+
- "80:80"
67+
- "443:443"
68+
volumes:
69+
- /var/lib/torrust/certbot/webroot:/var/www/html
70+
- /var/lib/torrust/proxy/etc/nginx-conf:/etc/nginx/conf.d
71+
- /var/lib/torrust/certbot/etc:/etc/letsencrypt
72+
- /var/lib/torrust/certbot/lib:/var/lib/letsencrypt
73+
- /var/lib/torrust/dhparam:/etc/ssl/certs
74+
logging:
75+
options:
76+
max-size: "10m"
77+
max-file: "3"
78+
depends_on:
79+
- tracker
80+
- grafana
81+
healthcheck:
82+
test: ["CMD", "curl", "-f", "http://localhost/"]
83+
interval: 30s
84+
timeout: 10s
85+
retries: 3
86+
87+
# Grafana for testing
88+
grafana:
89+
image: grafana/grafana:11.4.0
90+
container_name: grafana-test
91+
restart: unless-stopped
92+
environment:
93+
- GF_SECURITY_ADMIN_USER=${GF_SECURITY_ADMIN_USER:-admin}
94+
- GF_SECURITY_ADMIN_PASSWORD=${GF_SECURITY_ADMIN_PASSWORD:-admin}
95+
networks:
96+
- test_network
97+
ports:
98+
- "3101:3000" # Avoid conflict with production Grafana
99+
volumes:
100+
- grafana_test_data:/var/lib/grafana
101+
- ../share/grafana/dashboards:/etc/grafana/provisioning/dashboards
102+
- ../share/grafana/datasources:/etc/grafana/provisioning/datasources
103+
logging:
104+
options:
105+
max-size: "10m"
106+
max-file: "3"
107+
108+
# MySQL database for testing
109+
mysql:
110+
image: mysql:8.0
111+
container_name: mysql-test
112+
restart: unless-stopped
113+
environment:
114+
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-root_password}
115+
MYSQL_DATABASE: ${MYSQL_DATABASE:-torrust_tracker}
116+
MYSQL_USER: ${MYSQL_USER:-torrust}
117+
MYSQL_PASSWORD: ${MYSQL_PASSWORD:-user_password}
118+
networks:
119+
- test_network
120+
ports:
121+
- "3307:3306" # Avoid conflict with production MySQL
122+
volumes:
123+
- mysql_test_data:/var/lib/mysql
124+
logging:
125+
options:
126+
max-size: "10m"
127+
max-file: "3"
128+
healthcheck:
129+
test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD:-root_password}"]
130+
interval: 30s
131+
timeout: 10s
132+
retries: 5
133+
134+
# Torrust Tracker for testing
135+
tracker:
136+
image: torrust/tracker:develop
137+
container_name: tracker-test
138+
restart: unless-stopped
139+
networks:
140+
- test_network
141+
ports:
142+
- "6870:6868/udp" # Avoid conflict with production tracker
143+
- "6971:6969/udp" # Avoid conflict with production tracker
144+
- "7071:7070" # Avoid conflict with production tracker
145+
- "1213:1212" # Avoid conflict with production tracker
146+
volumes:
147+
- ../storage/tracker/lib:/var/lib/torrust/tracker:Z
148+
- ../storage/tracker/log:/var/log/torrust/tracker:Z
149+
- ../storage/tracker/etc:/etc/torrust/tracker:Z
150+
logging:
151+
options:
152+
max-size: "10m"
153+
max-file: "3"
154+
depends_on:
155+
mysql:
156+
condition: service_healthy
157+
158+
networks:
159+
test_network:
160+
driver: bridge
161+
162+
volumes:
163+
grafana_test_data:
164+
driver: local
165+
mysql_test_data:
166+
driver: local

‎application/compose.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ services:
2828
- /var/lib/torrust/proxy/webroot:/var/www/html
2929
- /var/lib/torrust/proxy/etc/nginx-conf:/etc/nginx/conf.d
3030
- /var/lib/torrust/certbot/etc:/etc/letsencrypt
31+
- /var/lib/torrust/certbot/webroot:/var/lib/torrust/certbot/webroot
3132
- /var/lib/torrust/certbot/lib:/var/lib/letsencrypt
3233
- /var/lib/torrust/dhparam:/etc/ssl/certs
3334
logging:

‎application/pebble-config/pebble-config.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"pebble": {
3+
"listenAddress": "0.0.0.0:14000",
4+
"managementListenAddress": "0.0.0.0:15000",
5+
"httpPort": 80,
6+
"tlsPort": 443,
7+
"ocspResponderURL": "",
8+
"externalAccountRequired": false
9+
}
10+
}

0 commit comments

Comments
 (0)