[infrastructure] Fix Traefik Versioning and Update Crowdsec (#8152)

infrastructure_files/tests/test-getting-started-enterprise.sh

@@ -0,0 +1,96 @@
+#!/bin/bash
+
+set -euo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source "$script_dir/../getting-started-enterprise.sh"
+
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+cases=0
+
+for errexit in +o -o; do
+  for pipefail in +o -o; do
+    bash -c '
+      set "$1" errexit
+      set "$2" pipefail
+      before_options=$SHELLOPTS
+      source "$3"
+      if [[ "$SHELLOPTS" != "$before_options" ]]; then
+        echo "Sourcing changed shell options: $before_options -> $SHELLOPTS" >&2
+        exit 1
+      fi
+    ' bash "$errexit" "$pipefail" "$script_dir/../getting-started-enterprise.sh"
+  done
+done
+
+assert_tag() {
+  local expected_status="$1" expected_message="$2" actual_status=0
+  shift 2
+  local label="${1-<unset>}"
+
+  # Each call needs its own process because die exits rather than returning.
+  (
+    unset NETBIRD_TRAEFIK_TAG
+    if [[ $# -gt 0 ]]; then
+      NETBIRD_TRAEFIK_TAG="$1"
+    fi
+    check_traefik_tag
+  ) >"$test_dir/stdout" 2>"$test_dir/stderr" || actual_status=$?
+
+  if [[ "$actual_status" != "$expected_status" ]]; then
+    echo "Tag '$label': expected exit $expected_status, got $actual_status" >&2
+    cat "$test_dir/stderr" >&2
+    exit 1
+  fi
+  if [[ -s "$test_dir/stdout" ]]; then
+    echo "Tag '$label': unexpected output on stdout" >&2
+    cat "$test_dir/stdout" >&2
+    exit 1
+  fi
+  if [[ -n "$expected_message" ]]; then
+    if ! grep -Fq "$expected_message" "$test_dir/stderr"; then
+      echo "Tag '$label': expected diagnostic '$expected_message'" >&2
+      cat "$test_dir/stderr" >&2
+      exit 1
+    fi
+  elif [[ -s "$test_dir/stderr" ]]; then
+    echo "Tag '$label': unexpected output on stderr" >&2
+    cat "$test_dir/stderr" >&2
+    exit 1
+  fi
+  cases=$((cases + 1))
+}
+
+# Unset and empty overrides both select the installer's default image.
+assert_tag 0 ""
+assert_tag 0 "" ""
+
+for tag in v3.7.13 3.7.13 v3.7.14 v3.8 3.8 v4.0 v4.0.0 \
+  v03.07.013 v3.08.0 v3.7.019; do
+  assert_tag 0 "" "$tag"
+done
+
+for tag in v2.11.0 v3.6.20 v3.7 3.7 v3.7.11 v3.7.12 3.7.12 \
+  v03.07.012 v3.7.08; do
+  assert_tag 1 "predates aliasHeadersStrategy" "$tag"
+done
+
+for tag in latest custom-build v2 v3 sha256:abcdef v3.7.11-alpine \
+  v3.7.13-alpine v3.7.13-rc1 v3.7.14+custom v3.7.14@sha256:abcdef \
+  3..14 v3.7.14.0 " 3.7.14" $'v3.7.14\n'; do
+  assert_tag 1 "Cannot verify NETBIRD_TRAEFIK_TAG=" "$tag"
+done
+
+# Re-rendering an install that has no header config must not add a blank line
+# to the Traefik command list.
+for header_config in "" "$TRAEFIK_HEADER_CONFIG"; do
+  rendered=$(TRAEFIK_HEADER_CONFIG="$header_config" render_compose_common)
+  if [[ "$(printf '%s\n' "$rendered" | service_block traefik)" == *$'\n\n'* ]]; then
+    echo "Traefik command list has a blank line (header config: '${header_config:-<empty>}')" >&2
+    exit 1
+  fi
+  cases=$((cases + 1))
+done
+
+echo "Passed $cases Traefik tag validation cases."

infrastructure_files/tests/test-getting-started-networks.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+
+set -eo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source "$script_dir/../getting-started.sh"
+compose_command=$(check_docker_compose)
+read -r -a compose <<< "$compose_command"
+
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+mkdir "$test_dir/deployment"
+cd "$test_dir/deployment"
+
+unset COMPOSE_PROJECT_NAME COMPOSE_FILE COMPOSE_ENV_FILES
+# The generator's environment must not bake a project name into the output.
+if [[ "${1:-}" == "--migration" ]]; then
+  COMPOSE_PROJECT_NAME=render-only bash -s -- "$script_dir/../migrate.sh" >/dev/null <<'EOF'
+source "$1"
+INSTALL_DIR=$PWD
+DOMAIN=netbird.test
+generate_dashboard_env
+generate_docker_compose_traefik
+EOF
+else
+  TRAEFIK_IMAGE=traefik:v3.7.14
+  NETBIRD_DOMAIN=netbird.test
+  NETBIRD_AGENT_NETWORK=false
+  initialize_default_values
+  COMPOSE_PROJECT_NAME=render-only generate_configuration_files >/dev/null
+fi
+
+assert_network() {
+  local expected="$1" actual provider
+  shift
+  "${compose[@]}" "$@" config --format json >config.json
+  actual=$(jq -r '.networks.netbird.name' config.json)
+  provider=$(jq -r '.services.traefik.command[] | select(startswith("--providers.docker.network="))' config.json)
+  if [[ "$actual" != "$expected" || "$provider" != "--providers.docker.network=$expected" ]]; then
+    echo "Expected network '$expected'; Compose chose '$actual', Traefik received '$provider'" >&2
+    exit 1
+  fi
+}
+
+assert_network deployment_netbird
+COMPOSE_PROJECT_NAME=env-project assert_network env-project_netbird
+echo 'COMPOSE_PROJECT_NAME=file-project' >.env
+assert_network file-project_netbird
+COMPOSE_PROJECT_NAME=env-project assert_network cli-project_netbird -p cli-project
+: >.env
+echo 'name: config-project' >>docker-compose.yml
+assert_network config-project_netbird
+
+echo "Passed 5 Compose network scoping cases."

infrastructure_files/tests/test-getting-started.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+
+set -eo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source "$script_dir/../getting-started.sh"
+
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+cases=0
+
+assert_image() {
+  local expected_status="$1" expected_message="$2" image="$3" actual_status=0
+  local case_dir="$test_dir/$cases"
+  mkdir "$case_dir"
+
+  (
+    cd "$case_dir"
+    TRAEFIK_IMAGE="$image"
+    NETBIRD_DOMAIN=netbird.test
+    NETBIRD_AGENT_NETWORK=false
+    initialize_default_values
+    generate_configuration_files
+  ) >"$case_dir/stdout" 2>"$case_dir/stderr" || actual_status=$?
+
+  if [[ "$actual_status" != "$expected_status" ]]; then
+    echo "Image '$image': expected exit $expected_status, got $actual_status" >&2
+    cat "$case_dir/stderr" >&2
+    exit 1
+  fi
+  if [[ "$expected_status" == 0 ]]; then
+    if [[ -s "$case_dir/stderr" ]]; then
+      cat "$case_dir/stderr" >&2
+      exit 1
+    fi
+    for entrypoint in web websecure; do
+      if ! grep -Fq -- "--entrypoints.$entrypoint.http.aliasHeadersStrategy=delete" "$case_dir/docker-compose.yml"; then
+        echo "Image '$image': missing header protection for $entrypoint" >&2
+        exit 1
+      fi
+    done
+    if ! grep -Fxq "    image: ${image:-traefik:v3.7.14}" "$case_dir/docker-compose.yml"; then
+      echo "Image '$image': unexpected rendered image" >&2
+      exit 1
+    fi
+  else
+    if ! grep -Fq "$expected_message" "$case_dir/stderr"; then
+      echo "Image '$image': expected diagnostic '$expected_message'" >&2
+      cat "$case_dir/stderr" >&2
+      exit 1
+    fi
+    if [[ -e "$case_dir/docker-compose.yml" || -e "$case_dir/config.yaml" || -e "$case_dir/dashboard.env" ]]; then
+      echo "Image '$image': generated configuration despite failed validation" >&2
+      exit 1
+    fi
+  fi
+  cases=$((cases + 1))
+}
+
+# An empty override selects the default image.
+assert_image 0 "" ""
+for image in traefik:v3.7.13 traefik:3.7.13 traefik:v3.7.14 traefik:v3.8 \
+  traefik:v4 traefik:v4.0.0 traefik:v03.07.013 traefik:v3.08.0 \
+  registry.example:5000/team/traefik:3.7.13; do
+  assert_image 0 "" "$image"
+done
+
+for tag in v2 v2.11.0 v3 v3.6.20 v3.7 v3.7.11 v3.7.12 v03.07.012 v3.7.08; do
+  assert_image 1 "incompatible with this configuration" "traefik:$tag"
+done
+
+digest="sha256:$(printf '%064d' 0)"
+for image in traefik:latest traefik:custom-build traefik registry.example:5000/traefik \
+  "traefik@$digest" "registry.example:5000/team/traefik@$digest" \
+  "traefik:v3.7.13@$digest" "traefik:latest@$digest" \
+  traefik:v3.7.13-rc1 traefik:v3.7.13-alpine traefik:v3.7.14+custom \
+  traefik:3..14 traefik:v3.7.14.0 traefik:custom:v3.7.14 :v3.7.14 \
+  "traefik: v3.7.14" $'traefik:v3.7.14\n'; do
+  assert_image 1 "Cannot verify TRAEFIK_IMAGE=" "$image"
+done
+
+echo "Passed $cases Traefik image configuration cases."