Add Docker-based E2E testing (#1320)

### Summary - Add automated end-to-end testing using Docker to verify the installation script works across 18 Linux distributions - Add Oracle Linux 9 support to the installation script - Drop support for EOL distributions (Debian 8/9/10, CentOS 7, Ubuntu 16.04) - Disable Digital Ocean droplets based end-to-end tests, let's use docker from now on ### Changes **New test infrastructure:** - `test/Dockerfile.server` - Multi-OS server image with `BASE_IMAGE` build arg - `test/Dockerfile.client` - Ubuntu 24.04 client for connectivity testing - `test/server-entrypoint.sh` - Runs install script, verifies files exist, asserts iptables NAT rules, starts OpenVPN - `test/client-entrypoint.sh` - Connects to VPN, verifies tun0 interface, pings gateway - `docker-compose.yml` - Orchestrates server + client with shared volume - `.github/workflows/docker-test.yml` - CI matrix testing 18 OS variants - `.github/workflows/test.yml` - Removed push/PR triggers, now manual only for DO tests - `Makefile` - Local testing commands (`make test`, `make test-ubuntu-24.04`, etc.) **Distributions tested (18 total):** | Family | Versions | |--------|----------| | Ubuntu | 18.04, 20.04, 22.04, 24.04 | | Debian | 11, 12 | | Fedora | 40, 41 | | Rocky Linux | 8, 9 | | AlmaLinux | 8, 9 | | Oracle Linux | 8, 9 | | Amazon Linux | 2, 2023 | | CentOS Stream | 9 | | Arch Linux | latest |
2025-12-12 07:22:41 +01:00 · 2025-12-07 12:27:41 +01:00
parent 94c1af2b5d
commit a3389c126c
10 changed files with 655 additions and 46 deletions
--- a/test/Dockerfile.client
+++ b/test/Dockerfile.client
@@ -0,0 +1,24 @@
+# checkov:skip=CKV_DOCKER_2:Test container doesn't need healthcheck
+# checkov:skip=CKV_DOCKER_3:OpenVPN client requires root for NET_ADMIN
+FROM ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Install OpenVPN client and testing tools
+RUN apt-get update && apt-get install -y \
+    openvpn \
+    iproute2 \
+    iputils-ping \
+    procps \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create TUN device directory (device will be mounted at runtime)
+RUN mkdir -p /dev/net
+
+# Copy test scripts
+COPY test/client-entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+WORKDIR /etc/openvpn
+
+ENTRYPOINT ["/entrypoint.sh"]
--- a/test/Dockerfile.server
+++ b/test/Dockerfile.server
@@ -0,0 +1,42 @@
+# checkov:skip=CKV_DOCKER_2:Test container doesn't need healthcheck
+# checkov:skip=CKV_DOCKER_3:OpenVPN server requires root for NET_ADMIN
+# checkov:skip=CKV_DOCKER_7:Base image is parameterized, some use latest tag
+ARG BASE_IMAGE=ubuntu:24.04
+FROM ${BASE_IMAGE}
+
+ARG BASE_IMAGE
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Install basic dependencies based on the OS
+RUN if command -v apt-get >/dev/null; then \
+        apt-get update && apt-get install -y \
+            iproute2 iptables curl procps systemd systemd-sysv \
+        && rm -rf /var/lib/apt/lists/*; \
+    elif command -v dnf >/dev/null; then \
+        dnf install -y --allowerasing \
+            iproute iptables curl procps-ng systemd tar gzip \
+        && dnf clean all; \
+    elif command -v yum >/dev/null; then \
+        yum install -y \
+            iproute iptables curl procps-ng systemd tar gzip \
+        && yum clean all; \
+    elif command -v pacman >/dev/null; then \
+        pacman -Syu --noconfirm \
+            iproute2 iptables curl procps-ng \
+        && pacman -Scc --noconfirm; \
+    fi
+
+# Create TUN device (will be mounted at runtime)
+RUN mkdir -p /dev/net
+
+# Copy the install script
+COPY openvpn-install.sh /opt/openvpn-install.sh
+RUN chmod +x /opt/openvpn-install.sh
+
+# Copy test scripts
+COPY test/server-entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+WORKDIR /opt
+
+ENTRYPOINT ["/entrypoint.sh"]
--- a/test/client-entrypoint.sh
+++ b/test/client-entrypoint.sh
@@ -0,0 +1,90 @@
+#!/bin/bash
+set -e
+
+echo "=== OpenVPN Client Container ==="
+
+# Create TUN device if it doesn't exist
+if [ ! -c /dev/net/tun ]; then
+	mkdir -p /dev/net
+	mknod /dev/net/tun c 10 200
+	chmod 600 /dev/net/tun
+fi
+
+echo "TUN device ready"
+
+# Wait for client config to be available
+echo "Waiting for client config..."
+MAX_WAIT=120
+WAITED=0
+while [ ! -f /shared/client.ovpn ] && [ $WAITED -lt $MAX_WAIT ]; do
+	sleep 2
+	WAITED=$((WAITED + 2))
+	echo "Waiting... ($WAITED/$MAX_WAIT seconds)"
+done
+
+if [ ! -f /shared/client.ovpn ]; then
+	echo "ERROR: Client config not found after ${MAX_WAIT}s"
+	exit 1
+fi
+
+echo "Client config found!"
+cat /shared/client.ovpn
+
+# Connect to VPN
+echo "Connecting to OpenVPN server..."
+openvpn --config /shared/client.ovpn --daemon --log /var/log/openvpn.log
+
+# Wait for connection
+echo "Waiting for VPN connection..."
+MAX_WAIT=60
+WAITED=0
+while ! ip addr show tun0 2>/dev/null | grep -q "inet " && [ $WAITED -lt $MAX_WAIT ]; do
+	sleep 2
+	WAITED=$((WAITED + 2))
+	echo "Waiting for tun0... ($WAITED/$MAX_WAIT seconds)"
+
+	# Check for errors
+	if [ -f /var/log/openvpn.log ]; then
+		tail -5 /var/log/openvpn.log
+	fi
+done
+
+if ! ip addr show tun0 2>/dev/null | grep -q "inet "; then
+	echo "ERROR: VPN connection failed"
+	echo "=== OpenVPN log ==="
+	cat /var/log/openvpn.log || true
+	exit 1
+fi
+
+echo "=== VPN Connected! ==="
+ip addr show tun0
+
+# Run connectivity tests
+echo ""
+echo "=== Running connectivity tests ==="
+
+# Test 1: Check tun0 interface
+echo "Test 1: Checking tun0 interface..."
+if ip addr show tun0 | grep -q "10.8.0"; then
+	echo "PASS: tun0 interface has correct IP range (10.8.0.x)"
+else
+	echo "FAIL: tun0 interface doesn't have expected IP"
+	exit 1
+fi
+
+# Test 2: Ping VPN gateway
+echo "Test 2: Pinging VPN gateway (10.8.0.1)..."
+if ping -c 3 10.8.0.1; then
+	echo "PASS: Can ping VPN gateway"
+else
+	echo "FAIL: Cannot ping VPN gateway"
+	exit 1
+fi
+
+echo ""
+echo "=========================================="
+echo "  ALL TESTS PASSED!"
+echo "=========================================="
+
+# Keep container running for debugging if needed
+exec tail -f /var/log/openvpn.log
--- a/test/server-entrypoint.sh
+++ b/test/server-entrypoint.sh
@@ -0,0 +1,109 @@
+#!/bin/bash
+set -e
+
+echo "=== OpenVPN Server Container ==="
+
+# Create TUN device if it doesn't exist
+if [ ! -c /dev/net/tun ]; then
+	mkdir -p /dev/net
+	mknod /dev/net/tun c 10 200
+	chmod 600 /dev/net/tun
+fi
+
+echo "TUN device ready"
+
+# Set up environment for auto-install
+export AUTO_INSTALL=y
+export APPROVE_INSTALL=y
+export APPROVE_IP=y
+export IPV6_SUPPORT=n
+export PORT_CHOICE=1
+export PROTOCOL_CHOICE=1
+export DNS=9 # Google DNS (works in containers)
+export COMPRESSION_ENABLED=n
+export CUSTOMIZE_ENC=n
+export CLIENT=testclient
+export PASS=1
+export ENDPOINT=openvpn-server
+
+# Prepare script for container environment:
+# - Replace systemctl calls with no-ops (systemd doesn't work in containers)
+# This ensures the script won't fail silently on systemctl commands
+sed 's/\bsystemctl /echo "[SKIPPED] systemctl " # /g' /opt/openvpn-install.sh >/tmp/openvpn-install.sh
+chmod +x /tmp/openvpn-install.sh
+
+echo "Running OpenVPN install script..."
+# Run in subshell because the script calls 'exit 0' after generating client config
+# Use || true to prevent set -e from exiting on failure, then check exit code
+(bash -x /tmp/openvpn-install.sh) && INSTALL_EXIT_CODE=0 || INSTALL_EXIT_CODE=$?
+
+echo "=== Installation complete (exit code: $INSTALL_EXIT_CODE) ==="
+
+if [ "$INSTALL_EXIT_CODE" -ne 0 ]; then
+	echo "ERROR: Install script failed with exit code $INSTALL_EXIT_CODE"
+	exit 1
+fi
+
+# Verify all expected files were created
+echo "Verifying installation..."
+MISSING_FILES=0
+for f in \
+	/etc/openvpn/server.conf \
+	/etc/openvpn/ca.crt \
+	/etc/openvpn/ca.key \
+	/etc/openvpn/tls-crypt.key \
+	/etc/openvpn/crl.pem \
+	/etc/openvpn/easy-rsa/pki/ca.crt \
+	/etc/iptables/add-openvpn-rules.sh \
+	/root/testclient.ovpn; do
+	if [ ! -f "$f" ]; then
+		echo "ERROR: Missing file: $f"
+		MISSING_FILES=$((MISSING_FILES + 1))
+	fi
+done
+
+if [ $MISSING_FILES -gt 0 ]; then
+	echo "ERROR: $MISSING_FILES required files are missing"
+	exit 1
+fi
+
+echo "All required files present"
+echo ""
+echo "Server config:"
+cat /etc/openvpn/server.conf
+
+# Copy client config to shared volume
+cp /root/testclient.ovpn /shared/client.ovpn
+# Modify remote address to use container hostname
+sed -i 's/^remote .*/remote openvpn-server 1194/' /shared/client.ovpn
+echo "Client config copied to /shared/client.ovpn"
+
+# Start OpenVPN server manually (systemd doesn't work in containers)
+echo "Starting OpenVPN server..."
+
+# Apply iptables rules manually (systemd not available in containers)
+echo "Applying iptables rules..."
+bash /etc/iptables/add-openvpn-rules.sh
+
+# Verify iptables NAT rules exist
+echo "Verifying iptables NAT rules..."
+if iptables -t nat -L POSTROUTING -n | grep -q "10.8.0.0"; then
+	echo "PASS: NAT POSTROUTING rule for 10.8.0.0/24 exists"
+else
+	echo "FAIL: NAT POSTROUTING rule for 10.8.0.0/24 not found"
+	echo "Current NAT rules:"
+	iptables -t nat -L POSTROUTING -n -v
+	exit 1
+fi
+
+# Enable IP forwarding (may already be set via docker-compose sysctls)
+if [ "$(cat /proc/sys/net/ipv4/ip_forward)" != "1" ]; then
+	echo 1 >/proc/sys/net/ipv4/ip_forward || {
+		echo "ERROR: Failed to enable IP forwarding"
+		exit 1
+	}
+fi
+
+# Start OpenVPN in foreground (run from /etc/openvpn so relative paths work)
+cd /etc/openvpn
+exec openvpn --config /etc/openvpn/server.conf