mirror of
http://100.103.83.12:3003/fegger/odoo-at-payroll.git
synced 2026-09-17 16:56:42 +00:00
48 lines
1.7 KiB
Python
48 lines
1.7 KiB
Python
"""Statische Schutztests für den Docker-Compose-Deploymentvertrag."""
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def load_compose() -> dict:
|
|
return yaml.safe_load((ROOT / "compose.yaml").read_text(encoding="utf-8"))
|
|
|
|
|
|
def test_compose_uses_external_ollama_network_and_tailscale_bind():
|
|
compose = load_compose()
|
|
service = compose["services"]["pv-agent"]
|
|
assert service["networks"] == ["ollama-default"]
|
|
assert compose["networks"]["ollama-default"] == {
|
|
"external": True,
|
|
"name": "ollama-default",
|
|
}
|
|
assert "100.103.83.12:${PV_PORT:-8080}:8080" in service["ports"]
|
|
assert service["environment"]["OLLAMA_URL"] == (
|
|
"${OLLAMA_URL:-http://ollama:11434}"
|
|
)
|
|
|
|
|
|
def test_compose_requires_auth_and_limits_container_privileges():
|
|
service = load_compose()["services"]["pv-agent"]
|
|
assert ":?" in service["environment"]["PV_API_KEY"]
|
|
assert "env_file" not in service
|
|
assert service["read_only"] is True
|
|
assert service["security_opt"] == ["no-new-privileges:true"]
|
|
assert service["cap_drop"] == ["ALL"]
|
|
assert "./data:/app/data" in service["volumes"]
|
|
assert "./wissensbasis:/app/wissensbasis:ro" in service["volumes"]
|
|
|
|
|
|
def test_docker_context_excludes_secrets_and_runtime_data():
|
|
ignored = set(
|
|
(ROOT / ".dockerignore").read_text(encoding="utf-8").splitlines()
|
|
)
|
|
assert {".env", "data", ".lexis360", ".rechtsprechung", "wissensbasis"} <= ignored
|
|
dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
|
|
assert "requirements-runtime.txt" in dockerfile
|
|
assert "COPY agent/" in dockerfile
|
|
assert "COPY web/" in dockerfile
|
|
assert "COPY ." not in dockerfile
|