Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for cluster resources, QEMU config, and node SSL fields - Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and terminate HTTPS at Kubernetes Ingress - Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and make pulumi-tests - Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions (make ci + Compose/Helm validation)
2026-07-18 04:18:05 +03:00
parent 777926487b
commit 48df10b17e
172 changed files with 7528 additions and 1208 deletions
@@ -0,0 +1,22 @@
+FROM python:3.13-bookworm
+
+ARG PULUMI_VERSION=3.193.0
+ARG PULUMI_PROXMOXVE_VERSION=8.2.1
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl ca-certificates \
+    && curl -fsSL https://get.pulumi.com | sh -s -- --version "${PULUMI_VERSION}" \
+    && ln -s /root/.pulumi/bin/pulumi /usr/local/bin/pulumi \
+    && pip install --no-cache-dir \
+        "httpx==0.28.1" \
+        "pulumi==${PULUMI_VERSION}" \
+        "pulumi-proxmoxve==${PULUMI_PROXMOXVE_VERSION}" \
+    && pulumi plugin install resource proxmoxve "${PULUMI_PROXMOXVE_VERSION}" \
+        --server github://api.github.com/muhlba91/pulumi-proxmoxve \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace/pulumi-tests
+ENV PYTHONPATH=/workspace/pulumi-tests/pulumi:/workspace/pulumi-tests
+ENV PULUMI_CONFIG_PASSPHRASE=hx-test-passphrase
+
+CMD ["python", "pulumi/run_suite.py"]
@@ -0,0 +1,188 @@
+name: proxmox-hx-tests
+
+x-test-env: &test-env
+  API_URL: http://simulator:8006
+  API_USER: ${API_USER:-root@pam}
+  API_PASSWORD: ${API_PASSWORD:-secret}
+  API_TOKEN: ${API_TOKEN:-root@pam!automation=automation-secret}
+  PVE_NODE: ${PVE_NODE:-pve01}
+  PVE_STORAGE: ${PVE_STORAGE:-local-lvm}
+  PVE_BRIDGE: ${PVE_BRIDGE:-vmbr0}
+  API_TIMEOUT: ${API_TIMEOUT:-120}
+  TEST_RESOURCE_PREFIX: ${TEST_RESOURCE_PREFIX:-hx}
+  PYTHONPATH: /workspace/pulumi-tests/pulumi:/workspace/pulumi-tests
+  CONTRACTS_ROOT: /workspace/contracts
+  SIMULATION_TIME_SCALE: "10"
+  # pulumi-proxmoxve requires https://… endpoints; keep TLS internal to this suite.
+  # Host-facing Compose lab stays plain HTTP on :8006 (K8s TLS = Ingress only).
+  PROXMOX_VE_ENDPOINT: https://tls-gateway:8443/
+  PROXMOX_VE_USERNAME: ${API_USER:-root@pam}
+  PROXMOX_VE_PASSWORD: ${API_PASSWORD:-secret}
+  PROXMOX_VE_INSECURE: "true"
+
+x-simulator-env: &simulator-env
+  DATABASE_URL: postgresql://proxmox:proxmox@postgres:5432/proxmox_simulator
+  CONTRACT_SNAPSHOT: /app/contracts/pve-9.2.3.json
+  COMPATIBILITY_EVIDENCE: /app/evidence/pve-9.2.3.json
+  LOG_LEVEL: INFO
+  TICKET_SIGNING_KEY: development-only-signing-key-change-me
+  TASK_WORKER_CONCURRENCY: "4"
+  SIMULATION_TIME_SCALE: "10"
+
+networks:
+  hx:
+    driver: bridge
+
+volumes:
+  postgres-data:
+  pulumi-state:
+
+services:
+  postgres:
+    image: postgres:17.5-bookworm
+    networks: [hx]
+    environment:
+      POSTGRES_DB: proxmox_simulator
+      POSTGRES_USER: proxmox
+      POSTGRES_PASSWORD: proxmox
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U proxmox -d proxmox_simulator"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+      start_period: 5s
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+
+  migrate:
+    build:
+      context: ../..
+      target: runtime
+    image: proxmox-api-simulator:0.1.0
+    networks: [hx]
+    environment:
+      <<: *simulator-env
+    depends_on:
+      postgres:
+        condition: service_healthy
+    entrypoint: ["python"]
+    command: ["-m", "app.db.migrate_cli"]
+    restart: "no"
+
+  simulator:
+    build:
+      context: ../..
+      target: runtime
+    image: proxmox-api-simulator:0.1.0
+    networks: [hx]
+    environment:
+      <<: *simulator-env
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+    command: ["--host", "0.0.0.0", "--port", "8006"]
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "python",
+          "-c",
+          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8006/health/ready', timeout=2)",
+        ]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+      start_period: 15s
+    ports:
+      - "${HX_SIMULATOR_HOST_PORT:-127.0.0.1:18006}:8006"
+
+  # Internal-only HTTPS for pulumi-proxmoxve (provider rejects http:// endpoints).
+  # Not published on host :8006 — lab HTTPS for end users is K8s Ingress.
+  tls-gateway:
+    image: nginx:1.28.0-alpine
+    networks: [hx]
+    depends_on:
+      simulator:
+        condition: service_healthy
+    volumes:
+      - ../../docker/tls/gateway.conf:/etc/nginx/conf.d/default.conf:ro
+      - ../../docker/tls/server.crt:/etc/nginx/tls/server.crt:ro
+      - ../../docker/tls/server.key:/etc/nginx/tls/server.key:ro
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "wget -qO- --no-check-certificate https://127.0.0.1:8443/health/ready || exit 1",
+        ]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+      start_period: 5s
+    read_only: true
+    tmpfs:
+      - /var/cache/nginx
+      - /var/run
+      - /tmp
+
+  seed:
+    image: proxmox-api-simulator:0.1.0
+    networks: [hx]
+    environment:
+      <<: *simulator-env
+      SEED_PROFILE: ${SEED_PROFILE:-small}
+    depends_on:
+      simulator:
+        condition: service_healthy
+    entrypoint: ["python"]
+    command: ["-m", "app.simulation.seed_cli"]
+    restart: "no"
+
+  pulumi-runner:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.pulumi-runner
+    image: hx-pulumi-runner:local
+    networks: [hx]
+    working_dir: /workspace/pulumi-tests
+    volumes:
+      - ../..:/workspace
+      - pulumi-state:/workspace/pulumi-tests/pulumi/.pulumi-state
+    environment:
+      <<: *test-env
+      PULUMI_CONFIG_PASSPHRASE: hx-test-passphrase
+      PULUMI_BACKEND_URL: file:///workspace/pulumi-tests/pulumi/.pulumi-state
+    depends_on:
+      seed:
+        condition: service_completed_successfully
+      tls-gateway:
+        condition: service_healthy
+    profiles: [pulumi]
+    entrypoint: ["python"]
+    command:
+      [
+        "pulumi/run_suite.py",
+        "--report-html",
+        "pulumi/reports/report.html",
+        "--report-json",
+        "pulumi/reports/results.json",
+        "--report-junit",
+        "pulumi/reports/junit.xml",
+      ]
+
+  cleanup:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.pulumi-runner
+    image: hx-pulumi-runner:local
+    networks: [hx]
+    working_dir: /workspace/pulumi-tests
+    volumes:
+      - ../..:/workspace
+    environment:
+      <<: *test-env
+    depends_on:
+      simulator:
+        condition: service_healthy
+    profiles: [cleanup]
+    entrypoint: ["python"]
+    command: ["tools/cleanup_test_resources.py"]