96 lines
3.6 KiB
Bash
Executable File
96 lines
3.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# infra/authentik/scripts/smoke.sh
|
|
#
|
|
# Post-deploy smoke checks for the self-hosted Authentik stack. Runs
|
|
# read-only HTTP probes from the operator's machine; safe to re-run.
|
|
#
|
|
# Probes:
|
|
# 1. https://auth.<host>/ -> 200 (login page)
|
|
# 2. https://auth.<host>/-/health/live/ -> 200
|
|
# 3. https://auth.<host>/-/health/ready/ -> 200
|
|
# 4. https://auth.<host>/application/o/<app-slug>/.well-known/openid-configuration -> 200 JSON
|
|
# with `issuer`, `authorization_endpoint`, `token_endpoint`, `jwks_uri`
|
|
# 5. (optional) self-registration endpoint returns 404
|
|
#
|
|
# Usage:
|
|
# export AUTHENTIK_BASE_URL=https://auth.boiler.saas-ctrl.com
|
|
# export AUTHENTIK_APP_SLUG=toolctrl-admin-panel
|
|
# bash infra/authentik/scripts/smoke.sh
|
|
#
|
|
# Exit codes:
|
|
# 0 = all probes passed
|
|
# 1 = at least one probe failed
|
|
|
|
set -Eeuo pipefail
|
|
|
|
: "${AUTHENTIK_BASE_URL:?AUTHENTIK_BASE_URL must be set (e.g. https://auth.boiler.saas-ctrl.com)}"
|
|
: "${AUTHENTIK_APP_SLUG:=toolctrl-admin-panel}"
|
|
|
|
FAILED=0
|
|
PASSED=0
|
|
|
|
log_ok() { printf "\033[1;32m[smoke:OK]\033[0m %s\n" "$*"; PASSED=$((PASSED+1)); }
|
|
log_fail() { printf "\033[1;31m[smoke:FAIL]\033[0m %s\n" "$*" >&2; FAILED=$((FAILED+1)); }
|
|
log_info() { printf "\033[1;34m[smoke]\033[0m %s\n" "$*"; }
|
|
|
|
probe_status() {
|
|
local label="$1"
|
|
local url="$2"
|
|
local want="$3"
|
|
local got
|
|
got="$(curl -ksS -o /dev/null -w "%{http_code}" "${url}" || echo "000")"
|
|
if [[ "${got}" == "${want}" ]]; then
|
|
log_ok "${label} -> ${got}"
|
|
else
|
|
log_fail "${label} -> got ${got}, want ${want} (${url})"
|
|
fi
|
|
}
|
|
|
|
probe_oidc_discovery() {
|
|
local url="${AUTHENTIK_BASE_URL}/application/o/${AUTHENTIK_APP_SLUG}/.well-known/openid-configuration"
|
|
local body
|
|
body="$(curl -ksS -o - -w "\nHTTP_STATUS:%{http_code}" "${url}" || true)"
|
|
local status
|
|
status="$(printf "%s" "${body}" | grep -E "^HTTP_STATUS:" | tail -1 | cut -d: -f2 | tr -d '[:space:]')"
|
|
local payload
|
|
payload="$(printf "%s" "${body}" | sed -e '/^HTTP_STATUS:/d')"
|
|
if [[ "${status}" != "200" ]]; then
|
|
log_fail "oidc-discovery -> got ${status}, want 200 (${url})"
|
|
return
|
|
fi
|
|
for k in issuer authorization_endpoint token_endpoint jwks_uri; do
|
|
if printf "%s" "${payload}" | grep -q "\"${k}\""; then
|
|
log_ok "oidc-discovery field ${k} present"
|
|
else
|
|
log_fail "oidc-discovery field ${k} MISSING (${url})"
|
|
fi
|
|
done
|
|
}
|
|
|
|
log_info "smoke target: ${AUTHENTIK_BASE_URL}"
|
|
log_info "app slug: ${AUTHENTIK_APP_SLUG}"
|
|
|
|
# 1. Root login page reachable
|
|
probe_status "root (login page)" "${AUTHENTIK_BASE_URL}/" "200"
|
|
|
|
# 2. Health probes
|
|
probe_status "health-live" "${AUTHENTIK_BASE_URL}/-/health/live/" "200"
|
|
probe_status "health-ready" "${AUTHENTIK_BASE_URL}/-/health/ready/" "200"
|
|
|
|
# 3. OIDC discovery (depends on blueprint 03-application-toolctrl-admin.yaml
|
|
# having applied — fails until bootstrap is done)
|
|
probe_oidc_discovery
|
|
|
|
# 4. Self-registration disabled (Authentik default-source-enrollment flow)
|
|
log_info "verifying public self-registration is OFF"
|
|
self_enroll_status="$(curl -ksS -o /dev/null -w "%{http_code}" "${AUTHENTIK_BASE_URL}/if/flow/default-source-enrollment/" || echo "000")"
|
|
if [[ "${self_enroll_status}" == "404" || "${self_enroll_status}" == "302" ]]; then
|
|
log_ok "self-enrollment endpoint returns ${self_enroll_status} (registration disabled or redirect-to-deny)"
|
|
else
|
|
log_fail "self-enrollment endpoint returns ${self_enroll_status} (expected 404 or 302)"
|
|
fi
|
|
|
|
echo
|
|
log_info "summary: ${PASSED} passed, ${FAILED} failed"
|
|
[[ ${FAILED} -eq 0 ]] || exit 1
|