.kitchen.yml

#
# Cookbook:: sys
# Config file for test-kitchen
#
# Copyright:: 2015-2024 GSI Helmholtzzentrum fuer Schwerionenforschung GmbH
#
# Authors:
#  Christopher Huhn   <c.huhn@gsi.de>
#  Dennis Klein       <d.klein@gsi.de>
#  Matthias Pausch    <m.pausch@gsi.de>
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

---
driver:
  name: vagrant
  box_auto_update: true
  customize:
    memory: 1024
    cpus: 2

provisioner:
  require_chef_omnibus: false
  install_strategy: skip
  log_level: warn
  # name: chef-solo
  # chef_solo_path: /usr/bin/chef-solo
  name: chef_zero
  chef_client_path: /usr/bin/chef-client
  data_bags_path: test/integration/data_bags
  # product_name: cinc
  chef_omnibus_url: https://omnitruck.cinc.sh/install.sh

verifier:
  name: busser
  ruby_bindir: /usr/bin

platforms:
  - name: jessie
    driver:
      box: debian/jessie64
      require_chef_omnibus: 12.0.3
      provider: libvirt
      provision: true
      vagrantfiles:
        - vagrant.rb
  - name: stretch
    driver:
      box: gsi/stretch
      box_url: https://web-docs.gsi.de/~christo/vagrant-boxes/gsi-stretch.json
      provider: libvirt
      provision: true
      vagrantfiles:
        - vagrant.rb
  - name: buster
    driver:
      box: gsi/buster
      box_url: https://web-docs.gsi.de/~christo/vagrant-boxes/gsi-buster.json
      provider: libvirt
      provision: true
      vagrantfiles:
        - vagrant.rb
  - name: bullseye
    driver:
      box: debian/bullseye64
      provider: libvirt
      provision: true
      require_chef_omnibus: true
      vagrantfiles:
        - vagrant.rb
    provisioner:
      client_rb:
        # Chef 15 no longer collects passwd information by default
        # cf. https://stackoverflow.com/a/70749387/9793012
        'ohai.optional_plugins = ':
          - :Passwd
  - name: bookworm
    driver:
      box: debian/bookworm64
      provider: libvirt
      provision: true
      require_chef_omnibus: true
      vagrantfiles:
        - vagrant.rb
    provisioner:
      client_rb:
        # Chef 15 no longer collects passwd information by default
        # cf. https://stackoverflow.com/a/70749387/9793012
        'ohai.optional_plugins = ':
          - :Passwd
  - name: trixie
    driver:
      box: debian/testing64
      provider: libvirt
      provision: true
      require_chef_omnibus: true
      vagrantfiles:
        - vagrant.rb
    provisioner:
      client_rb:
        # Chef 15 no longer collects passwd information by default
        # cf. https://stackoverflow.com/a/70749387/9793012
        'ohai.optional_plugins = ':
          - :Passwd
  - name: focal
    driver:
      box: generic/ubuntu2004
      provider: libvirt
      provision: true
      vagrantfiles:
        - vagrant.rb
    provisioner:
      client_rb:
        # Chef 15 no longer collects passwd information by default
        # cf. https://stackoverflow.com/a/70749387/9793012
        'ohai.optional_plugins = ':
          - :Passwd
  # the Jammy libvirt image is broken - at least on my box
  # - name: jammy
  #   driver:
  #     box: generic/ubuntu2204
  #     provider: libvirt
  #     provision: true
  #     vagrantfiles:
  #       - vagrant.rb
  #   provisioner:
  #     client_rb:
  #       # Chef 15 no longer collects passwd information by default
  #       # cf. https://stackoverflow.com/a/70749387/9793012
  #       'ohai.optional_plugins = ':
  #         - :Passwd

suites:
  - name: sys_accounts
    run_list:
      - recipe[sys::accounts]
    attributes:
      sys:
        accounts:
          homer:  # empty
          bart:   # databag
          lisa:
            home: /home/lisa
            gid: simpsons
          root:
            # existing account, password should be changed,
            #  otherwise left untouched
            password: "$6$aycaramba$ql7zzi/ASEyEA.MsG5/7I6njGIfXoOn.JJjbToCLfadhYa9axBSJ.bWJiALYy3vA1FnzPx.ycq0uCXqOFrgW6/"
        groups:
          simpsons:
  - name: sys_apt
    run_list:
      - recipe[sys::ohai]   # for 'debian' ohai plugin
      - recipe[sys::apt]
    attributes:
      sys:
        apt:
          config:
            51languages:
              Acquire::Languages: none
          keys:
            add:
              - "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmI0EYhjlUAEEALEhqsecNZOQMYQncDh5htEPu4/nxga6vPovMsmy9viByGwOMhjk\nDSQ7KCykaF/qD3YCSRsxscEfK/S94QyAUI9TgLjW4pQ5Ru8tuHndOS7STAlN+g73\n1Um8XNkjcvGzVbnTC/GiZNvUaon7jmr5UQehrfrMsuDRAgkxTSiiI1DrABEBAAG0\nOlphcHBlcmdlY2sgKEVpbiBzY2h3aWVyaWdlcyBLaW5kKSA8emFwcGVyZ2Vja0Bl\neGFtcGxlLmNvbT6I0gQTAQoAPBYhBHRLnTKh+G0175mg0SWgrRZdPwfvBQJiGOVQ\nAhsDBQld/A8ABAsJCAcFFQoJCAsEFgIDAQIeAQIXgAAKCRAloK0WXT8H7zLKBACF\nJjyzBjjhzbCy25E0nQefGvPzxrsQOkjObESmt5mq7TBPRJlKyR1RRJxqtE/D/Hwa\nsn9APnFtacX1CYkpDDVLRJWkujfv4eX7Oa/HSrAHMvXLw8hsNXIZVawD/4PMKskC\nPJOHirykipjT4Hh0tES+YhM8jRlspvlh0FFAKGvIHw==\n=lA2v\n-----END PGP PUBLIC KEY BLOCK-----\n"
          multiarch: true
          packages:
            - nyancat
          preferences:
            sid:
              package: '*'
              pin: release l=Debian,n=sid
              priority: 333
          repositories:
            # broken on Ubuntu - needs repo key for sid too
            sid: "deb http://ftp.debian.org/debian sid main"
  - name: sys_autofs
    run_list:
      - recipe[sys::autofs]
      - recipe[sys::file]
    attributes:
      sys:
        autofs:
          maps:
            test:
              # dummy entry to avoid nil value
              foo: bar
        file:
          # create a bind mount autofs map for testing
          /etc/auto.test:
            content: tempo -fstype=bind :/tmp
            notifies:
              - reload
              - service[autofs]
  - name: sys_banner
    run_list:
      - recipe[sys::banner]
    attributes:
      sys:
        banner:
          header: 'Space: the final frontier.'
          message:
            - These are the voyages of the starship Enterprise.
            - 'Its continuing mission: to explore strange new worlds.'
            - To seek out new life and new civilizations.
          service_properties:
            - To boldly go where no one has gone before!
          footer: Engage!
          info: true
  - name: sys_chef
    run_list:
      - recipe[sys::chef]
    attributes:
      sys:
        admin_group: adm
        chef:
          server_url: http://localhost:4000
          init_style: systemd-timer
    driver:
      customize:
        memory: 1024 # increase memory for chef-zero install
      vagrantfiles:
        - vagrant.rb
        - vagrant_buildenv.rb # required to install chef-zero gem
  - name: sys_fail2ban
    run_list:
      - recipe[sys::fail2ban]
    attributes:
      sys:
        fail2ban:
          jail.local:
            DEFAULT:
              bantime: 1234
              maxretry: '4'
              findtime: 2468
              # on Trixie ignoreself has to be turned off explicitely
              #  for ban testing to work:
              ignoreself: false
          logtarget: syslog
  - name: sys_ferm
    run_list:
      - recipe[sys::ferm]
    attributes:
      sys:
        ferm:
          rules:
            ip:
              filter:
                INPUT:
                  - 'policy ACCEPT;'
                OUTPUT:
                  - 'policy ACCEPT;'
                FORWARD:
                  - 'policy DROP;'
  - name: sys_ldap
    run_list:
      - recipe[sys::ldap]
  - name: sys_linuxlogo
    run_list:
      - recipe[sys::linuxlogo]
    attributes:
      sys:
        linuxlogo: absolutely!
  - name: sys_krb5
    run_list:
      - recipe[sys::krb5]
    attributes:
      sys:
        krb5:
           foo: bar
  - name: sys_mail
    run_list:
      - recipe[sys::mail]
      - recipe[mail-test::default]
    attributes:
      sys:
        mail:
          relay:
            smtp.example.com
          aliases:
            array:
              - '| /bin/true'
              - /tmp/mail.test
            nobody: knowsthetroubleiveseen@example.org
          message_size_limit: 1234567890
  - name: sys_multipath
    run_list:
      - recipe[sys::multipath]
    attributes:
      sys:
        multipath:
          disable: false
          regenerate_initramdisk: true
          defaults:
            verbosity: 5
  - name: sys_nfs
    run_list:
      - recipe[sys::nfs]
    attributes:
      sys:
        nfs:
          gssd:
            verbosity: 12
            rpc-verbosity: 7
  - name: sys_nftables
    run_list:
      - recipe[nftables-test::default]
  - name: sys_nftablesempty
    run_list:
      - recipe[nftables-test::empty]
  - name: sys_nsswitch
    run_list:
      - recipe[nsswitch-test::default]
    # attributes:
    #   sys:
    #     nsswitch:
    #       foo: bar
    #       passwd: files
    #       netgroup: compat
  - name: sys_ohai
    run_list:
      - recipe[sys::ohai]
    driver:
      vagrantfiles:
        - vagrant.rb
        - vagrant_buildenv.rb  # required to install ohai gem
  - name: sys_resolv
    run_list:
      - recipe[sys::resolv]
    attributes:
      sys:
        resolv:
          servers:
            - 8.8.8.8
            - 9.9.9.9
            - 140.181.61.61  # in case the cloud DNS servers are not accessible
          search:
            - gsi.de
            - fair-center.eu
          domain:
            example.com
          options:
            - rotate
            - timeout:3
          force: true
  - name: sys_rsyslog
    run_list:
      - recipe[sys::rsyslog]
    attributes:
      rsyslog:
        filter: '*.*'
        protocol: 'tcp'
      sys:
        rsyslog:
          loghosts:
            test-tls:
              tls: true
              target: '192.168.144.120'
              port: 55514
              priority_filter: 'authpriv.*'
            test-relp:
              tls: true
              target: '192.168.144.96'
              type: 'omrelp'
            no-tls:
              target: '192.168.144.72'
  - name: sys_snmp
    run_list:
      - recipe[sys::hosts]
      - recipe[sys::snmp]
    attributes:
      sys:
        hosts:
          allow:
            - "snmpd: 127.0.0.1"
        snmp:
          community: oz
          sys_contact: Dorothy Gale
          sys_location: Somewhere over the rainbow
          log_level: alert
  - name: sys_ssh
    run_list:
      - recipe[sys::accounts]
      - recipe[sys::ssh]
    attributes:
      sys:
        accounts:
          mchammer:
            home: /home/mchammer
        ssh:
          authorize:
            mchammer:
              keys:
                - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+UAVz/kz0W/kTg0FGenwvJKZxxuBfLOKfg+VaKq9hB
            root:
              keys:
                - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKZ7mI0iEdW2GmHZv+0OknkPDkQaBowEDzfaal2A+eRR
          config:
            root:
              '*':
                AddKeysToAgent: ask
          known_hosts:
            git.gsi.de:
              ssh-rsa: AAAAB3NzaC1yc2EAAAADAQABAAABAQCeDOfPabxvYr+HNlBfE4plYktECkYIDRE3ggxjPOSGIH1SEMp+eMvbm46/aGXRBtEcHDXNju+CS2P+RjiNVV7UWzbkrsi3uyjDoDwMRlJyhvPR79fS4nsxI04ztk0GrYYZRGoDj9LcVdXWHYN/Ru70K2U+G2bQ8l2otMYVKdnsIssd1MOBpISy7fursYmC31U/Bpn19nfn0sRpdL8WNrjmJukFTzaSAJQIzciF/uTkAw5qmmJXRsl7aXyk5S690SQx8Wj1Jk8+AM508zdeD/M6vnWXDQQWZPYi1IcB+GA+7mQr9ijo3qJ9dIT54iZUAWmZU1KGYh5PBD93OnuiFh3P
              ecdsa-sha2-nistp256: AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHXJoiDuGO3tveTCbbQONo9mBCXohPlziqGJAMvW8BY/WRMTW+C4Thoc2L69JZtV/FHF7fGpJ/g81Ljrxm4Huk8=
              ssh-ed25519: AAAAC3NzaC1lZDI1NTE5AAAAINftkQCmVICGs0rdcZ13OQhdaQMjrYhsFF1ACtNwMseR
            github.com:
              ecdsa-sha2-nistp256: AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
              ssh-ed25519: AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
              ssh-rsa: AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
          ssh_config:
            - '*.example.org':
                SendEnv: TGIF
        sshd:
          config:
            ClientAliveInterval: 4711
            X11Forwarding: 'no'
  - name: sys_ssl
    run_list:
      - recipe[sys::ssl]
    attributes:
      sys:
        ssl:
          certs:
            - {}    # will not find data bag item
            - data_bag_item: www-linux.gsi.de
            - data_bag_item: www-linux.gsi.de
              file: '/etc/ssl/certs/www-linux.gsi.de_chain.pem'
              include_chain: true
              key_file: '/etc/ssl/private/www-linux.gsi.de_chain.key'
            - data_bag_item: www-linux.gsi.de
              file: '/etc/ssl/certs/www-linux.gsi.de_no_chain.pem'
              key_file: '/etc/ssl/private/www-linux.gsi.de_no_chain.key'
            - data_bag: other_certs
              data_bag_item: alternativlos.org
              file: /tmp/covfefe.pem
            - data_bag: nonexistant_databag
  - name: sys_sudo
    run_list:
      - recipe[sys::env]
      - recipe[sys::sudo]
    attributes:
      sys:
        env:
          FFF: "SKOLSTREJK F&Ouml;R KLIMATET"
          RESCUE: "THE PLANET"
        sudo:
          config:
            cleanup: true
            mailfrom: prosecutor@example.com
            mailto: daemon
            mailsub: "[SUDO] RED ALERT!"
          kitchen:
            defaults:
              - user: SMUTJE
                option: "env_keep += FFF"
            users:
              SMUTJE:
                # for kitchen-docker:
                - kitchen
                # for kitchen-vagrant:
                - vagrant
                # for env_keep test:
                - root
            rules:
              - "SMUTJE ALL=(ALL) NOPASSWD: ALL"
  - name: sys_systemd
    run_list:
      - recipe[sys::systemd]
    attributes:
      sys:
        systemd:
          unit:
            unknown_method:
              whatever: "Should throw an error but converge"
          journald:
            Storage: volatile
            RuntimeMaxUse: 128M
  - name: sys_time
    run_list:
      - recipe[sys::time]
    attributes:
      sys:
        time:
          zone: Antarctica/Troll
          servers:
            - ntp1.net.berkeley.edu
            - time1.esa.int
            - zeit.fu-berlin.de
  - name: sys_x509
    run_list:
      - recipe[x509-test::default]