unkin-agent
a161c44575
Real clients now authenticate every local publish against a static mock OIDC issuer, and each type checks unauthenticated publishes are refused while anonymous reads keep working.
47 lines
1.7 KiB
YAML
47 lines
1.7 KiB
YAML
# Overlay for the dockerised end-to-end suite (scripts/docker-e2e.sh).
|
|
# Adds a static mock upstream that the artifactapi container proxies, so the
|
|
# caching tests are hermetic and need no internet access.
|
|
services:
|
|
mockupstream:
|
|
image: nginx:alpine
|
|
volumes:
|
|
- ./e2e-docker/fixtures:/usr/share/nginx/html:ro,z
|
|
# No host port needed: only the artifactapi container talks to it, and the
|
|
# tests compare served bytes against the on-disk fixtures.
|
|
|
|
# Two constant-body upstreams for the multi-base_url suite: each returns a
|
|
# distinct, upstream-identifying body for any path, so round-robin
|
|
# distribution across a two-mirror remote is directly observable.
|
|
mockupstreama:
|
|
image: nginx:alpine
|
|
volumes:
|
|
- ./e2e-docker/mirror-conf/a.conf:/etc/nginx/conf.d/default.conf:ro,z
|
|
mockupstreamb:
|
|
image: nginx:alpine
|
|
volumes:
|
|
- ./e2e-docker/mirror-conf/b.conf:/etc/nginx/conf.d/default.conf:ro,z
|
|
|
|
# Static OIDC issuer gating writes; the suite's TestMain writes jwks.json.
|
|
mockoidc:
|
|
image: nginx:alpine
|
|
volumes:
|
|
- ./e2e-docker/oidc:/usr/share/nginx/html:ro,z
|
|
|
|
artifactapi:
|
|
environment:
|
|
ARTIFACTAPI_OIDC_ISSUER: http://mockoidc
|
|
ARTIFACTAPI_OIDC_AUDIENCE: artifactapi
|
|
ARTIFACTAPI_AUTH_UPLOADS: "true"
|
|
# The host port is set via ARTIFACTAPI_PORT (see scripts/docker-e2e.sh),
|
|
# defaulting to 8000; the e2e run uses 8001 to avoid colliding with a
|
|
# locally-running instance.
|
|
depends_on:
|
|
mockupstream:
|
|
condition: service_started
|
|
mockupstreama:
|
|
condition: service_started
|
|
mockupstreamb:
|
|
condition: service_started
|
|
mockoidc:
|
|
condition: service_started
|