mender-testkit 0.1.1__py3-none-any.whl

mender_testkit/__init__.py

@@ -0,0 +1,31 @@
+# Copyright 2026 Northern.tech AS
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+"""Shared test infrastructure for the Mender integration test suites."""
+
+import os
+
+# Traefik's routers match on Host as well as path, and the tests address the
+# ingress by container IP, so every request has to carry this. testutils defaults
+# it to "traefik", the name mender-server's own deployments answer to.
+#
+# Set here rather than in plugin.py because it has to happen before
+# testutils.api.client is imported -- that module reads it into a module-level
+# constant. Importing any submodule of this package runs this file first, whereas
+# plugin.py's own module-level imports already pull testutils in before its body
+# executes.
+os.environ.setdefault("GATEWAY_HOSTNAME", "docker.mender.io")
+
+from ._server_ref import MENDER_SERVER_REF  # noqa: E402
+
+__all__ = ["MENDER_SERVER_REF"]

mender_testkit/_server_ref.py

@@ -0,0 +1,27 @@
+# Copyright 2026 Northern.tech AS
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+"""The mender-server commit this package's vendored trees were taken from.
+
+Both src/testutils/ and src/mender_testkit/data/mender_server/ are copies
+of that commit, refreshed by scripts/vendor.py. Do not edit either tree by
+hand: a fix belongs upstream in mender-server, after which this ref moves and
+the copies are regenerated. Renovate updates the constant below, see
+renovate.json5.
+
+A commit rather than a release tag because the Host-header routing the tests
+depend on (MENDER_HOSTNAME in docker-compose.yml) is not in any tag yet -- as of
+this writing v4.1.1 through v4.1.3 have none of it.
+"""
+
+MENDER_SERVER_REF = "30871b083f9b3154b560ac8f618cd58dcf8e35d8"

mender_testkit/compose.py

@@ -0,0 +1,114 @@
+# Copyright 2026 Northern.tech AS
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+"""Access to the mender-server compose files shipped as package data.
+
+importlib.resources exposes package data as a Traversable, not a filesystem
+path -- in a zipped install there is no path at all. Docker compose needs real
+files, and it needs them as a *tree*: docker-compose.yml binds ./compose/certs,
+./compose/config/traefik and ./compose/config/mender.pem relative to the project
+directory, and it `include:`s compose/docker-compose.seaweedfs.yml. So the whole
+directory is materialised together rather than a file at a time.
+
+importlib.resources.as_file() is the usual answer for a single resource, but its
+temporary copy is removed when the context manager exits, which is no good for
+paths that have to outlive a `compose up` ... `compose down` cycle.
+"""
+
+import atexit
+import logging
+import shutil
+import tempfile
+from importlib.resources import files
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+_DATA_ROOT = ("data", "mender_server")
+# Overrides written by this package rather than vendored from mender-server, so
+# they live outside the tree scripts/vendor.py regenerates.
+_OVERLAY_ROOT = ("data", "overlays")
+
+# Materialised at most once per process, so `up` and `down` are handed identical
+# paths. Under xdist each worker gets its own copy, which costs 31 KB.
+_materialised = None
+
+
+def _copy_tree(src, dest: Path) -> None:
+    """Recursively copy a Traversable into a real directory.
+
+    Written against the Traversable API rather than shutil.copytree so that it
+    works whether the package is installed as a directory or inside a zip.
+    """
+    dest.mkdir(parents=True, exist_ok=True)
+    for entry in src.iterdir():
+        target = dest / entry.name
+        if entry.is_dir():
+            _copy_tree(entry, target)
+        else:
+            target.write_bytes(entry.read_bytes())
+
+
+def compose_dir(dest=None) -> Path:
+    """Real on-disk directory holding mender-server's compose tree.
+
+    Pass this as compose's --project-directory so the relative bind mounts in
+    docker-compose.yml resolve. This package's own overrides are materialised
+    alongside, under overlays/.
+
+    With no `dest` the tree goes to a temporary directory removed at process
+    exit, which suits a pytest session. Pass `dest` to materialise somewhere
+    that outlives this process -- handing the path to a shell script, say.
+    """
+    global _materialised
+
+    def _build(target: Path) -> None:
+        _copy_tree(_resource(_DATA_ROOT), target)
+        _copy_tree(_resource(_OVERLAY_ROOT), target / "overlays")
+
+    if dest is not None:
+        dest = Path(dest)
+        _build(dest)
+        return dest
+    if _materialised is None:
+        tmp = Path(tempfile.mkdtemp(prefix="mender-compose-"))
+        _build(tmp)
+        atexit.register(shutil.rmtree, tmp, ignore_errors=True)
+        logger.debug("materialised mender-server compose files to %s", tmp)
+        _materialised = tmp
+    return _materialised
+
+
+def _resource(parts):
+    root = files(__package__)
+    for part in parts:
+        root = root / part
+    return root
+
+
+def compose_files(plan: str = "os", publish_ports: bool = False, dest=None) -> list:
+    """Compose files for `plan`, in the order they must be passed to -f.
+
+    By default the backend publishes no host ports: the tests reach Traefik by
+    container IP, and not publishing lets several backends coexist. Pass
+    publish_ports=True to reach the stack from the host, which only works for one
+    backend at a time.
+    """
+    d = compose_dir(dest)
+    paths = [d / "docker-compose.yml"]
+    if plan == "enterprise":
+        paths.append(d / "compose" / "docker-compose.enterprise.yml")
+    if not publish_ports:
+        # Last, so it overrides whatever the files above declared.
+        paths.append(d / "overlays" / "no-ports.yml")
+    return paths

mender_testkit/data/mender_server/.env

@@ -0,0 +1,7 @@
+MENDER_IMAGE_TAG=main
+# MENDER_IMAGE_REGISTRY=docker.io|registry.mender.io
+# MENDER_IMAGE_REPOSITORY=mendersoftware|mender-server-enterprise
+
+# Environment for configuring s3 secret.
+MENDER_ACCESS_KEY_ID=mender
+MENDER_SECRET_ACCESS_KEY=thisisnotsecure

mender_testkit/data/mender_server/compose/certs/mender.crt

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIB0jCCAXmgAwIBAgIUBFs9wGFvoR3FEF9hK5b1iOrZsL0wCgYIKoZIzj0EAwIw
+GzEZMBcGA1UEAwwQZG9ja2VyLm1lbmRlci5pbzAeFw0yMTA2MDExMzExMTNaFw0z
+MTA1MzAxMzExMTNaMBsxGTAXBgNVBAMMEGRvY2tlci5tZW5kZXIuaW8wWTATBgcq
+hkjOPQIBBggqhkjOPQMBBwNCAAQPyND/aGLxFoMl9PVMQ0gBG74VXK4hVgOWOznX
+VrzoBfETf6wXEyV7Dq217ZxtV7gsafyZ6lWtLx33qRfQd7Exo4GaMIGXMB0GA1Ud
+DgQWBBSjTHcK2xcQFJLrjnAv+0Sl6pLD8zAfBgNVHSMEGDAWgBSjTHcK2xcQFJLr
+jnAv+0Sl6pLD8zAPBgNVHRMBAf8EBTADAQH/MBMGA1UdJQQMMAoGCCsGAQUFBwMB
+MC8GA1UdEQQoMCaCEGRvY2tlci5tZW5kZXIuaW+CEiouZG9ja2VyLm1lbmRlci5p
+bzAKBggqhkjOPQQDAgNHADBEAiAvmTdg3z7GkrnNM+N5ujl4xIm6bdnVhhLXkJdn
+TyWKrwIgN2asFU4swaMUobs6uXMBt5zftfLKwuQIYbBEwBemWFg=
+-----END CERTIFICATE-----

mender_testkit/data/mender_server/compose/certs/mender.key

@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg1l/vZtE9AH5eDFkD
+7Cs814ZSv5SxbbC+1VK8m8S8npahRANCAAQPyND/aGLxFoMl9PVMQ0gBG74VXK4h
+VgOWOznXVrzoBfETf6wXEyV7Dq217ZxtV7gsafyZ6lWtLx33qRfQd7Ex
+-----END PRIVATE KEY-----

mender_testkit/data/mender_server/compose/config/mender.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCJQ4+0xaG9L8M6
+Fs7vSHwYj8/Q4DtJaBS2SguHs9/6Mm2d5M8xNv32r2CAsiQUrsQq7moBm/zy7UkY
+pLamyTWY3SNlUHnROH85H6DshFd9rEOCcyTjcDsBfTfDhxYi0YJtd7vmz5wlAupE
+i+cThNWVtb6O8ZblliPLuAwKTqrrfiOFVKuIHpnZB6lYVDUJU+T+iJaQGuKPt28h
+TtcC/+TQePvYJ7z6zZEXe/cBJ5wtpv0KCDRKlPg/vP8rP/tQ2t7B8ySCzJSX1WxL
+fEnZn134nUFLvpp4fLYnIzGSexYDnYFLRdZAKj3zYMjAKpbqks0fU8FpW+9EUUnC
+1TnB/0Q9AgMBAAECggEAL5Tp9eIkZO5voG1TooLf8au4gFGae6HGvEICqTHjTFm6
+wecVI5xKgP7eVv5pn3nNqowm1xP5pUQ3+IDwh/RrzeeqY254K9yHzYd3Q0XFBl12
+sXu0p9q5uZRshi0HsV4q9kNxMVt6ZyIRj11n5s4/M7xiqC56/m8DTZUpJ1GJ0kPP
+kKdtAGjK6it/XHbRCGJ7pNBq75a4s++oM8If5oPLYqexXhnPm39IjrZ8n2bmIVMZ
+9f34WaRFGqTVU4aQn5AR1FRgIYHUkQVHyRBI3A6ddkSc+qcCzj3U+Wt9ZYvoDnLa
+vrP3fzFancTPvP0wYYIegI+rEtUE1+w0OSKOtNdyiQKBgQC/8WGKCbwayo1dSZgv
+F7OHzCtkH9MZbJipkB+dMDVoBMUVEQSAp8GjjB/F67l7QtKFjRwao5YW3tkvhohf
+u/mbbHDD2zGjKM19A0IJIxX7jPOBLc/YWEH0LFuUHAW+FIiGrXTnEnASfz1gmrZq
+hbWqJrwgvdl49/+3G4mXyqHbDwKBgQC3ErAQY8sN0Z9mCxqeFDQ1Lbh/fkHgrl+c
+FS5fkOVJC5Vix6SI6eDEwIlARmiuCu57k9IiLP6rTSuo9y6aOlcYJfQYVYw5uTPf
+hlbadTrTQRytFM4ha+y+KB6N7ESlJHCUR7GJqHSILnt3FzjuI27Fl4AJCLjwKy1a
+nGaznqJb8wKBgCu8P4Jph2//WUi5XTDV0LWPow90ZPB1Gy//xARYGMMz2wha0VDT
+aL7wTckWVjQs3LVLmuzC+48IhipbGDXgKhbtFaC7EEtiH7hthp14XijsTAvSOXrN
+WXHerZtI61INcbJmUa3ZOKouTfj2J7yL7QHxQ4qeV7BFqgG6B5cLt+enAoGAYIQK
+rGlgKMXl6k9aVhLCv3J+PUDcDE8B+vCzxRBHwS3JMQ2dsczTggcblPZJw8/hkOcK
+tpfQH5GMvgSq3gZ52jJQMPARAHGiZmqVqZB6VduS+bDpR3d1lX7jNOFmA0Zlz9bI
+Q5G69fzDfLKSggHOKX/IsXqWvY+V1pp0DqhIYn8CgYEAqCTUEX4nbKzKsh9+rxwh
+m69Bpb/wPUTMsVmGKVPOqcXkCwx9Z/mFqlpm1wT3inZaNRcZ67Lrn1qfDhE0kUBF
+QmrgFugqulEahrYpZcR4s7LM7RBQFadzgHGXWGonYDMNUMxTU+HIKuHEac++L1xP
+HDs7g8VXdLEUfbVl1As20d4=
+-----END PRIVATE KEY-----

mender_testkit/data/mender_server/compose/config/traefik/middlewares.yaml

@@ -0,0 +1,48 @@
+http:
+  middlewares:
+    sec-headers:
+      headers:
+        stsSeconds: 31536000
+        forceSTSHeader: true
+        stsPreload: true
+        stsIncludeSubdomains: true
+        contentTypeNosniff: true
+        browserXssFilter: true
+        customRequestHeaders:
+          "X-Forwarded-Proto": "https"
+
+    compression:
+      compress: true
+
+    devauth:
+      forwardAuth:
+        address: "http://deviceauth:8080/api/internal/v1/devauth/tokens/verify"
+        authResponseHeaders: "X-MEN-RequestID"
+
+    userauth:
+      forwardAuth:
+        address: "http://useradm:8080/api/internal/v1/useradm/auth/verify"
+        authResponseHeaders: "X-MEN-RequestID,X-MEN-RBAC-Inventory-Groups,X-MEN-RBAC-Deployments-Groups,X-MEN-RBAC-Releases-Tags"
+
+    inventoryV1-replacepathregex:
+      replacepathregex:
+        regex: "^/api/devices/v1/inventory/(.*)"
+        replacement: "/api/0.1.0/attributes"
+
+    inventoryMgmtV1-replacepathregex:
+      replacepathregex:
+        regex: "^/api/management/v1/inventory/(.*)"
+        replacement: "/api/0.1.0/$1"
+
+    mgmtStack:
+      chain:
+        middlewares:
+          - userauth
+          - sec-headers
+          - compression
+
+    devStack:
+      chain:
+        middlewares:
+          - devauth
+          - compression

mender_testkit/data/mender_server/compose/config/traefik/tls.yaml

@@ -0,0 +1,9 @@
+tls:
+  stores:
+    default:
+      defaultCertificate:
+        certFile: /etc/traefik/certs/mender.crt
+        keyFile: /etc/traefik/certs/mender.key
+  options:
+    default:
+      minVersion: VersionTLS12

mender_testkit/data/mender_server/compose/docker-compose.enterprise.yml

@@ -0,0 +1,181 @@
+# Enterprise override for ../docker-compose.yml
+services:
+  auditlogs:
+    build:
+      context: .
+      dockerfile: ./backend/services/auditlogs/Dockerfile
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/auditlogs:${MENDER_IMAGE_TAG:-latest}
+    restart: on-failure:3
+    command: [server, --automigrate]
+    depends_on:
+      - mongo
+    environment:
+      AUDITLOGS_MONGO_URL: "mongodb://mongo"
+      AUDITLOGS_DEVICEAUTH_ADDRESS: "deviceauth:8080"
+      AUDITLOGS_USERADM_ADDRESS: "useradm:8080"
+    labels:
+      traefik.enable: "true"
+      traefik.http.services.auditlogs.loadBalancer.server.port: "8080"
+      traefik.http.routers.auditlogs.middlewares: "mgmtStack@file"
+      traefik.http.routers.auditlogs.rule: >-
+        (Host(`${MENDER_HOSTNAME:-docker.mender.io}`) || Host(`localhost`) || Host(`traefik`)) &&
+        PathRegexp(`/api/management/v[0-9a-z]+/auditlogs`)
+      traefik.http.routers.auditlogs.service: auditlogs
+    networks:
+      default:
+        aliases: [mender-auditlogs]
+
+  create-artifact-worker:
+    build:
+      context: .
+      dockerfile: ./backend/services/create-artifact-worker/Dockerfile
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/create-artifact-worker:${MENDER_IMAGE_TAG:-latest}
+
+  deployments:
+    build:
+      context: .
+      dockerfile: ./backend/services/deployments/Dockerfile
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/deployments:${MENDER_IMAGE_TAG:-latest}
+    environment:
+      DEPLOYMENTS_ENABLE_AUDIT: "1"
+
+  deviceauth:
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/deviceauth:${MENDER_IMAGE_TAG:-latest}
+    environment:
+      DEVICEAUTH_REDIS_CONNECTION_STRING: "redis://redis:6379"
+      DEVICEAUTH_REDIS_LIMITS_EXPIRE_SEC: "3600"
+      DEVICEAUTH_TENANTADM_ADDR: "http://tenantadm:8080"
+      DEVICEAUTH_HAVE_ADDONS: "1"
+      DEVICEAUTH_ENABLE_AUDIT: "1"
+
+  deviceconfig:
+    build:
+      context: .
+      dockerfile: ./backend/services/deviceconfig/Dockerfile
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/deviceconfig:${MENDER_IMAGE_TAG:-latest}
+
+  deviceconnect:
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/deviceconnect:${MENDER_IMAGE_TAG:-latest}
+    environment:
+      DEVICECONNECT_ENABLE_AUDIT: "true"
+
+  devicemonitor:
+    build:
+      context: .
+      dockerfile: ./backend/services/devicemonitor/Dockerfile
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/devicemonitor:${MENDER_IMAGE_TAG:-latest}
+    restart: on-failure:3
+    command: [server, --automigrate]
+    depends_on:
+      - mongo
+    environment:
+      DEVICEMONITOR_MONGO_URL: "mongodb://mongo"
+      DEVICEMONITOR_WORKFLOWS_URL: http://workflows:8080
+    labels:
+      traefik.enable: "true"
+      traefik.http.services.devicemonitor.loadBalancer.server.port: "8080"
+      traefik.http.routers.devicemonitorDev.middlewares: "devStack@file"
+      traefik.http.routers.devicemonitorDev.rule: >-
+        (Host(`${MENDER_HOSTNAME:-docker.mender.io}`) || Host(`localhost`) || Host(`traefik`)) &&
+        PathRegexp(`/api/devices/v[0-9a-z]+/devicemonitor`)
+      traefik.http.routers.devicemonitorDev.service: devicemonitor
+      traefik.http.routers.devicemonitorMgmt.middlewares: "mgmtStack@file"
+      traefik.http.routers.devicemonitorMgmt.rule: >-
+        (Host(`${MENDER_HOSTNAME:-docker.mender.io}`) || Host(`localhost`) || Host(`traefik`)) &&
+        PathRegexp(`/api/management/v[0-9a-z]+/devicemonitor`)
+      traefik.http.routers.devicemonitorMgmt.service: devicemonitor
+    networks:
+      default:
+        aliases: [mender-devicemonitor]
+
+  generate-delta-worker:
+    build:
+      context: .
+      dockerfile: ./backend/services/generate-delta-worker/Dockerfile
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/generate-delta-worker:${MENDER_IMAGE_TAG:-latest}
+    restart: on-failure:3
+    depends_on:
+      - workflows
+    environment:
+      GENERATE_DELTA_DEPLOYMENTS_URL: http://deployments:8080
+      WORKFLOWS_MONGO_URL: "mongodb://mongo"
+      WORKFLOWS_NATS_URI: "nats://nats"
+
+  gui:
+    environment:
+      HAVE_AUDITLOGS: "1"
+      HAVE_DELTA_PROGRESS: "1"
+      HAVE_ENTERPRISE: "1"
+      HAVE_MONITOR: "1"
+      HAVE_MULTITENANT: "1"
+
+  inventory:
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/inventory:${MENDER_IMAGE_TAG:-latest}
+    environment:
+      INVENTORY_REDIS_CONNECTION_STRING: "redis://redis:6379"
+      INVENTORY_REDIS_LIMITS_EXPIRE_SEC: "1800"
+
+  iot-manager:
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/iot-manager:${MENDER_IMAGE_TAG:-latest}
+
+  useradm:
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/useradm:${MENDER_IMAGE_TAG:-latest}
+    environment:
+      USERADM_REDIS_CONNECTION_STRING: "redis://redis:6379"
+      USERADM_REDIS_LIMITS_EXPIRE_SEC: "3600"
+      USERADM_ORCHESTRATOR_ADDR: "http://workflows:8080"
+      USERADM_TENANTADM_ADDR: "http://tenantadm:8080"
+      USERADM_HAVE_ADDONS: "1"
+      USERADM_ENABLE_AUDIT: "1"
+
+  tenantadm:
+    build:
+      context: .
+      dockerfile: ./backend/services/tenantadm/Dockerfile
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/tenantadm:${MENDER_IMAGE_TAG:-latest}
+    restart: on-failure:3
+    command: [server, --automigrate]
+    depends_on:
+      - mongo
+    environment:
+      TENANTADM_MONGO: "mongodb://mongo"
+      TENANTADM_AUDITLOGS_ADDR: http://auditlogs:8080/
+      TENANTADM_ORCHESTRATOR_ADDR: http://workflows:8080/
+      TENANTADM_USERADM_ADDR: http://useradm:8080/
+      TENANTADM_DEVICEAUTH_ADDR: http://deviceauth:8080/
+      TENANTADM_DEPLOYMENTS_ADDR: http://deployments:8080/
+    labels:
+      traefik.enable: "true"
+      traefik.http.services.tenantadm.loadBalancer.server.port: "8080"
+      traefik.http.routers.tenantadm.middlewares: "mgmtStack@file"
+      traefik.http.routers.tenantadm.rule: >-
+        (Host(`${MENDER_HOSTNAME:-docker.mender.io}`) || Host(`localhost`) || Host(`traefik`)) &&
+        PathRegexp(`/api/management/v[0-9a-z]/tenantadm`)
+      traefik.http.routers.tenantadm.service: tenantadm
+      traefik.http.routers.signup.middlewares: >-
+        compression@file,sec-headers@file
+      traefik.http.routers.signup.rule: >-
+        (Host(`${MENDER_HOSTNAME:-docker.mender.io}`) || Host(`localhost`) || Host(`traefik`)) &&
+        ((Method(`OPTIONS`) || Method(`POST`)) && PathRegexp(`/api/management/v[0-9a-z]+/tenantadm/tenants/signup`) ||
+        (Method(`OPTIONS`) || Method(`POST`)) && PathRegexp(`/api/management/v[0-9a-z]+/tenantadm/tenants/trial`))
+      traefik.http.routers.signup.service: tenantadm
+    networks:
+      default:
+        aliases: [mender-tenantadm]
+
+  workflows-worker:
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/workflows:${MENDER_IMAGE_TAG:-latest}
+    environment:
+      AUDITLOGS_ADDR: auditlogs:8080
+      DEVICEMONITOR_ADDR: devicemonitor:8080
+      TENANTADM_ADDR: tenantadm:8080
+      HAVE_AUDITLOGS: "1"
+
+  workflows:
+    image: ${MENDER_IMAGE_REGISTRY:-registry.mender.io}/${MENDER_IMAGE_REPOSITORY:-mender-server-enterprise}/workflows:${MENDER_IMAGE_TAG:-latest}
+
+  redis:
+    image: ${MIRROR_REGISTRY:-docker.io}/library/redis:8.8
+    networks:
+      default:
+        aliases: [mender-redis]

mender_testkit/data/mender_server/compose/docker-compose.seaweedfs.yml

@@ -0,0 +1,102 @@
+configs:
+  s3-conf:
+    content: |
+      {
+        "identities": [
+          {
+            "name": "mender",
+            "credentials": [
+              {
+                "accessKey": "${MENDER_ACCESS_KEY_ID:-mender}",
+                "secretKey": "${MENDER_SECRET_ACCESS_KEY:-thisisnotsecure}"
+              }
+            ],
+            "actions": [
+              "Admin:mender",
+              "Read:mender",
+              "Write:mender",
+              "List:mender",
+              "Tagging:mender"
+            ]
+          }
+        ]
+      }
+
+services:
+  s3-master:
+    image: ${MIRROR_REGISTRY:-docker.io}/chrislusf/seaweedfs:4.22
+    command:
+      - master
+      - -mdir=/data
+      - -ip=s3-master
+      - -ip.bind=0.0.0.0
+      - -electionTimeout=1s
+      - -heartbeatInterval=200ms
+      - -raftHashicorp=true
+    volumes:
+      - s3:/data
+
+  s3-volume:
+    image: ${MIRROR_REGISTRY:-docker.io}/chrislusf/seaweedfs:4.22
+    command:
+      - volume
+      - -mserver=s3-master:9333
+      - -ip.bind=0.0.0.0
+      - -port=8080
+      - -dir=/data
+      - -preStopSeconds=0
+    depends_on:
+      - s3-master
+    volumes:
+      - s3:/data
+
+  s3-filer:
+    image: ${MIRROR_REGISTRY:-docker.io}/chrislusf/seaweedfs:4.22
+    command:
+      - filer
+      - -master=s3-master:9333
+      - -ip.bind=0.0.0.0
+    depends_on:
+      - s3-master
+      - s3-volume
+    volumes:
+      - s3:/data
+
+  s3:
+    image: ${MIRROR_REGISTRY:-docker.io}/chrislusf/seaweedfs:4.22
+    command:
+      - s3
+      - -port=8080
+      - -filer=s3-filer:8888
+      - -ip.bind=0.0.0.0
+      - -config=/etc/seaweedfs/s3.conf
+    depends_on:
+      - s3-master
+      - s3-volume
+      - s3-filer
+    configs:
+      - source: s3-conf
+        target: /etc/seaweedfs/s3.conf
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.s3.priority: "99999"
+      traefik.http.routers.s3.rule:
+        (Host(`s3.${MENDER_HOSTNAME:-docker.mender.io}`) ||
+        Host(`${MENDER_HOSTNAME:-docker.mender.io}`) ||
+        Host(`localhost`)) &&
+        PathPrefix(`/mender`)
+      traefik.http.services.s3.loadBalancer.server.port: "8080"
+    healthcheck:
+      test:
+        - CMD
+        - /usr/bin/nc
+        - -z
+        - 127.0.0.1
+        - "8080"
+      interval: 5s
+      retries: 10
+    volumes:
+      - s3:/data
+
+volumes:
+  s3: {}